Is it possible to VPN within the same network?

VPN
1

I have Wireguard setup on an Ubuntu server in my home, and I also have it setup on my rooted Android phone. My home router is a Mikrotik hEX.

Wireguard is extremely fast. So fast I don’t even notice I’m using a VPN. For this reason, I’d really like to just turn Wireguard on in my phone and leave it, so that I don’t have to remember to turn it on every time I leave the house.

The problem is, when I’m connected to my home network (the same network running the Wireguard server) while Wireguard is enabled on my phone, I can’t connect to the internet.

I asked about this on the Wireguard IRC, and someone there told me I need to deal with this in my router/home network. I asked in the Mikrotik IRC and I was told this needed to be dealt with through Wireguard. So I’m completely lost on how to handle this. I don’t even know where to start looking and I’m pretty green when it comes to networking, so anything would be helpful at this point.

Oh and I don’t know if this is helpful or not, but Wireguard uses all the familiar Linux networking tools like ip route, ip tables, etc.

Here is an example Wireguard server configuration file:

[Interface] 

Address = 192.168.3.1/24 

ListenPort = 51820 

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE 

PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE 

PrivateKey = $(wg genkey) 

SaveConfig = true 

[Peer] 

PublicKey = CLIENT_PUBLIC_KEY

 AllowedIPs = CLIENT_VPN_IP/32

Maybe I can add something to these PostUp and PostDown scripts?

2

You will need to enable NAT Loopback, also known as NAT hairpinning, also known as NAT Reflection, in order to connect to your own network.

3

Although I can’t give you a full solution, I believe you can achieve this with the use of Tasker. I’ve seen similar tasks performed with Tasker.

4

In principle, it is possible to connect back into the same Network using VPN. It definitely works for the SoftEther Server I have running on a Raspberry Pi at home.

It might be a DHCP issue. Depending on how exactly the VPN works, the phone could Show up with the same MAC for your router, so it doesn’t get an IP address for the VPN Connection.

I am not familiar with Wireshark specifically, but do you have a way to set up specific IP addresses for VPN Client devices? Alternatively, adding a NAT layer for the VPN might also work.

5

Ah ha, that is what I was looking for, thank you.

/u/Jsreb solved the issue for me, but I’m going to look into this anyways. :slight_smile:

EDIT: Yep, this looks like exactly what I was looking for.

Thanks again!

6

Other option and more secure is running local DNS and direct the domain to your local IP.

7

Ah, on the phone itself? I hadn’t heard of Tasker until now.

I’ll look into this. Thank you.

8

Hot damn, that was easy.

New profile → when this wifi is no longer connected, run this task → execute shell command wg-quick up wg0

Thanks so much!

9

Hey thanks for the reply.

t might be a DHCP issue. Depending on how exactly the VPN works, the phone could Show up with the same MAC for your router, so it doesn’t get an IP address for the VPN Connection.

I am not familiar with Wireshark specifically, but do you have a way to set up specific IP addresses for VPN Client devices? Alternatively, adding a NAT layer for the VPN might also work.

Wireguard works by creating a separate interface on the device. So you would have eth0, but then also wg0 (or whatever you have named it). I believe Wireguard works similar to openVPNs tun interface.

Here’s a simple overview of how it works.

10

I was mostly thinking about how the Client devices are represented once they sign up. If - for example - your phone appears with the same MAC through the VPN Interface as it has normally, your DHCP Server might try to assign the same IP address your phone got before, which obviously doesn’t work, because that is already in use.

The safest solution would be using a different subnet for the VPN Logins.

Another possible way, not directly related to the VPN itself, might be using Task planners or triggered Tasks on your phone. I have used a scheduled Task on my tablet to check on any new Network Connection if the assigned Gateway device has the same MAC as my home router. If it didn’t see my home router, it would log into my VPN connection automatically.

I assume something similar would be possible on Android phones.

11

Another possible way, not directly related to the VPN itself, might be using Task planners or triggered Tasks on your phone. I have used a scheduled Task on my tablet to check on any new Network Connection if the assigned Gateway device has the same MAC as my home router. If it didn’t see my home router, it would log into my VPN connection automatically.

Thanks to /u/Jsreb comment, that’s exactly what I just did and it was extremely simple to automate using “Tasker”.

Wireguard includes some easy to use bash scripts wg-quick up wg0 and wg-quick down wg0 to quickly create and delete the interface.

So it was pretty easy to create a new task:

when this wifi is no longer connected, run this task → execute shell command wg-quick up wg0

and then the reverse when connecting to my home network again.

Thanks again for the help!

12

Ah, nice and clean. I like that solution.