Let WireGuard clients use your BGP-advertised IP blocks

This is an addendum to my previous post on giving yourself an IPv6 address using WireGuard. If you have an IPv4 range from before the "great IPv4 exhaustion", you can assign addresses from that range to WireGuard clients.

Several cloud providers, including OVH, Vultr, and Equinix Metal, allow customers to advertise their own IP ranges. OVH is the example here because its bandwidth costs are predictable and it does not require a separate BGP connection, which makes setup less work.

Note: If you followed part 1 and added a MASQUERADE rule for your network interface, you will need to remove it when assigning real public IPs from your own range. The MASQUERADE rule rewrites the source IP of outgoing packets to the server's address, which defeats the purpose of giving clients their own public IP. Remove it with iptables -t nat -D POSTROUTING -o <YOUR_NETWORK_INTERFACE> -j MASQUERADE (and the equivalent ip6tables rule if applicable).

With the WireGuard connections from the previous post already set up, assign each client an address from your range. This example uses 8.8.8.0/24, the TEST-NET-1 block reserved for documentation.

# server adjustments to wg0.conf
[Peer]
# change each peer to have a specific "allowed IP" from your block of addresses
AllowedIPs = 8.8.8.1/32  # Replace this documentation address with one from your advertised range.
#...

On the client, make the Interface address match the address defined for that peer on the server:

# client adjustments to wg0.conf
[Interface]
Address = 8.8.8.1/32 # must match the "AllowedIPs" configuration on the server for this peer
# ...

The WireGuard configuration only assigns an address to a peer. Your server must also be able to receive and send traffic for the range. How that is configured depends on whether you maintain a BGP connection with the provider or use a setup such as OVH's, where no separate BGP connection is required.

Editor's Note: If you don't have your own IPv4 range, you can do this with IPv6, which is much easier to get. If you are an EU citizen, I can assist with the process. Send an email to hello at 'this domain without the text part'.