Hello everyone,

I'm writing to here because I searched for my problem in this forum but I couldn't find the solution.

My problem is I want to use Wireguard on my LTE-AP kit router but when I try to connect the handshake packets haven't reached the router. I have tried both windows(with another wifi) and ios(with another mobile carrier) to connect but nothing reaches the router. I'm using DDNS from mikrotik. What confuses me a bit is that I can use the option "use-local-address=yes" then I can get the IP that is shown on quickset, but when I uncheck it I get a different IP, this must be related to the modem. But what is my real public IP? What does quickset show, is that?

What I have tried so far:
-DDNS with local address option and without
-Monitoring the lte1 and wireguard with torch, but not even a single packet does show
-Playing with NAT, firewall settings
-Changing MTU decrease, increase both on router and client together

I have attached the export of the config, and also here is the windows client config Please help me to find out whats my problem. What else could be?
Thanks

Your provider probably uses CGNAT. On the IP -> Cloud window, do you see this on the status bar?


If yes, then that's CGNAT. It's understandable because most mobile networks now no longer have enough IPv4 addresses for all their subscribers. Nowadays, IPv6 should be well supported by mobile networks. You can use IPv6 for the WireGuard connection instead. But you might have to setup IPv6 on your device first, if you currently don't see any IPv6 address listed in the IP -> Cloud window (if that's the case, you need to do the usual IPv6 configuration: DHCPv6 Client -> IPv6 pool -> Get prefix from pool to assign to the bridge interface -> open port 13231 UDP chain input on the IPv6 firewall filter table, for the LAN devices to have working IPv6, IPv6 ND must also be configured). If there is already an IPv6 address listed on the IP -> Cloud window, then you only need to open port 13231 UDP on your IPv6 firewall.

Thanks for your reply, yes you were right the CGNAT was my problem. Unfortunately the ipv6 enabled wireguard is not an option for me. I asked my internet cable provider to put me out of form NAT, and this means I only have ipv4 address. This was new to me that, the mobile operators are now using CGNAT only connection.

What I have tried and work, I changed the original plan. I was set up the MT router as a client and the server is now sitting on my cable internet which is accessible. I would be happier if the MT was the server, but I see no chance on ipv4.