A couple of years ago I created a IP Sec tunnel betweem my RoadLAB and HomeLAB so I could access my home network and use my home as a my breakout online. In effect I was home. However it turned out to be a fragile setup. More ofton the not did it not really work. I never go the traffic from my Apple TV to go really go through the tunnel. The downside is that the Delta TV app on my Apple TV requieres that I am connected to the Delta network to use it. The annoying part is that the iPad and iPhone app does work from other networks.

Solution attempt 1

Since I am using Twingate to connect to my HomeLAB, why not see if it is possible to connect the two (RoadLAB & HomeLAB)

It might be possible, but the the connection is not really stable. Although I was able to connect to webservices through this Twingate connection, streaming was simply not possible using the site-site solution. Using the Twingate client does support streaming, but alas there is no Apple TV client for the Twingate solution. Also I only would be able to connect to the HomeLAB network. I still would need to route my traffic from the Apple TV back home and then out to the internet.

Back to “classic” VPN solutions. At least then I have a point-point connection. And I might be able to route the traffic as desired.

VPN

For me I rather not use the IPSec tunnel or the OpenVPN solution. In most locations my RoadLAB does not have a public IP address, but are we using a NAT solution. So in effect I am doing a double NAT. Workable if you do not need access from outside. And even if I need to access the RoadLAB LAN, I can use Twingate for that. Since in the past I did setup WireGuared Road Warrior a couple of times, the ease I could get it to work and the fact that WireGuard VPN is simple to setup.

Solution attempt 2

Finally I got it working. Using a nifty combination of three how-to’s of the OPNSense Documentation:

Implementation

I figured out a way to combine (elements) of these three how-to’s. In my opinion this should work. At the same time it is a nice challenge!

Road Warrior

First I got the basic road warrior setup working. Testing it from my iPad and now I have the posibility to connect to my home using WireGuard. I am able to connect to the home network and back out online if I need to. Next step is a bit harder.

Proton Road Warrior VPN

Since I also have a Proton account, why nog try to implement this as well. Following the how-to work as expected. I am now able to selectivly send data through the Proton VPN, using the OPNSense gateway as a routing service. Pretty cool. Seeing this approach in action, I should be able to get to my end-goal.

Connecting the RoadLAB gateway to HomeLAB

Following the same rythem as in the Proton Road Warrior VPN I used the credentials to create the connection. And pretty fast it worked. I did ran into some stupid mistake I made. When setting the UDP port on my Home OPNSense gateway it really helps to use the excact same port. Stupid me, switched two ports…. The most annoying part in troubleshooting this that even when you use the wrong port. The WireGuard client say connected, while it clearly cannot, since that port is not open open… But in the end found the issue and now it really works. Now there is a connection to my HomeLAB network.

Selective Routing

Using the last How-To and a static lease for the Apple TV I got it working, All traffic from my Apple TV is now routed through the WireGuard connection to my HomeLAB and back out. I can stream my content from my JellyFin instance and the Delta app also works. I am accessing the Delta TV content via the Delta network. After some testing whith just this device I made sure to route all traffic of the RoadLAB LAN through the WireGuard VPN. And presto it works as I wanted. This is a pretty cool solution.

Performance

Although IPSec tunnels are the fastest type, they are the most complex. The speed decrease is hardly there. I still got download speeds on the remote side that is pretty close to the maximum speed available. So not really a problem. And all streaming services work. Pretty cool solution. And a next level connection between my two OPNSense gateways.