Confused by Wireguard configuration

Configuration
1

I'll start by introducing myself. I've been into computing since 1969, a system administrator for HP and Sun minicomputers, workstation networks, Linux, signal processing and GIS systems, etc. I still find HA to be very complicated and difficult to configure, at least for the things I'd like to do.

Until a couple of days ago, I was playing around with HA in a VM on my desktop but I've just moved my implementation over to a Dell Wyse thin client, that I picked up on eBay. So. it's getting serious. So far, I use HA to monitor various important sensors (e.g. refrigerator temp, water on the floor, etc.) at home and at a remote location.

At the remote location, I'm running a SMlite SMhub Nano MG24, which is running Zigbee2MQTT and is watching the fridge and water sensors. I've configured my home router to forward ports 1883 (TCP) and 51820 (UDP) to my HA machine and MQTT seems to be working pretty well. I don't seem to be able to restrict the MQTT port forward to a single source IP address. When I try, the connection is lost. Because of this, I think it would be a Good Idea ® to secure the connection by a VPN and drop the 1883 port forward. The SMhub implements Wireguard VPN.

After considerable messing around with settings, keys, etc, It looks like I have been able to get a wireguard link between the remote location and my HA box. The problem is that I really don't understand the address configuration parameters. On IPSec and Open VPN the client's IP address is set more or less automatically by the server an it's not something you have to mess around with. Is there some place that clearly explains the what and why of the wireguard settings for addresses, allowed_ips, allowed_client_ips, etc. Right now these are populated with blanks or more or less random numbers, like 10.10.11.3/8 but only because it looks like typical VPN addresses. Right now, my home LAN is mostly 192.168.50.X with a mask of 255.255.255.0 but I'm considering segmenting my LAN so that the cameras and IOT are on a separate VLAN, but I'm not there yet.

Any help is appreciated. Thanks in advance.

2

HA likes a flat subnet, so while VLans can be done, you have to tweak a lot to get all the protocols working. If you are doing Matter devices, the IPV6 also likes a flat network. You sound like you have the skills to do it OK, it's just really not the easy way, if you know what I mean.

I have not used wireguard, but from what I've heard you may instead want tailscale that uses wireguard. There's an App for that I believe.

Personally I use ZeroTier App and have it running on my phones, Linux, and Windows boxes. To me the user it adds a lower level subnet that I can just use. Substitute that IP address for the regular IP address for HA or any of the nodes, and send stuff around at will. Initial set-up is simple, and just load the software and add nodes after that.

3

Thanks, I'll look into tailscale and ZeroTier. Getting started with HA is like drinking from a firehose.
Correct me if I'm wrong. Does the UI change frequently? I look at how-to videos on YouTube and they don't resemble what I see on my monitor. The older the video, the greater the divergence.

I have Thom Haagenrud's book "Home Assistant for Beginners" and the first half of the book is really basic stuff. I do understand networking but the bolting together of so many disperate systems under one umbrella takes some getting used to.

4

There was a major change from
Lovelace to sections a year or so ago. I'm not much of a UI guy though...

5

One simple observation, that could make working with multiple network way easier in HA, though might require some HW changes. If you have 2 NIC in your instance (personally I use HA as VM on ESX and it is configured with 2 network adapters), you can connect each of them to different network and HA will tread both of them equally. So regardless of what subnet devices are installed, will work with HA (and be discoverable). So perhaps in your case having one adapter on local LAN and second on VPN LAN would simplify setup.