I'm trying to setup Wireguard on my Raspberry Pi, which kind of succeed, but now I have problems with additional configuration of it.

Is there a way to allow some users to see other computers in local network?

What I'm trying to achive is that some user will have access to RPis and camera (green dotted line) and other only to the NAS (blue dotted line).The red dotted line is connection that I was able to successfuly configure - is there a way to allow network access for that connection? Is there a way that some user will have access to all devices in this local network and internet connection?

I know that it is problably connected to AllowedIPs entry, but I'm not sure how and where to configure it.

Network configuration


The question is very good explained with the diagram. But, sorry, it also shows that it is a very complex situation I can't give a detailed answer without access to the network to analyze its behavior step by step. And I'm afraid that it will be voted to close because it isn't restricted to Raspberry Pi. There are many other components involved for your solution. It is a general networking question.

But here are a few thoughts at first sight. Wireguard is an encryption application and has mainly nothing to do with user access. It is not the right tool to manage it.

Network restrictions are managed by a firewall, that is nftables (replaced iptables) by default on Linux. This is made to control devices on the network, not user accounts. If you are happy to restrict only device connections then this it the right tool. But any user who is able to login to a specific computer can use its resources.

The ultimate but most complex solution with user accounts is to use kerberos. With it you are independent from the network infrastructure. You only have to ensure that all devices can connect to the kerberos server. Then authentication is controlled on the device itself. You cannot only control login, you are able to control access to different services on the device. You may specify that a user can login and use the NFS connections to copy pictures but not to use the camera service to manage it or take pictures.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.