How to connect Zigbee LAN coordinator and ZHA via WireGuard VPN?

Hi everyone, I want to connect a Zigbee LAN coordinator to Home Assistant OS (ZHA or Z2M) using a Wireguard VPN Add-on. My Home Assistant is on the 192.168.0.1/24 network, and the Wireguard Add-on is on the 192.168.1.1/24 network. The LAN coordinator is located in another house on a different network. I can access both Home Assistant and the Zigbee LAN coordinator from my mobile phone. I can connect the Zigbee LAN coordinator locally, when it is on the same network as Home Assistant, but I cannot connect them when they are on different networks. I suspect this is because my router does not know how to reach the other network. Can someone help me solve this problem?

My guess is that you need to setup a static route in HA OS to point traffic for the Wireguard subnet to the Wireguard tunnel.

The problem is that HA OS (assuming that’s your install type on the Pi) is going to use it’s default gateway for all network traffic. And, as you figured out, that means sending all traffic to your router which doesn’t know what to do with it.

1 Like

Thank you for your reply. This command worked for me:

host_result=$(host a0d7b954-wireguard); addon_ip=${host_result##* }; ip route replace 192.168.1.0/24 via $addon_ip; echo $addon_ip

2 Likes

@bogdan.sv Do not, just DO NOT do that! Even if that sounds logical to you now it is such a bad idea for many reasons!

The Zigbee Gateway host application software (regardless if it is the Zigbee2MQTT or the ZHA integration) uses serial communication to connect to the Zigbee Coordinator adapter which requires that to be a 100% stable connection to the host because Zigbee stack application firmware running on use a serial protocol that has never been designed to be robust or resilient enough to handle packet loss (dropped packages) or latency delays, as Zigbee is meant to practically function very close to a real-time network protocol its designers expect a serial connection to be local and directly connected thus they simply not built in fault-tolerance for such edge scenarios. Note that even the network-attached Zigbee Coordinator running on the same local-LAN and same site as the Zigbee Gateway host software is a dirty workaround. Best practice is to use a USB connected Zigbee USB radio adapter if possible (even if need to use a very long USB extension cable). That is why it is not even recommended to connect a Zigbee Coordinator over Wi-Fi, see warnings about connecting a remote adapter in documentation for Zigbee2MQTT and the ZHA integration:

What you instead want to consider doing is to buy another Raspberry Pi or similar for the second location to install another local instance of Zigbee2MQTT on that site and connect it to the Zigbee Coordinator directly (on the same site). If you have multiple sites with Zigbee then you need a local Zigbee Gateway instance with its only directly connected Zigbee Coordinator at each site.

Again, preferably using a USB connected Zigbee Coordinator. Network-attached Zigbee Coordinator solution does introduce additional complexity and introduce your LAN as another SPOF (Single-Point-Of-Failure) for your Zigbee network setup, and I therefor personally believe that in most use bases it will be easier to just use either up to 5 meters / 15 feet shielded USB extension cable or if even longer USB extension distance is needed you can achieve up to around 30 meters by using inexpensive “USB Ethernet RJ45 Extender Adapter” converters which easily and practically convert any single CAT5e/CAT6 shielded Ethernet cable with RJ45 connectors into a very long USB extension cable, (note that 30 meters or 100 feet is the recommended maximum length for USB 2.0 data traffic over a passive cable). See for example these USB extension solutions:

PS: Another tip is to note that the Raspberry Pi 3 is no longer recommended for Home Assistant OS as it is a little to slow, so suggest buying a better computer to run Home Assistant OS on for the primary site and then repurpose your Raspberry Pi 3 to only run Zigbee2MQTT on the second site (again with a Zigbee Coordinator on the same site).

1 Like

All your advice is correct and very well-intentioned, but I suspect you may have missed the detail that OP is talking about a Zigbee LAN coordinator which isn’t subject to the concerns you’ve raised.

The image OP included in their first post makes it look like they’re using a variant of of SLZB-06 adapter, but there are plenty of others on the market like the ZigStar Gateway as well.

These devices are basically combined Zigbee coordinators and mini-PCs to run ZHA or Z2M on board to the device. They function equivalently to an Rpi or small form factor PC with a USB ZIgbee adapter connected.

As far as I know they are just a CC2652 chipset (or silabs) and an ESP32 with lan-interface. Far fetched to say they can run Zigbee2MQTT stand-alone. And ZHA is virtually impossible, since it needs a whole HA installation.

1 Like

No you are wrong, (no offence meant but) my above reply absolutly applies here, because you see those type of ”Zigbee LAN Coordinator” are not a “Zigbee Gateway”, meaning that the do terminate the Zigbee stack at that location, instead they just use “Serial over LAN” technology that allow it to act as serial-over-IP proxy that relay the UART-interface of a remote radio module to a client over the network. They simply have an ESP32-chip inside then that runs a serial streaming server that act as a TCP/IP tunnel from the client directly to the UART on the Zigbee radio module, meaning it still uses the exact same serial communication as if it was local serial radio adapter connected via a serial cable. You just map those via a socket to kind of a Virtual COM Port (VCP, also known as a Virtual Serial Port)

As far as the software application (e.g Zigbee2MQTT or ZHA as the Zigbee Gateway) known it is just a local serial device connected directly. It does not know that it is network-attached devices connected via TCP/IP. It is just a dumb “Serial-over-IP bridge” (also known as a Serial-to-Ethernet converter). Look-up how ”ser2net” works as that has the exact same function. See these references:

Thanks for the correction