fix: wireguard.address must be the router's own address in its network, not the network or broadcast address, from which the peers' addresses are told apart.

README.md

@@ -114,7 +114,7 @@ must have the type shown below; an unknown section or setting is an error.
 | `p2s` | `enabled` | boolean | `false` | Road-warrior access |
 | `p2s` | `address_pool` | string | | CIDR assigned to road-warrior clients |
 | `wireguard` | `enabled` | boolean | `false` | WireGuard endpoint |
-| `wireguard` | `address` | string | | Address and prefix for `wg0`, for example `192.168.200.1/24` |
+| `wireguard` | `address` | string | | The router's own address on `wg0` with the prefix of the peers' network, for example `192.168.200.1/24`; the network and the broadcast address of a network larger than /31 are refused |
 | `wireguard` | `listen_port` | integer | `51820` | UDP port |
 | `openvpn` | `enabled` | boolean | `false` | OpenVPN access for users |
 | `openvpn` | `address_pool` | string | | IPv4 CIDR assigned to OpenVPN clients |
@@ -1157,7 +1157,7 @@ OpenVPN (`openvpn`) and WireGuard (`wireguard`), with the same token as `/users`
 
 | Request | Body | Answer |
 | --- | --- | --- |
-| `GET /remote-access` | | `{"p2s", "openvpn", "wireguard", "running", "local_fqdn"}` |
+| `GET /remote-access` | | `{"p2s", "openvpn", "wireguard", "running", "local_fqdn", "wireguard_server"}`; `wireguard_server` is `{"public_key", "endpoint", "allowed_ips"}`: the router's WireGuard public key (`null` before setup made it), `<wan.local_fqdn>:<wireguard.listen_port>` (`null` without a name) and the networks a peer reaches through the tunnel, the router's local CIDRs and the WireGuard network |
 | `PUT /remote-access/<system>` | any of the settings of the section `p2s`, `openvpn` or `wireguard` | the section |
 
 `running` tells for each system whether setup runs it. IKEv2 and OpenVPN run once enabled with an

debian-package/debian/changelog

@@ -1,3 +1,22 @@
+vpn-router (0.25.2-1) unstable; urgency=medium
+
+  fix: wireguard.address must be the router's own address in its network, not the network or broadcast address, from which the peers' addresses are told apart.
+
+  * A wireguard.address that is the network or the broadcast address of a
+    network larger than /31, such as 192.168.232.0/24, is refused with the
+    first address of the network as the example.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 03 Nov 2026 02:30:00 +0100
+
+vpn-router (0.25.1-1) unstable; urgency=medium
+
+  fix: /remote-access gives the router's WireGuard public key, endpoint and allowed IPs, which a peer's configuration needs.
+
+  * GET /remote-access answers wireguard_server: {"public_key",
+    "endpoint", "allowed_ips"}.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 03 Nov 2026 01:30:00 +0100
+
 vpn-router (0.25.0-1) unstable; urgency=medium
 
   feature: a VPN user has WireGuard peers, each a device with its public key and IPs, kept in the directory and written into wg0.conf by setup.

debian-package/src/usr/lib/vpn-router/vpnrouter.py

@@ -38,6 +38,8 @@ SITE_TO_SITE   = SWANCTL_CONF_D / 'site-to-site.conf'
 ROAD_WARRIOR   = SWANCTL_CONF_D / 'road-warrior.conf'
 P2S_FORWARDER  = pathlib.Path('/etc/systemd/resolved.conf.d/p2s-forwarder.conf')
 WG_CONF        = pathlib.Path('/etc/wireguard/wg0.conf')
+#: The router's WireGuard public key, which setup writes with its private key.
+WG_PUBLIC_KEY  = pathlib.Path('/etc/wireguard/wg0.pub')
 #: The lines around the [Peer] sections of the users' WireGuard peers in WG_CONF, which setup writes from the directory.
 WG_PEERS_BEGIN = "# BEGIN WireGuard peers of the users of the router's directory"
 WG_PEERS_END   = "# END WireGuard peers of the users of the router's directory"
@@ -456,10 +458,16 @@ def validate(cfg):
     wg_address = _get(cfg, 'wireguard', 'address')
     if wg_address:
         try:
-            ipaddress.ip_interface(wg_address)
+            interface = ipaddress.ip_interface(wg_address)
         except ValueError:
             raise ConfigError(
                 f'wireguard.address: {wg_address!r} is not an address with prefix')
+        # The router's own address on wg0, from which the peers' addresses of the same network are told apart.
+        network = interface.network
+        if network.num_addresses > 2 and interface.ip in (network.network_address, network.broadcast_address):
+            raise ConfigError(
+                f'wireguard.address: {wg_address} is the network or broadcast address of {network}; give the '
+                f'router\'s own address in it, such as {next(network.hosts())}/{network.prefixlen}')
 
     port = _get(cfg, 'wireguard', 'listen_port')
     if not 1 <= port <= 65535:

debian-package/src/usr/lib/vpn-router/web

@@ -89,6 +89,7 @@ import collections
 import configparser
 import fcntl
 import hashlib
+import ipaddress
 import json
 import os
 import pwd
@@ -823,13 +824,32 @@ def backup(method, path, body):
     return 200, {'settings': backup_settings(cfg['backup'])}
 
 
+def wireguard_server(cfg, state):
+    """What a WireGuard peer's configuration needs of the router: {public_key, endpoint, allowed_ips}; public_key is
+    null before setup made the key pair, endpoint, <wan.local_fqdn>:<wireguard.listen_port>, null without a name, and
+    allowed_ips the networks reached through the tunnel, the router's local CIDRs and the WireGuard network."""
+    try:
+        public_key = vpnrouter.WG_PUBLIC_KEY.read_text(encoding='utf-8').strip() or None
+    except OSError:
+        public_key = None
+    fqdn = cfg['wan']['local_fqdn'].strip()
+    address = cfg['wireguard']['address'].strip()
+    networks = section(state, 'network').get('local_cidrs')
+    allowed = [cidr for cidr in networks if isinstance(cidr, str)] if isinstance(networks, list) else []
+    if address:
+        allowed.append(str(ipaddress.ip_interface(address).network))
+    return {'public_key': public_key, 'endpoint': f'{fqdn}:{cfg["wireguard"]["listen_port"]}' if fqdn else None,
+            'allowed_ips': list(dict.fromkeys(allowed))}
+
+
 def remote_access(state, method, path, body):
     """Answer a /remote-access request: the HTTP status and the JSON document.
 
-      GET /remote-access            {"p2s", "openvpn", "wireguard", "running", "local_fqdn"}: the settings of the three
-                                    remote access systems (REMOTE_ACCESS), whether setup runs each (running: {p2s,
-                                    openvpn, wireguard}), and wan.local_fqdn, which IKEv2 and OpenVPN need with the
-                                    router's VPN server certificate
+      GET /remote-access            {"p2s", "openvpn", "wireguard", "running", "local_fqdn", "wireguard_server"}: the
+                                    settings of the three remote access systems (REMOTE_ACCESS), whether setup runs
+                                    each (running: {p2s, openvpn, wireguard}), wan.local_fqdn, which IKEv2 and OpenVPN
+                                    need with the router's VPN server certificate, and what a WireGuard peer's
+                                    configuration needs of the router (wireguard_server)
       PUT /remote-access/<system>   change any of the settings of the system's section; answers the section
 
     A change is made as /site-to-site makes one, and applied by restarting vpn-router-setup without waiting for it.
@@ -843,7 +863,8 @@ def remote_access(state, method, path, body):
             cfg = vpnrouter.load_config()
             return 200, {**{system: cfg[system] for system in REMOTE_ACCESS},
                          'running': {system: bool(state.get(system)) for system in REMOTE_ACCESS},
-                         'local_fqdn': cfg['wan']['local_fqdn']}
+                         'local_fqdn': cfg['wan']['local_fqdn'],
+                         'wireguard_server': wireguard_server(cfg, state)}
         if method != 'PUT' or len(parts) != 2 or parts[1] not in REMOTE_ACCESS:
             return 404, {'error': f'no route {method} {path}'}
         system = parts[1]