Wireguard + BGP setup

[roopeshsn]

In my setup, I've two hosts (host1 and host2) that form a Wireguard tunnel between the cloud server (host1 --- cloud server --- host2). Over WireGuard there is a BGP neighborship between host1 and host2 using FRRouting.

Below are the wireguard tunnel interfaces IP addresses:
host1: 10.0.0.3/32
cloud server: 10.0.0.10/24
host2: 10.0.0.4/32

Say on host1, I created a loopback interface that has an IP address of 100.100.100.1/32 and advertised it to host2. I see that host2's routing table has the following entry for the prefix 100.100.100.1/32:

root@019b3308f344:/# ip route get 100.100.100.1
100.100.100.1 via 10.0.0.3 dev wg0 src 10.0.0.4 uid 0
    cache

Ping from host2 to 100.100.100.1 didn't work as it doesn't have a tunnel to 10.0.0.3 which is host1.

root@019b3308f344:/# ping 100.100.100.1
PING 100.100.100.1 (100.100.100.1) 56(84) bytes of data.
From 10.0.0.4 icmp_seq=1 Destination Host Unreachable
ping: sendmsg: Required key not available
From 10.0.0.4 icmp_seq=2 Destination Host Unreachable
ping: sendmsg: Required key not available
...

To address this I added the prefix 100.100.100.1/32 in the list of AllowedIPs in wg0.conf in host2.

root@019b3308f344:/# cat /etc/wireguard/wg0.conf
[Interface]
PrivateKey = SC1iMBIBVI3tIGmWQ7LvZdGXAqqWAueDlew7IiFckk8=
Address = 10.0.0.4/24

[Peer]
PublicKey = WdFWaWzgFYqcCEVgnkphNkWKu3u9N6cYnki87GXFhX0=
Endpoint = 172.232.112.230:51820
AllowedIPs = 10.0.0.0/24, 100.100.100.1/32
PersistentKeepalive = 25

Now the route points to the wg tunnel interface directly, and the ping worked!

root@019b3308f344:/# ip route get 100.100.100.1
100.100.100.1 dev wg0 src 10.0.0.4 uid 0
    cache

But by doing the above change I feel there is no use of BGP here.

My question is if I use Plexus, will this limitation be taken care of? As Plexus is an agent running in the clients or hosts, will advertisement and route installation or modification be taken care of? @mattkasun

[mattkasun]

there are a couple of ways to achieve the network connectivity you describe about but as with pure wireguard, BGP would not be used.

[roopeshsn]

Do we have any dynamic way of doing this? Can Plexus help with this?

[mattkasun]

You could create a second plexus network with cidr of 10.100.100.0/24 and have the 3 machine join that network

[roopeshsn]

So should another tunnel interface be needed to be created on the clients in the 10.100.100.0/24 range?

[mattkasun]

So should another tunnel interface be needed to be created on the clients in the 10.100.100.0/24 range?

correct