UniFi UDM - routing Wireguard VPN traffic over IPSEC tunnel

Networking & Firewalls
1

Over the weekend I swapped out 3 watchguard firewalls at our own office sites for 3 UniFi devices.

The process went smoothly for the most part except for the inability to port-forward L2TP ports through the UDM-PRO-MAX with a site-to-site IPSEC tunnel present. (Which the fireboxes could handle ok) - SSTP and L2TP were/are being handled by a MS RRAS server with Radius Auth

(and yes I was planning to replace both the L2TP and the working SSTP VPN connections with something more modern but wanted to keep things the same during the device switch)

I’ve set up the wireguard VPN server on the UDM-PRO-MAX at the primary site (I’m aware that L2TP and OpenVPN definitely won’t be able to route to the AWS resources) and configured a test client which is able to connect and can access the Site A LAN as well as the internal networks at sites B & C via the UniFi Site magic connections. However all traffic directed to the remote AWS subnet terminates on the wireguard subnet gateway.

Can anyone advise if it’s possible to configure the routing to allow Wireguard clients to access the AWS VPC over the IPSEC tunnel (route based)? The IPSEC settings only allow for additional remote networks to be added as I believe the UDM handles the local netowrk side of things?

Simplified diagram:

image
image703×450 34.4 KB

I guess if it can’t be resolved I’ll just need to configure a wireguard server within the LAN but I’d prefer for the UDM to handle it if possible.

Any advice would be gratefully received!

Thanks Tim.

2

Welcome to the forums, this is not a configuration I have ever tried so I am not certain if it is possible. Maybe someone will post if they have got this to work.

3

Thanks for the reply Tom.

The users are getting restless so I may drop back to the UDM OpenVPN server so I can at least use Radius Auth/MFA on the client connections and not have to worry about manually assigning peer addresses; then set up an nginx proxy manager instance within the Site A LAN to handle the routing of the traffic to AWS (most of the internal systems we have hosted there are web based - but sensitive).

[Apparently my suggestion of why don’t you just use Windows like the majority of the company wasn’t received well :face_savoring_food:]

Tim.

4

Here’s what I would do:

  1. Nuke the IPSEC tunnel
  2. Install either Wireguard or OpenVPN server on the AWS VPC
  3. Configure VPN client on the UDM-PRO-MAX to the AWS server
  4. Create a routing policy on the UDM-PRO-MAX to send traffic matching AWS IPs out the AWS VPN client