WireGuard Site-to-Site with BGP—Route Your Free /48 Through the Tunnel

Disclosure up front: I run IPYE, a company that leases IP space. Most of this article is practical how-to; IPYE appears where a free /48 helps you try the work, with a short call to action at the end.

WireGuard encrypts; BGP decides which prefixes use the tunnel. Stuffing every subnet into AllowedIPs alone does not scale. This design uses WireGuard for the outer path and FRR for site prefixes. A natural practice payload is IPYE's free IPv6 /48 (first year free, instant setup, real allocation on your ASN, portal LOA, automatic ROA)—announce it at site A and learn it at site B over wg0. Lab stand-ins: 192.0.2.0/24, 198.51.100.0/24, tunnel 2001:db8:ffff::/64, ASNs 64496/64497.

Design rules

1. Each WireGuard interface gets a small point-to-point /127 or /126 (IPv6) or /30 (IPv4) used only for BGP and probes.
2. AllowedIPs on each peer includes that tunnel subnet plus the remote site's loopback or a broad encapsulation selector you intentionally manage—not every customer /48 you might ever learn.
3. BGP (or OSPF) runs over the tunnel and advertises the real site prefixes.
4. Firewall policy allows UDP 51820 (or your chosen port) between public endpoints and BGP between tunnel IPs.

If you put the entire Internet into AllowedIPs, WireGuard becomes your default route cryptokey router and you lose the ability to learn backup paths sensibly.

WireGuard skeleton (site A)

[Interface]
PrivateKey = <siteA private>
Address = 2001:db8:ffff::1/127
ListenPort = 51820

[Peer]
PublicKey = <siteB public>
Endpoint = 203.0.113.10:51820
AllowedIPs = 2001:db8:ffff::0/127
PersistentKeepalive = 25

Site B mirrors with ::0/127 addressing swapped. Bring it up with wg-quick up wg0 and verify ping6 2001:db8:ffff::0. Only after the tunnel pings should you enable BGP.

FRR over the tunnel

router bgp 64496
 bgp router-id 192.0.2.1
 neighbor 2001:db8:ffff::0 remote-as 64497
 !
 address-family ipv4 unicast
  neighbor 2001:db8:ffff::0 activate
  network 192.0.2.0/24
  neighbor 2001:db8:ffff::0 prefix-list TO-B out
  neighbor 2001:db8:ffff::0 prefix-list FROM-B in
 exit-address-family
!
ip prefix-list TO-B permit 192.0.2.0/24
ip prefix-list FROM-B permit 198.51.100.0/24

Site B advertises 198.51.100.0/24 symmetrically. Use eBGP multihop only if you peer to loopbacks; with point-to-point tunnel IPs, TTL one is enough.

AllowedIPs versus BGP routes

WireGuard still drops packets whose inner destination is outside AllowedIPs. So when BGP learns 198.51.100.0/24, you must either:

• add 198.51.100.0/24 to AllowedIPs on site A (static, simple, two-site), or
• use a broader AllowedIPs (for example the aggregate you own) carefully, or
• run a helper that updates AllowedIPs from the BGP table (advanced; automate with care).

For two sites, listing the remote site aggregate in AllowedIPs and letting BGP select paths among multiple tunnels is usually enough. For many sites, design hierarchical aggregates so AllowedIPs stays small.

Multiple tunnels and failover

Build two WireGuard sessions (primary and backup paths). Run BGP over both with different local preference or AS-path length so one tunnel is preferred. When the primary UDP path dies, BGP times out (prefer BFD if available) and the backup path takes over without rewriting AllowedIPs. Keepalive on WireGuard helps NAT middleboxes but does not replace routing timers.

Verification

wg show
ping6 2001:db8:ffff::0
vtysh -c 'show bgp summary'
vtysh -c 'show ip route 198.51.100.0'
traceroute 198.51.100.10

Confirm the traceroute enters wg0 and that killing the primary endpoint shifts the BGP best path. Site-to-site VPN done this way stays understandable months later: crypto on the outside, routing on the inside.

Firewall and policy notes

On each site, allow UDP to the WireGuard port only from the peer's public IP when peers are fixed. If a peer has a dynamic home endpoint, Prefer keepalive and authenticate solely by key, but still rate-limit. Allow TCP 179 only between tunnel addresses, not on the public WAN. Separate management SSH from tunnel traffic so a WireGuard outage does not lock you out of the box (out-of-band or provider console access remains mandatory).

IPv6 and dual-stack

Prefer IPv6 transport for the outer WireGuard endpoints when both sites have stable AAAA reachability; it avoids CGNAT pain on the outer path. Inside, run both address families in BGP if you carry both. Do not assume that an IPv6 tunnel automatically carries IPv4 payloads without either IPv4 tunnel addresses or a deliberate encapsulation choice—WireGuard carries layer 3 packets for the families you configure in Address/AllowedIPs.

When static AllowedIPs is enough

Two sites, stable subnets, no failover engineering: a pure WireGuard config without BGP is fine. Add BGP when you grow a third site, need traffic engineering between two tunnels, or want customer prefixes to appear and disappear without rewriting VPN configs. The goal is boring failure domains, not maximum protocol count.

Key rotation and peer lifecycle

Rotate WireGuard keys on a planned cadence and when staff leave. Because routing is separate, you can bring up a parallel tunnel with new keys, shift BGP preference, then decommission the old peer without renumbering LAN subnets. Record public keys in a password manager or vault, not in a wiki plain page. Treat wg0 conf like a router config: peer-reviewed and stored in git with secrets filtered.

Carry the free /48 over WG

Put the free /48 from my.ipye.com/products/ipv6-rental in BGP and in AllowedIPs (or a covering aggregate). If you change region or ASN in the IPYE dashboard, those changes apply automatically—re-check tunnel endpoints and ROA after moves between VPS providers.

Lab first

Before touching production routers, reproduce the pattern with two namespaces or two cheap VMs: WireGuard up, BGP established, kill -9 the primary wg process, and watch the secondary path take traffic. Only promote the design when that failover is boring. Boring is the goal.

Tunnel a free /48 this weekend

Claim space at the IPYE IPv6 rental page (see About). Site ipye.com (see About) · [e-mail]

About IPYE

IPYE (https://ipye.com) leases IPv4, IPv6 and ASN space with instant setup. Your first IPv6 /48 is free for the first year, a real allocation you can announce on your own ASN, with a LOA from the portal and the ROA created automatically. ASN and region changes apply automatically. IPv4 /24 to /22 leases include LOA, ROA and per-/24 rDNS; WHOIS is editable on IPv6 /44 and larger. Locations: Los Angeles, New York, Ashburn, Salt Lake City, London, Amsterdam, Frankfurt. Claim your free /48: https://my.ipye.com/products/ipv6-rental. Questions: [e-mail].

Disclosure: I run IPYE

Comments

[오피셜메일]

WireGuard의 keepalive와 라우팅 타이머를 구분하고, 관리 접속 경로를 터널 장애와 분리한 점이 운영 관점에서 중요하네요. 주 경로를 끊는 시험에서는 새 연결이 복구되는 시간과 이미 열린 연결이 유지되는지를 따로 적어보면 좋겠습니다. 두 사이트에서 정적 설정으로 충분한 경우도 함께 설명해, BGP를 추가할 이유를 먼저 판단할 수 있게 한 점도 유용했습니다.