I needed to correct a wrong value, my NS8 runs on Debian 12. It seems that reconnecting the migration tool in some cases (like wrong DNS settings) increases the last octet of the Wireguard VPN IP of the NS7 (10.5.4.10) but doesn’t adapt the “AllowedIPs” on NS8 correctly that still was set to 10.5.4.3.
Following steps helped:
Get the right Wireguard IP of NS7:
[root@testserver ~]# ip a s dev ns8
5: ns8: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
link/none
inet 10.5.4.10/32 scope global ns8
Edit /etc/wireguard/wg0.conf
on NS8 and change the AllowedIPs of the NS7 peer to the right one.
[Peer]
PublicKey = UjwxpNWsdRF/egLJDaJofb7fEYrUrH3pT3CxdS4Ws4o=
AllowedIPs = 10.5.4.10/32
Endpoint = 192.168.3.162:53080
PersistentKeepalive = 25
Restart wireguard service on NS8:
systemctl restart wg-quick@wg0
Here’s a similar issue, partly solved by changing the IP on NS7 to the allowed one on NS8 (other way round):