{
  "id": 19250972,
  "title": "WireGuard Site-to-Site with BGP—Route Your Free /48 Through the Tunnel",
  "url": "https://urgent.news/2026/11/10/wireguard-site-to-site-with-bgp-route-your-free-48-through-the-tunnel",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-10T00:22:58.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ipye_com/wireguard-site-to-site-with-bgp-route-your-free-48-through-the-tunnel-49kp"
  },
  "original_language": "en",
  "account": "This article explains a practical implementation of WireGuard combined with BGP for site-to-site connections. The design involves using WireGuard for the outer path and FRR (Free Range Routing) for internal site prefixes. IPYE provides a free IPv6 /48 for testing purposes. The tunnel is established using WireGuard, and BGP decides which prefixes use the tunnel. It is essential to restrict AllowedIPs on each peer to only that tunnel subnet and the remote site's loopback or a specific encapsulation selector. BGP runs over the tunnel and advertises the real site prefixes, while firewall policy allows UDP 51820 (or your chosen port) between public endpoints and BGP between tunnel IPs. Careful management of AllowedIPs is necessary to avoid WireGuard becoming the default route crypto key router. The design rules stress the importance of limiting AllowedIPs to prevent security risks and ensure proper path learning. The article also provides configurations for both site A and site B, detailing how to set up the WireGuard interfaces, BGP routers, and address families. Verification steps are outlined to ensure the tunnel and BGP are functioning correctly. The article concludes by mentioning that for a simple two-site setup, a pure WireGuard configuration without BGP can be used. However, adding BGP becomes necessary when the network grows, or traffic engineering and customer prefixes require more complex routing.",
  "summary": "Disclosure up front: I run IPYE, a company that leases IP space. Most of this article is practical how-to; IPYE appears where a free /48 helps you try the work, with a short call to action at the end. WireGuard encrypts; BGP decides which prefixes use the tunnel. Stuffing every subnet into AllowedIPs alone does not scale. This design uses WireGuard for the outer path and FRR for site prefixes. A…",
  "key_points": [
    "WireGuard combined with BGP for site-to-site connections explained",
    "IPYE provides free IPv6 /48 for testing WireGuard tunnel",
    "BGP routes real site prefixes, AllowedIPs restricted to tunnel"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}