Site-to-site VPN

A site-to-site VPN is a particular use case for a VPN tunnel where the goal is not to route all traffic from network A into the VPN, but rather to grant network A access to network B remotely. This is also sometimes called a “split-tunnel”, “split-brain”, or a “split-routing” VPN.

The general setup is typically like this:

• Diagram split-route VPN

OpenWRT & Wireguard setup

For this example, I’m using a Wireguard VPN client on an OpenWRT router.

1. Create a new Wireguard interface:
   1. OpenWRT LuCI ⇒ Network ⇒ Interfaces
   2. “Create New Interface” at the bottom of the list
   3. Give it a name, and select Protocol = WireGuard VPN
   4. In the General Settings tab:
      1. Confirm “Disable this interface” ⇒ unchecked
      2. Confirm “Bring up on boot” ⇒ checked
      3. Click “Generate new key pair”
      4. Confirm “Listen Port” is blank
   5. In the Firewall tab:
      1. Assign or create a new firewall zone
   6. Save and apply changes
2. Acquire the config file
   1. This will typically involve generating or getting a wireguard config from the admin of the network you want to connect to.