Do bazy wiedzy
Dokument informacyjny #3686

Setting up a WireGuard VPN between two FRITZ! networks

WireGuard allows you to connect two FRITZ! networks (FRITZ!Box network or FRITZ!Repeater network) at different locations over the internet via a secure, encrypted VPN connection (LAN-LAN linkup). This allows you to access all of the devices in the remote network and use all of the IP-based services such as email servers, data banks, and file servers at both locations.

You can find an overview of additional VPN connection options in our guide VPN with FRITZ!.

Example values used in this guide

In this guide we show you how to connect a FRITZ!Repeater in a branch with a FRITZ!Box in the headquarters. When setting up the connection, replace the values used in this guide with your actual values.

Requirements / Restrictions

  • The FRITZ!Repeater (branch) must be configured as a router for internet access via a fiber optic or cable modem. VPN is not available when it is used as an IP client.

    Note:If you are operating the FRITZ!Repeater with a FRITZ!Box, configure the VPN connection in the FRITZ!Box.

  • The FRITZ!Box (headquarters) must obtain either an IPv6 address or a public IPv4 address from the internet service provider. The FRITZ!Repeater (branch) must obtain an IP address with the same protocol version (IPv4 or IPv6) from the internet service provider.
  • FRITZ!OS 7.50 or later is installed on the FRITZ!Box (headquarters).

Note:All instructions on configuration and settings given in this guide refer to the latest FRITZ!OS for the FRITZ!Repeater.

1 Preparations

Configuring MyFRITZ!

Register the FRITZ! products (FRITZ!Box or FRITZ!Repeater) with MyFRITZ!Net so that they can always be reached on the internet at fixed MyFRITZ! addresses:

Setting up MyFRITZ!
  1. Click "Internet" in the user interface of the FRITZ!Repeater.
  2. Click "MyFRITZ! Account" in the "Internet" menu.
  3. Enter your email address in the "Your email address" field.
  4. Click "Apply". Now MyFRITZ!Net sends you an email with the confirmation link to your FRITZ!Repeater.

    Important:If you do not receive an email, the email was classified as unsolicited advertising (spam). In this case, check the spam folder of your email inbox.

  5. Open the email you received from MyFRITZ!Net.
  6. Click the "Register Your FRITZ!Repeater" button in the email.

Adapting the IP networks

VPN communication is not possible if both FRITZ! products use the same IP network. Since all FRITZ!Boxes and FRITZ!Repeaters use the IP network 192.168.178.0 in the factory settings, configure IP addresses from different IP networks in the FRITZ! products:

Example:
In this guide, the FRITZ!Repeater (branch) has the IP address 192.168.20.1 (subnet mask 255.255.255.0) and the FRITZ!Box (headquarters) has the IP address 192.168.10.1 (subnet mask 255.255.255.0).

Changing the FRITZ!Repeater's IP network
  1. Click "Home Network" in the user interface of the FRITZ!Repeater.
  2. Click on "Network" in the "Home Network" menu.
  3. Click on the "Network Settings" tab.
  4. Click "Additional Settings" in the section "LAN Settings" to display all of the settings.
  5. Click the "IPv4 Settings" button.
  6. Enter the desired IP address and subnet mask.
  7. Click "Apply" to save the settings and on the FRITZ!Repeater, confirm that the procedure may be executed, if you are asked to do so.

2 Downloading WireGuard settings from FRITZ!Repeater (branch)

The following steps are only necessary if WireGuard connections are already configured in FRITZ!Repeater (branch) (for example for a mobile device):

  1. Click "Internet" in the user interface of the FRITZ!Repeater (branch).
  2. Click "Permit Access" in the "Internet" menu.
  3. Click on the "VPN (WireGuard)" tab.
  4. Click the "Display WireGuard Settings" button.
  5. If you are asked to do so, on the FRITZ!Repeater confirm that the procedure may be executed and click "OK" to complete the procedure.
  6. Click "Download Configuration File" and download the file with the extension ".conf" to the computer.

3 Configuring the FRITZ!Box (headquarters)

  1. Click "Internet" in the user interface of the FRITZ!Box (headquarters).
  2. Click "Permit Access" in the "Internet" menu.
  3. Click on the "VPN (WireGuard)" tab.
  4. Click the "Add Connection" button.
  5. Click "Connect networks or establish special connections" and then "Next".
  6. By "Has this WireGuard connection already been set up at the remote connection?", click "No".
  7. If no WireGuard connections have been set up in FRITZ!Repeater (branch) yet:
    1. By "Should the new WireGuard connection be used used concurrently with an existing connection on the remote site?", click "No".
    2. By "Is the connection to be made with a single device (laptop, smartphone, tablet), or a router that supports WireGuard (such as a FRITZ!Box)?", click "Router with WireGuard support".
    3. Click "Next".
    4. Enter a unique name for the connection (FRITZ!Repeater branch) in the field "Name of the WireGuard connection".
    5. Enter the IP network of the FRITZ!Repeater (192.168.20.0) in the "Remote IPv4 network:" field.
    6. In the "Subnet mask" field, enter the subnet mask that corresponds to the FRITZ!Repeater's IPv4 network (255.255.255.0).
    7. In the "IPv6 address (/64)" field, enter the IPv6 address (Unique Local Address) of the FRITZ!Repeater (fdfb:a446:9719::b2f2:8ff:fe6a:e378).

      Note:The IPv6 address (Unique Local Address) is displayed in the FRITZ!Repeater under "Home Network > Network > Network Settings > IPv6 Settings > Unique local address of your FRITZ!Repeater".

  8. If WireGuard connections have already been set up in the FRITZ!Repeater (branch):
    1. By "Should the new WireGuard connection be used used concurrently with an existing connection on the remote site?", click "Yes".
    2. Click "Yes" by "Should the settings file of the remote site be imported and the new connection be appended automatically?".
    3. Click "Next".
    4. Enter a unique name for the connection (FRITZ!Repeater branch) in the field "Name of the WireGuard connection".
    5. Click the "Choose File" or "Browse..." button.
    6. Select the settings file for the WireGuard connection that you downloaded from the FRITZ!Repeater (Conf file) and click "Open".
    Configuring a WireGuard connection in the FRITZ!Box (headquarters)
  9. If available, enable the option "Allow NetBIOS over this connection".
  10. If only certain devices in the home network of the FRITZ!Box (headquarters) should be reachable via VPN, enable the option "Only certain devices in the home network are to be accessible over this WireGuard connection" and select the corresponding devices.
  11. Click the "Finish" button.
  12. If you are asked to do so, on the FRITZ!Repeater confirm that the procedure may be executed and click "OK" to complete the procedure.
  13. Click "Download Settings" and download the file with the extension ".conf" to the computer.

4 Setting up the FRITZ!Repeater (branch)

  1. Click "Internet" in the user interface of the FRITZ!Repeater (branch).
  2. Click "Permit Access" in the "Internet" menu.
  3. Click on the "VPN (WireGuard)" tab.
  4. Click the "Add Connection" button.
  5. Click "Connect networks or establish special connections" and then "Next".
  6. By "Has this WireGuard connection already been set up at the remote connection?", click "Yes".
  7. Click "Next".
  8. Enter a unique name for the connection (FRITZ!Box headquarters) in the field "Name of the WireGuard connection".
  9. Click the "Choose File" or "Browse..." button.
  10. Select the settings file for the WireGuard connection that you downloaded from the FRITZ!Box (Conf file) and click "Open".
  11. If you do not only want to use the VPN connection to access the remote network, but also want all web requests to be sent over the VPN connection to the FRITZ!Box (headquarters), enable the option "Send all IPv4 network traffic via the VPN connection".
  12. Enable the option "Allow NetBIOS over this connection" if access to Windows file and printer sharings (SMB shares) in the remote network should be allowed.
  13. If only certain devices in the home network of the FRITZ!Repeater (branch) should be reachable via VPN, enable the option "Only certain devices in the home network are to be accessible over this WireGuard connection" and select the corresponding devices.
  14. Click the "Finish" button.
  15. If you are asked to do so, on the FRITZ!Repeater confirm that the procedure may be executed and click "OK" to complete the procedure.

Now the VPN connection between both FRITZ! networks is configured and the FRITZ!Repeater (branch) is permanently connected to the FRITZ!Box (headquarters).



Help topics:

Related topics:

Wybór języka