The Marrakech branch VPN is “connected”… but nothing gets through

Céramiques Atlas connects its Marrakech branch (network 192.168.50.0/24) to its Casablanca head office (network 10.10.0.0/24) with a WireGuard tunnel. At head office, the tunnel lands on gw-casa (10.10.0.2), a small Debian VM; the Fortinet box (10.10.0.1), the office's default gateway, forwards UDP port 51820 to it. The ERP is on 10.10.0.20.

On Friday 16/10, after an employee left, Nabil rotated the keys: he rewrote /etc/wireguard/wg0.conf, updated the branch router with the new public key, then rebooted gw-casa “to be safe”. He kept a copy of the old file.

On Monday morning, the branch reports: the router shows the VPN as connected, but the ERP does not answer. You are logged in as root on gw-casa. Restore traffic without going back to the old keys.