WireGuard setup with internet access only
I'd like to setup a WireGuard server, on a way, that any client connecting to it, would have access only to the internet, but no access to anything in the local network.
My ER605 router is behind the ISP modem (what is in normal NAT mode, not bridge mode). All LAN clients are connected directly to the router. Omada Controller runs from a docker container in LAN.
I've succesfully setup the WireGuard server, can connect and it works, but cant figure out how to deny access to the local network.
What I've tried, is to define a VLAN, configure Wireguard peers to use IPs from that VLAN, and created a Gateway ACL to block the VLAN to access LAN.
Any ideas why this isnt working, and how to fix it?
WAN setup:
LAN setup:
VLAN for WireGuard setup:
WireGuard server:
WireGuard client:
Gateway ACL:
@Clive_A "Doesnt work" means, that I can connect from my external android client, over the internet, to this server succesfully:
And then I can successfully access an address inside the localnetwork of the server, when I should not.
I would like to be able to setup the wireguard server on the router on a way, that whoever connects to it, can access only public internet addresses, but nothing in the local network. All 192.168.0.xxx should be blocked.