# WireGuard peering without proxy

**URL:** <https://community.fly.io/t/wireguard-peering-without-proxy/3856>\
**Category:** Questions / Help\
**Created:** [January 28, 2022, 3:34pm UTC](https://community.fly.io/t/wireguard-peering-without-proxy/3856 "2022-01-28T15:34:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![eric-karambit-ai](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/eric-karambit-ai/32/10829_2.png) [@eric-karambit-ai](https://community.fly.io/u/eric-karambit-ai)\
**Post date:** [January 28, 2022, 3:34pm UTC](https://community.fly.io/t/wireguard-peering-without-proxy/3856/1 "2022-01-28T15:34:53Z")

</div>

I’ve been following the below example for setting up a WireGuard peer to expose services behind another cloud VPC. Thanks for this. This was really easy to start off with.

> **[GitHub - fly-apps/rds-connector: Trivial Terraform example for a WireGuard...](https://github.com/fly-apps/rds-connector)**
>
> Trivial Terraform example for a WireGuard peer to RDS - fly-apps/rds-connector

The below is roughly the WireGuard client configuration that was generated by `flyctl`.

```auto
[Interface]
PrivateKey = ...
Address = ...
DNS = <ipv6>::3

[Peer]
PublicKey = ...
AllowedIPs = <ipv6>::/48
Endpoint = ...
PersistentKeepalive = 15

```

The typical pattern I see people employ is hosting a proxy like nginx or pgbouncer on the WireGuard client in order to reach hosts in the VPC.

Is there anyway we can add a route so that [fly.io](http://fly.io) apps can connect to all hosts in the VPC?

```auto
FlyApp_A = <ipv6_A>
VPC_Server_A (WG Peer) = 10.0.2.1, <ipv6_B>
VPC_Server_B = 10.0.2.2
VPC_Server_C = 10.0.2.3

```

I want FlyApp\_A to reach any of the VPC\_Servers without needing a proxy.

I’ve tried to update the client configuration like the following.

```auto
AllowedIPs = <ipv6>::/48, 10.0.2.1/24

```

But I think the WireGuard server on [fly.io](http://fly.io)’s side would also need to know that that route exists right? Is this currently doable?

---

<div class="post-metadata">

**Author:** ![kurt](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/kurt/32/43757_2.png) [@kurt](https://community.fly.io/u/kurt)\
**Post date:** [January 28, 2022, 11:41pm UTC](https://community.fly.io/t/wireguard-peering-without-proxy/3856/2 "2022-01-28T23:41:41Z")

</div>

We don’t have the right bits to route traffic to IP blocks through a wireguard peer.

The _best_ way to do this is to run something like Tailscale in all your Fly VMs. Tailscale does all the routing you’d need to make it work.

If you’re feeling bold, you can experiment with making this work on Fly, but you can’t do it with our built in Wireguard peers. You’d need to run your own Wireguard instance on Fly, figure out how to set the Fly vm that’s running it to work as a router, and then install routes through it on your other VMs.

I really want this to work some day, for what it’s worth. 🙂

---

<div class="post-metadata">

**Author:** ![eric-karambit-ai](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/eric-karambit-ai/32/10829_2.png) [@eric-karambit-ai](https://community.fly.io/u/eric-karambit-ai)\
**Post date:** [January 30, 2022, 4:51pm UTC](https://community.fly.io/t/wireguard-peering-without-proxy/3856/3 "2022-01-30T16:51:46Z")

</div>

Gotcha, thanks for confirming. I’ll play around with setting my own WG setup on Fly.