How to Connect Two Homes with a WireGuard Site-to-Site VPN (Reach Mum's Network from Yours)
Tutorial 33 connected devices to your home. A site-to-site tunnel connects two networks: a server (or Pi) at each house, a WireGuard link between them, and routes so that every device at house A can reach every device at house B by its normal address. The classic use is an off-site backup box at a relative's — restic sends to it nightly over the tunnel — but it's equally a camera at the holiday home or a shared Pi-hole for both houses.
Quick reference
| House A (yours) | House B (relative's) | |
|---|---|---|
| LAN | 192.168.1.0/24 | 192.168.2.0/24 — must differ |
| Tunnel address | 10.9.0.1 | 10.9.0.2 |
| WireGuard box | server, 192.168.1.50 | Pi, 192.168.2.50 |
| Public reachability | port 51820/udp forwarded | not needed if A is reachable |
| Router route | 192.168.2.0/24 via 192.168.1.50 | 192.168.1.0/24 via 192.168.2.50 |
1. The two LANs must have different ranges
Both houses on 192.168.1.x can't be joined. Change one router's LAN to 192.168.2.0/24 (B is usually easier). Do this first.
2. Keys on both boxes
On each (sudo apt install wireguard -y if needed):
wg genkey | sudo tee /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key
sudo chmod 600 /etc/wireguard/private.key
Note each box's public key; swap them.
3. House A config (the one with a port forward)
sudo nano /etc/wireguard/wg0.conf
[Interface]
Address = 10.9.0.1/24
ListenPort = 51820
PrivateKey = <A private key>
PostUp = sysctl -w net.ipv4.ip_forward=1
[Peer]
# House B
PublicKey = <B public key>
AllowedIPs = 10.9.0.2/32, 192.168.2.0/24
PersistentKeepalive = 25
AllowedIPs is both "who may be behind this peer" and "what to route to it": B's tunnel address and B's whole LAN.
Forward UDP 51820 on A's router to 192.168.1.50; sudo ufw allow 51820/udp. A dynamic DNS name for A (tutorial 48) saves editing B when the IP changes.
4. House B config
[Interface]
Address = 10.9.0.2/24
PrivateKey = <B private key>
PostUp = sysctl -w net.ipv4.ip_forward=1
[Peer]
# House A
PublicKey = <A public key>
Endpoint = myhome.duckdns.org:51820
AllowedIPs = 10.9.0.1/32, 192.168.1.0/24
PersistentKeepalive = 25
B initiates to A, so B needs no port forward at all — it can sit behind CGNAT. PersistentKeepalive keeps the tunnel up through B's NAT.
5. Bring it up
On both:
sudo systemctl enable --now wg-quick@wg0
sudo wg show
latest handshake: 12 seconds ago on both ends means the tunnel is live. ping 10.9.0.2 from A and ping 10.9.0.1 from B.
6. Make the whole LAN reachable
Right now only the two WireGuard boxes know about the tunnel. Two ways to teach the rest:
Routes on the routers (best): on A's router, a static route 192.168.2.0/24 → 192.168.1.50; on B's, 192.168.1.0/24 → 192.168.2.50. Every device at each house can then reach the other house by address, no changes on the devices. Most routers have this under Static routes / Routing.
NAT on the WireGuard boxes (if a router can't do routes): add to each [Interface]:
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
(interface name from ip link). Devices at B see traffic as coming from B's WireGuard box; fine for backups and cameras, slightly less tidy.
Test from a laptop at A: ping 192.168.2.50, then open B's camera or Pi-hole page.
7. Use it
- Off-site backup: restic/rclone from A to an SFTP or REST target on B's Pi (tutorials 55, 116) — 192.168.2.50 in the script, nothing else special.
- Shared Pi-hole/Unbound: B's router DNS → 192.168.1.50. (Tolerates A being down? Set B's secondary DNS to a public one.)
- Cameras, Home Assistant, printers: just addresses now.
- Monitoring: Uptime Kuma at A pings B's devices; Healthchecks catches B's backup not running.
Troubleshooting
Handshake never completes. A's port forward or firewall, the endpoint name not resolving, or keys swapped the wrong way round. sudo wg show on both.
Tunnel up, boxes ping, LAN devices don't. Missing router routes (step 6) or ip_forward not set. Check sysctl net.ipv4.ip_forward on both.
Works one way only. One router has the route, the other doesn't; or B's AllowedIPs is missing A's LAN.
Both houses were 192.168.1.x. Nothing will work until one changes; there's no routing trick around it.
Slow. It's limited by the slower house's upload speed. For backups that's fine; for streaming video from B, probably not.
Wrapping up
Different LAN ranges, a key pair each, one config per box with the other's LAN in AllowedIPs, a static route on each router. Two houses become one network, and the backup box under a relative's stairs is a local address that restic writes to every night.
