WireGuard Server and LAN Access

[MadPup]

I've been trying to set up WireGuard server on my AX88U router in order to access LAN resources from anywhere using my Android phone. The only way I've been able to get it to work is to set the tunnel IP to the same IP as the router LAN IP (192.168.1.1), and set the client IP to an IP in the LAN range (192.168.1.2). None of the documentation or tutorials that I can find suggest doing this but instead show using a completely different private subnet (10.6.0.x) for the VPN, but I don't see how my phone on that subnet could access devices on the LAN subnet. What mm I missing?

 

[bennor]

In the Wireguard Server setting on the router, did you enable Access Intranet?
[Wireless Router] How to set up WireGuard® VPN server?
No problem using stock WireGuard settings on Asus-Merlin firmware to access local network clients from an Android phone with the Access Intranet option enabled and the Wireguard IP's set to 10.6.0.1/32. One may have to configure local network device firewalls to allow access from the 10.6.0.x range used by the WireGuard tunnel if those devices block access from ranges other than local LAN default.

From the Asus link, an example of the WireGuard Server settings showing the Access Intranet option.

 

[jacklul]

Windows firewall blocks non-LAN ranges by default for file shares.
Alternative to modifying firewall on each device is setting masquerade rule on the router instead.

 

[MadPup]

Thank you for your suggestions. I believe i have it mostly working now...

I have verified that devices I am trying to access on the LAN are indeed blocking the VPN subnet, so those are working now. However there is still one exception, and it is my main motivation for using a VPN. I have IP security cams that I have blocked from accessing the Internet (a router option) because I don't trust them. With them blocked, I am unable to access them over the VPN.