My hosts only see each other when wireguard is up

[lazaroofarrill]

Hi
So right now I have this setup

Laptop->openwrt router-> home router-> vps
Mac -> vps

My laptop, the openwrt router the vps and the Mac all have two identical nebula networks with only the prefix changed.

The MacBook can talk to the VPS and the router just fine

The laptop too

The MacBook and the laptop for some reason can't talk to each other

They all have the same config, the same group, the lighthouse is the vps

Now the funny part is that if I bring up a the wirguard network I also have in the vps, only then can the MacBook ping the laptop

I also tried setting the lighthouse as a relay but it works rarely

Any ideas?

[lazaroofarrill-opstalent]

emoteIndex=0 responderIndex=0 vpnAddrs="[10.200.100.2]"
time="2026-01-15T21:16:13+01:00" level=info msg="Handshake message sent" cached=true from="10.200.101.2:4242" handshake="map[stage:2 style:ix_psk0]" vpnAddrs="[10.200.100.2]"

I also have this weird case. I'm connecting from the laptop to the mac and the log shows the "from" using the prefix of the second nebula network.

[nbrownus]

Nebula will try to use any path available. You can control which paths it considers using with lighthouse.remote_allow_list or which paths it advertises with lighthouse.local_allow_list. You could use these options to have each nebula instance ignore the other and both ignore the wireguard tunnel.

For general connectivity improvements we suggest configuring relaying, for home use your lighthouse is a great candidate to act as a relay.

For direct connectivity, In a home network we usually advise that folks use listen.port: 0 and let NAT traversal do its thing. If you decide to use the same dedicated port like 4242 then do not install a firewall rule to allow unsolicited UDP on that port, doing so can cause packets from a remote to be blackholed for at least 5 minutes by your router.

It may be that you are behind a symmetric NAT which you can figure out using stunclient or by running the following assuming you have go installed: go run github.com/pion/stun/cmd/stun-nat-behaviour@latest 2>&1 | grep "NAT mapping". If it reports that your NAT is symmetric then your next best bet is to use port forwarding rules on your router or fall all the way back to relaying.