The default gateway for the new device needs to be your existing router in order to get to the internet. Then when you create a new WG connection, you ensure all traffic that gets passed to this new device forwards through the Wire guard tunnel.
Pretty much got it. Any other static routes you setup will be static to the new router only, but otherwise that’s pretty much it. Devices with static IPs don’t participate in DHCP, so it won’t cause a conflict. Just make sure DHCP is disabled on the new device.
I have two routers set up like this. The untrusted ISP router is plugged into the wall with untrusted devices (e.g., work laptops, guest devices) connected to it. Its IP is 192.168.20.1 and untrusted devices use that IP as gateway.
Then there’s a trusted router that trusted devices connect to with IP 192.168.1.1. I have it connected to the untrusted router’s wifi as WAN but you could also just connect its physical WAN port to an untrusted router LAN port. Trusted devices uses 192.168.1.1 as their gateway and the trusted router tunnels all connections over the untrusted router to the VPN provider.
Only the trusted router needs Wireguard. The trusted devices think they are just on a regular LAN, which keeps their configuration simpler.
deleted by creator
You will need to set up IP masquerading.
The default gateway for the new device needs to be your existing router in order to get to the internet. Then when you create a new WG connection, you ensure all traffic that gets passed to this new device forwards through the Wire guard tunnel.
PC > WG-router > existing-router > internet
deleted by creator
Pretty much got it. Any other static routes you setup will be static to the new router only, but otherwise that’s pretty much it. Devices with static IPs don’t participate in DHCP, so it won’t cause a conflict. Just make sure DHCP is disabled on the new device.
deleted by creator
I have two routers set up like this. The untrusted ISP router is plugged into the wall with untrusted devices (e.g., work laptops, guest devices) connected to it. Its IP is 192.168.20.1 and untrusted devices use that IP as gateway.
Then there’s a trusted router that trusted devices connect to with IP 192.168.1.1. I have it connected to the untrusted router’s wifi as WAN but you could also just connect its physical WAN port to an untrusted router LAN port. Trusted devices uses 192.168.1.1 as their gateway and the trusted router tunnels all connections over the untrusted router to the VPN provider.
Only the trusted router needs Wireguard. The trusted devices think they are just on a regular LAN, which keeps their configuration simpler.