February 2, 2025

WireGuard for Site-to-Site Connections

How to build secure, high-performance site-to-site VPN tunnels between three locations using WireGuard and policy-based routing.

Learn how to create secure, high-performance site-to-site VPN tunnels with WireGuard and policy-based routing. This guide connects three remote sites while controlling traffic flow efficiently.

Scenario overview

Site A (HQ) – 192.168.1.0/24
Site B (Branch 1) – 192.168.2.0/24
Site C (Branch 2) – 192.168.3.0/24

Prerequisites

Linux server or router with WireGuard installed
Public IP addresses for each site
Firewall rules allowing UDP traffic on WireGuard port 51820

Step 1: Install WireGuard

sudo apt update && sudo apt install wireguard -y
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Step 2: Generate keys for each site

wg genkey | tee privatekey | wg pubkey > publickey

Step 3: Configure WireGuard interfaces

Site A configuration

[Interface]
PrivateKey = <Site A private key>
Address = 10.0.0.1/24
ListenPort = 51820

[Peer]
PublicKey = <Site B public key>
AllowedIPs = 192.168.2.0/24
Endpoint = <Site B public IP>:51820
PersistentKeepalive = 25

[Peer]
PublicKey = <Site C public key>
AllowedIPs = 192.168.3.0/24
Endpoint = <Site C public IP>:51820
PersistentKeepalive = 25

Site B configuration

[Interface]
PrivateKey = <Site B private key>
Address = 10.0.0.2/24
ListenPort = 51820

[Peer]
PublicKey = <Site A public key>
AllowedIPs = 192.168.1.0/24
Endpoint = <Site A public IP>:51820
PersistentKeepalive = 25

[Peer]
PublicKey = <Site C public key>
AllowedIPs = 192.168.3.0/24
Endpoint = <Site C public IP>:51820
PersistentKeepalive = 25

Site C configuration

[Interface]
PrivateKey = <Site C private key>
Address = 10.0.0.3/24
ListenPort = 51820

[Peer]
PublicKey = <Site A public key>
AllowedIPs = 192.168.1.0/24
Endpoint = <Site A public IP>:51820
PersistentKeepalive = 25

[Peer]
PublicKey = <Site B public key>
AllowedIPs = 192.168.2.0/24
Endpoint = <Site B public IP>:51820
PersistentKeepalive = 25

Step 4: Policy-based routing

Create routing tables and rules for controlled traffic flow between sites.

Routing tables

echo "200 siteB" | sudo tee -a /etc/iproute2/rt_tables
echo "201 siteC" | sudo tee -a /etc/iproute2/rt_tables

Routing rules

# Example for Site A
ip rule add from 192.168.1.0/24 table siteB
ip route add 192.168.2.0/24 via 10.0.0.2 dev wg0 table siteB
ip rule add from 192.168.1.0/24 table siteC
ip route add 192.168.3.0/24 via 10.0.0.3 dev wg0 table siteC

Step 5: Enable the WireGuard service

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

Testing the tunnel

Ping from Site A to Site B: ping 192.168.2.1
Ping from Site C to Site A: ping 192.168.1.1

Conclusion

This guide shows how to establish a secure, high-performance site-to-site VPN with WireGuard and policy-based routing. Traffic between sites flows according to predefined rules, keeping things efficient and secure.

← Back to blog