MikroTik

anav

I will look at the entire config only, a working config is the sum of its parts, only showing a section is not conducive to success.

/export file=anynameyouwish ( minus router serial number, any publicWANIP information, vpn keys etc. )

anav

neki is bang on. it you wanted to give the 2011 a fixed IP address, then simply use IP address with interface vlan64 and not use IP DHCP client. Assuming Ether1 is the trunk port, and dont setup ports for people to access if not desired ( for example lets say only ether2 is used for home ! Also on s...

anav

edit, no l onger requred

anav

Wifi 7 devices.

anav

Step back one. Remember port forwarding is based upon a destination port. So I use the public IP of the connection as the destination address and the dst port/protocol. When that arrives at the main router, the router looks at the NAT rules and sees a corresponding dstnat (port forwarding) rule, the...

anav

Good news. Public IP on main router allows many things. a. remote road warrior or you as admin to access Main router via wireguard b. remote machine behind private IP can reach wireguard (using LTE as wireguard client router) +++++++++++++++++++++ via the main router c. admin while remote can reach ...

anav

Hola, That is a very good plan. I often suggest the same, as its very easy for users to decide which country they want to access internet from ( or remote LAN devices ) by use of SSID ( different wlans ). Very easy to setup!, once you get the device setup in spain, I can assist via skype/discord/tea...

anav

1. remove router serial number from initial post of config 2. need firewall rules 3. probably should upgrade to 7.16.2 latest firmware 4. probably should use vlans (https://forum.mikrotik.com/viewtopic.php?p=1111667#p1111667) 5. use normal pool setups Summary your vlan and pools and setup is a colos...

anav

Understood, your parents are getting ripped off. They should provide a router with 2.5gb output on a single port. The only thing to do here is use three of the four output ports on the ISP router as three WAN inputs ether1,2,3 on the 5009 Load balance them as three different inputs and you will have...

anav

AX3 is much better value IMHO, but of course its your budget. Both are capable of hosting wireguard. Since you require the opposite from normal, need internet out of client peer router, what I would do is create two wireguard tunnels. ONE JUST for the internet, for users on spain LAN to go out inter...

anav

Correct, the way BTH works in a nutshell. Concept. Mikrotik provides relay servers that both the router and devices reach out too. The relay server connects them. DONE. Doesnt matter if your behind an ISP router or CGNAT or starlink etc......... a. On the hex refresh router, enable IP cloud and enab...

anav

MISSING!! Besides the disabled=yes error, where is the interface? designated on that rule. Try /ip firewall mangle add action=change-mss chain=forward comment="Clamp MSS to PMTU for Outgoing packets" new-mss=clamp-to-pmtu out-interface=wireguard1 passthrough=yes protocol=tcp tcp-flags=syn...

anav

What model of mikrotik routers do you have in Venezuela and Espana?

anav

Basically a typo. From this: /interface list add name=VPN-WG /interface wireguard add listen-port=13232 mtu=1420 name=wireguard1 /interface list member add interface=wireguard1 list=VPN-WG /ip firewall address-list add address=10.19.99.0/24 list= WG-VPN TO /interface list add name=VPN-WG /interface ...

anav

The wireguard settings look correct to me. The extra routing rules to find the non local subnet are bang on. The firewall rules allow traffic from one subnet to another. Mystery at this point. You do have weird DHCP settings, that I have never seen and you have all kinds of funky DNS settings that I...

anav

HOME ROuter - again I dont see any issue here other than rearranging order of forward chain rules. see if that helps at all. Other than that, since I despise capsman will blame it LOL. /ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked"...

anav

Could not find any major on PERSTORP Firewall forward chain rules have to be moved in the order, and remove the old ones!!! /ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked /ip firewall ...

anav

Many assumptions and questions from an inadequate initial explanation. Assuming that the ISP is not putting out 2.5ghz to either the ONT/modem or the ISP Router after the ONT `is based on the OP assuming the ports on the Router are only gigabit capable. We dont have a model # / Make and the OP may h...

anav

How are you keeping the client devices endpoint address updated - aka what is it pointed at???

anav

I would suggest wireguard BTH but that is not possible with your old and discontinued router. Suggest the new HEX refresh with ARM processor, is an excellent low cost device, that will handle your router needs and can conduct BTH wireguard, which is designed to use mikrotik relay servers so that you...

anav

Based on your input, you want the L1009 to act as a router on the company network. The first thing is to ask your IT department if this is permitted as normally personal devices on a company network are not permitted. If you are in the IT department then I suppose its a request for some separate LAN...

anav

Its a phuckng PILE of CWAP........ The new config for wifi reminds me of 10 years ago getting tools for kids from china, where the written instructions in english are so bad its comedy material.
The MT wifi config is NOT intuitive and borders on stewpid, and is no laughing matter.

anav

Great, network diagram so we know the topology, and both configs.......
/export file=anynameyouwish ( minus router serial number, any public WANIP information, vpn keys etc.)

Use code blocks around export ( black square with white square brackets on same line as Bold and Underline ).

anav

In over my head......but where is vlan102 in IP DHCP client settings???

/ip dhcp-client
add add-default-route=special-classless default-route-distance=100 \
dhcp-options=vendor-class-identifier interface=vlan-altibox-voip \
use-peer-dns=no use-peer-ntp=no

anav

Recommend moving to 7.16.2.

Do you simply mean that the second device is connected to the first device by ethernet cable and you want to us the second device as an AP/switch ??

anav

What is the purpose of this thread??
Links to unknown sites are not recommended

anav

Closest looks like Thailand or Vietnam

anav

Impossible to define requirements.......and thus OP should a. identify all users/devices ( internal/externals and admin) b. identify all traffic they require without referring to any config speak. Also details on your wans separately How many. Public or private IP, static or dynamic, Detail which wa...

anav

A plan is a great start, ensure you capture all the traffic requirements such as vlan to vlan, shared printer etc, ( external incoming, any port forwarding or vpns --> at least wireguard so you as admin can remote in to the router ) You need either a trusted vlan ( home ) or create one specific just...

anav

What I do when configuring vlans is take one port off the bridge!! /interface ethernet set [ find default-name=eth8 ] name=OffBridge8 /ip address add address=192.168.77.1/30 interface=OffBridge8 network=192.168.77.0 /interface list member { only need one interface list on this device } add interface...

anav

Strange ask but I guess you dont want anyone with access to be able to manually set 1-24 Assuming your IP address is set to 192.168.88.254 interface=bridge network=192.168.88.0 I would create a firewall address list of 192.168.88.25-192.168.88.253 list=ALLOWED /ip firewall filter add action=accept c...

anav

If you have level enterprise control over the browser, then that is possible. My experience at the enterprise level is that the whole YOUTUBE is just not accessible.

anav

Nothing prevents you from going to a different vendor, or using a different VPN then wireguard. Just suggestions.......... Or, Mikrotik fixes their implementation to work like the rest of RouterOS. That is my first choice too! Why wireguard is allowed to deviate from standard Mangle practices is be...

anav

the config
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.)

anav

The point being is that 7.16 has most of the vers7 bugs worked out and has all the latest security improvements and most access to newest features. Its the way to go for sure at this point. If one has a business or provides services to businesses, the recommendation always is to test new firmware in...

anav

Concur, confusing explanation is an understatement.......... Need a least a detailed diagram to sort out context.
Impossible to define requirements.......and thus OP should
a. identify all users/devices ( internal/externals and admin)
b. identify all traffic they require

anav

Unless solving really means overcome brain fart..............

anav

Nothing prevents you from going to a different vendor, or using a different VPN then wireguard. Just suggestions..........
Perhaps other vendors handle wireguard differently so that its not a problem for the more complex routing subnets?

anav

Why the question asking the question?
Typically the LTS is acutally the most stable version available, who doesnt want that (rhetorical question)!
However, I have moved off vers6 on my main router recently to ver 7.16, as an LTS for ver7 seems unlikely.

anav

Hi Jaclaz, so the switch and LANA would be on the same private LAN subnet ( provided by the isp modem router) as the HEX? If this is the case then all users on LANB will be able to reach LANA. With sourcenat outgoing, all LANB user traffic would appear to come from router itself, so return traffic i...

anav

That has nothing to do with the router!
The router does not change ports on outbound, and thus its your server that is doing that ( changing the destination port when leaving the server )

anav

niche in the sense that its for experts only doing more complex configs and they are not trivial nor a small number of cases.
As for a broken config, that is the reason for the hack!!
If the hack doesnt work for a more complex case, then stop being lazy and come up with a better hack.

anav

Dont forget to install at least the common firewall rules on the 5009, probably have to do it manually. /ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked add action=accept chain=input com...

anav

How many bridges do you have............ I know some have used the fact of two chips on the unit to allow two bridges ports 1-A and B-Last port.
But other than that you should only use one bridge normally.

anav

And the horse you rode in on AMMO. I never said that other than multiwan setups on the main routing tables was trivial.............. There is a need for multiple approaches for the very basic through to BGB/OSPF VRP etc.......... Nor did I say that Mikrotik focussing on either home users or advanced...

anav

Nope........... Be it a two port or multiport device,

Take the extra port off bridge and do all your configuration from there safely.
give the port an ip address, use the ipv4 settings on laptop to access port and router.

anav

Sorry your trivial case nonsense is pure BS. Many folks that come here for assistance have normal multi-wan setups, not all can have specialized, niche vpn WAN only setups.

anav

No worries, there are many here with more patience! Ur in good hands on the forum.

anav

and here I thought holvoe was answering an incontinence question.

anav

If the ISP is blocking wireguard, the fact that you have tried numerous ports tells me that they are checking DPI, into the weeds to see the type of traffic. Therefore suggesting BTH is fruitless. However, if the lack of connection is either a. operator config error b. no access to public IP Then BT...

anav

No worries, you came for help, I asked for the information to make that possible and then you decide magically you know where the problem is (or isnt) and thus I have to question why did you come for help in the first place. I have limited time and your wasting it.

anav

1. The mistake is putting the WAN vlan on the bridge................. 2. You only have three ports active, 3 and two on the bridge 8, and sfp, so what in tarnation is ether6 doing in your config for example or ether4 for example 3. Forgot to tag bridge......... 4. Wrong address EDIT: my mistake crap...

anav

VLANS are not required, although much more flexible and recommended if you run out of ports and need to send multiple subnets out a port to a switch or access point etc.. IP address assign subnetA to ether2 assign subnetB to ether3 assign both to interface list=LAN Then in forward chain firewall rul...

anav

But then that rule (or a similar one) should go in chain forward. Quick recap: 1. chain input=connection to the router 2. chain forward=connection through the router Well stated except that similar rule is also bogus in forward chain as we drop all there as well!! add action=fasttrack-connection ch...

anav

1. Assuming your mikrotik has a public IP and is the SERVER peer for handshake for your devices that need to connect remotely, then this is all that one should see. For some reason you have peer side noise in allowed Ips, which makes me think this was created by using BTH vice manual. Nothing wrong ...

anav

Thanks for the config and continual understanding of the requirements both very helpful Before I delve into the config, output chain is not required to do what you need. One simply needs a firewall rule and routing mechanism to do so, while not conflicting with other traffic. Linking to other sites ...

anav

I really can't see anything When you provide nothing, nothing can be seen. So lets get some clarity. What is the home mikrotik router? model and I assume you have no public IP. Confirm you also have a CHR in the cloud that you use as the wireguard server for handshake. The idea being you as a remot...

anav

First a diagram as I have no idea what you mean about remote servers............ Right now I am assuming you have cloud servers behind a CHR. Second With a full config nothing really useful can be provided, I prefer not to guess. /export file=anynameyouwish (minus router serial number, any public WA...

anav

Lets start with the main router ONLY, it will handle vlans, dhcp and its own local wifi. Capsman will NOT be used............ starts singing Celebrate good times, come on (Let's celebrate) Follow the guidance document as suggested --> https://forum.mikrotik.com/viewtopic.php?t=143620 Create all the ...

anav

No you get rid of it, not required. Its also wasteful, in that all good traffic has to go through that rule before the rest of the rules not efficient. That traffic already captured by the last rule....... Since you didnt answer the question --> what are you afraid of??? You can do want you want, op...

anav

This topic has gotten off the rails. 1. For the OP, most of us dont worry about blocking intervlan traffic because that is just a continuation of the default safe setup MT provides for newbies. Most of use, first thing, is turn the concept of block a few known bad things and allow everything else, T...

anav

The 5009 should be connected to the MODEM The HAP should be connected to the 5009 The HAP should be ideally or most simply setup as an AP/Switch with no dhcp responsibilites ( done on 5009 ) your best tutorial on this is: https://forum.mikrotik.com/viewtopic.php?t=143620 when planning the network en...

anav

As was stated, dont start the config until a. you have a plan for the network ( a network diagram helps ) b. you have identified -- all the users/devices on you network (both external/internal and admin) -- have described the traffic they require to accomplish. Sorry a config cannnot be made in part...

anav

Just to add to that, the managment or trusted vlan is where all attached smart devices should get their LANIP from. So in addition to the data vlans ensure the management vlan also goes through the trunk to the CISCO. Surprized you dont use vlans already by the way. If this is the first time, then e...

anav

Nice, its good to start once you have plan on paper as its much easier to see where things fit together on a config. There should be no issues to the VLANID you use at either router, just MAKE SURE that no two subnets are the same. However we never ask for PCUNITES view of the world for configuratio...

anav

@anav
In the OP's current config the DNS server Is on another device, 192.168.1.9.

Hi Jaclaz, my intention was generic, thanks for pointing that out, in which case the OP only needs to allow local/vpn admin associated IPs to the input chain from the LAN side.

anav

Yeah I /ip firewall address-list add address=192.168.77.X list= Authorized comment="admin desktop" add address=192.168.77.Y list=Authorized comment="admin laptop" add address=192.168.77.Y list=Authorized comment="admin smartphone" /ip firewall filter add action=accept c...

anav

These two rules are almost the same: add action=accept chain=input src-address-list=allowed_to_router add action=accept chain=input in-interface-list=LAN Is an excellent start if the src-address-list is comprised of your LOCAL admin IPs ( wired/wifi/vpn if any) aka only those devices that need acces...

anav

Nice try............. Not the complete config.

Also didnt answer the questioWhat is your intention with this rule.
block WAN access To the router
OR
bloc WAN access to your subnets/LANn.....

What are you afraid of??

anav

I am confused by your explanation, do you mean you have separate WAN connections to the VMIs, and TVs?? I dont see those connections on the diagram Okay I get it now, you think NAT is the mechanism to provide internet to users,,,,,, its actually firewall rules that do so. So to be clear do you mean ...

anav

Reading your first post. Want anyone using ethernet 5, to go out proton wireguard for internet. 1. Wireguarg does not get an IP pool. It simply an interface with a subnet ( it carries traffic from other wireguard address, typically incoming or outgoing and also, router to router it carries subnets)....

anav

{rant on} It amazes me that we are asked to make a definitive call on a question on someones config, and they have the audacity to only show firewall rules. The config is a connected piece of work and thus a partial view is next to useless. {rant off} If your USER rules on input chain never get any ...

anav

Do you understand how the firewall chains work in Router OS. Asking about a single rule, is not going to solve the issue of not understanding how to apply them properly/safely. What is your intention with this rule. block WAN access To the router OR bloc WAN access to your subnets/LAN I think you sh...

anav

Ignore the bad advice above to modify the existing configuration.

The router should not be connected to the internet so remove.
1. use netinstall to upgrade to latest firmware, to be sure you have a non-compromised firmware on the router,
2. Then should have a decent starting point firewall.

anav

The point is you dont have to create a subnet for the WAN traffic, just create a vlan, which will carry the data to the 5009. Untagged port at the switch on the port to the ISP modem, added to the trunk port going to the other switch, added to the trunk port on second switch coming from first switch...

anav

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

You've misunderstood me so I must have not expressed myself clearly............... Other way round! In the old hookup there were two connections coming to the 5009 ( one from ISP modem ) and one from closest switch In the new hookup, there is only one connection available to the 5009 and that is si...

anav

The only example I can think of is if there is some need for a 0.0.0.0/0 allowed IP on the server router, and thus any other needs would require a separate wg interface

anav

It sounds like their equipment may be expecting a specific subnet? 192.168.0.1 or 192.168.1.1 ???
Can you plug one into a pc directly to test?

anav

I think the OP has a bug in his brain!, but to be accurate its a worm.

To upgrade Routerboard, use System --> RouterBOARD that updates

anav

1. Typically UNIFI requires the management or trusted vlan UNTAGGED, and the rest of the data vlans tagged. What is not clear to me is your trusted subnet, is it vlan10 production or vlan20 home.......... Since you have unifi untagged on 10 will assume its production. 2. All your /interface bridge p...

anav

Actually AMMO, you can use a single wireguard interface, and just use a different IP address schema for the road warriors, if you need some granularity over firewall rules.....

anav

You have four vlans but 5 pools is one clue. What was the first tip in my post above!!!
You only have two IP addresses???

Its clear to me you made NO effort to read the vlan link article.
Come back when you put an honest days work into the config.

anav

MT knows, they have not put it high on their priority list to fix I guess? The fix........ one still needs to mangle but add a dst nat rule. - https://forum.mikrotik.com/viewtopic.php?p=1092192&hilit=wireguard+WAN2+dstnat+fix#p1092255 The thread is this one.. https://forum.mikrotik.com/viewtopic...

anav

Regardless, not the config.

anav

Your logic seems very reasonable.

anav

jpegs mean little to me, also hard on my old eyes LOL.

anav

No idea without seeing the config.

/export file=anynameyouwish ( minus router serial number, any public WANIP information, VPN keys etc.)

anav

haha, not pissed, I just speak plainly/factually ;-) You will know for sure if displeased. Consider the config is like the human body, you cannot talk about muscles without discussing nerves that actually trigger muscle movement, you cannot talk about muscles without talking about their food supply ...

anav

I note on beta 7.17.rc - this line......

*) bth - improved stability on system time change;

Has anyone with this problem used the latest beta to see if this change fixes it???
I am 100% convinced these slew of WG bugs were introduced with BTH changes...........just a theory.

anav

You need to decide what is the purpose of AX2 devices. The Ax3 will be your MAIN router terminating the ISP connection( you get a public IP) and create private subnets behind the router. If you use the AX2 devices you will end up with double triple NAT etc, and unless needed for a specific reason sh...

anav

Beyond my scope of knowledge sorry! Hopefully someone else will chime in.

anav

viewtopic.php?t=157048

anav

I purchased an online course that includes a Failover and Load Balancing script. The first two rules prevent packets entering through WAN1 from returning via WAN2. Not sure how those two points are related...... but one can pay through the nose for these rules. ;-) https://forum.mikrotik.com/viewto...

anav

EAP? One unique fingerprint per device. Yay!

I hope I get at least 20 tries before getting locked out ( counting my toe prints)

anav

ASSUMING VLAN10 is the trusted VLAN where all managed devices should get their IP address from!! On Router 1. MINOR From: /interface bridge port add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether1 pvid=10 add bridge=bridge frame-types=admit-only-untagged-and-priori...

anav

You can source nat both WANS or use Sourcenat on WAN interface list. No mention of port forwarding before>>> This is what I call scope creep. I am not interested in chasing. If you have a network plan, then provide a network diagram. then list the requirements. a. identify all the users/devices incl...

anav

Instead of a supout for people to view, use the export function in CLI commands in winbox menu entry NEW TERMINAL.

/export file=anynameyouwish ( minus router serial number, any public WANIP information, vpn keys )

anav

Just to be clear you get a block of WANIPs from your ISP provider which is connected/terminated on ether1, using one of the WANIPs.
You wish to use the remainder of WANIPs to pass on to clients on ether 2,3,4 ???

anav

If not interested in forum help,,,,,,,,, there is always --> https://mikrotik.com/consultants

anav

Stand by computer user, when viewing unwanted information, place blindfold on computer user. No need for expensive routers.

anav

Therefore I was wondering the best way to expose these service ports in a secure way. This leads me to thinking you may want to try Zerotier, which basically joins participants as if they were in a layer 2 network ( my simpleton view ). Another thought is cloudflare zero trust, which is a way to ha...

anav

Concur Holvoe........ The post made is nonsensical, based on the experience on this forum I have seen all manner of setups and none of the threads examples seem out of place compared to that of which one is exposed to here. The intent of the article is to help users navigate through implementing vla...

anav

Good time to learn. Tips --> once you use vlans, take bridge off any dhcp etc.. and take the home LAN and make it another vlan. get rid of vlan interface list group, not required, and add a TRUSTED interface list. If you do have a spare port or can spare one during the bulk of the configuration, hig...

anav

I want to know more about this line............ In case of going through relay, speed could be limited. Clearly we have limits on client end for ISP, and limits at Router end from its associated ISP connection and then there are losses due using VPN. So are they saying on top of that there may be ad...

anav

So in summary, its transparent to the end user, and hence why both apps can be used.

anav

I like the suggestion of powerline, especially for the two bedrooms.......
https://www.tp-link.com/ca/home-network ... a7517-kit/

What I would personally use --> https://www.devolo.global/magic-2-wifi-6

anav

jajajajaja, I will stick to any errors that pop from the most basic of settings!!

For all those wireguards coming in on ISP1 and ISP2, where be the mangling required to ensure handshakes go back out correct WAN??
Cool one can bypass that with OSPF, I may have to learn it after all.

anav

Because the destination and source addresses are kept up to date by Wireguard ROS at either end, so MT ensures that if there is a direct connection that the client uses the direct dst IP address instead of the DDNS one. I am assuming that in the traffic back to the client, the BTH connection sends t...

anav

All is possible. You can a. have all traffic go over ether1, and when that fails switch to ether3 b. load balance traffic between the two connections c. have some users or subnets go out ether1 and some users or subnets go out ether3 For basic failover ( primary and backup ) /ip route add check-gate...

anav

Think of it as the native vlan, should not be used for data and should not be used as trusted or management. Its transparent in the background.

anav

As AMMO stated, the magic is the DDNS part of the BTH user config ( allowed IPs ). I am assuming this sends the user to the MT server. The server keeps track if the Mikrotik Router has a direct type of connection and then rejigs the destination/source address type information such that the BTH Users...

anav

1. Only need one bridge. Using multiple bridges may seem like an easy go to but its not recommended. Use VLANs and vlan-filtering. 2. Add a safe port to continue config for vlans from a port NOT connected to the bridge. We give it an IP address 192.168.55.1/30. Plug your PC into port 5, give your PC...

anav

network diagram would help as well.

anav

I am working on that bit ( improving docs ) and is why I am being nitpicky in my understanding.
I forget, where do the firewall rules show up that allow a USER to access the WAN and possibly the LAN???

anav

Okay so its just a convenience APP for the users second to infinity. The only critical use of the BTH app is for the first user ( admin ) as that account on that phone is the only one where the APP has MANAGE shares capability. The PRIMARY config loaded! You know its very annoying that your right ;-)

anav

There is never a perfect world. But for certain device types, cloud provisioning these days is leading the way. There also needs to be local management. If we cloud provision, the device info and network/device password would be saved at an administrative level. We copy password and use it to acces...

anav

Okay to be clear, it seems what you are saying is that you can take a wireguard config generated by the admin on the admins smartphone, for another user, using the Manage Shares approach, and it can be applied to any normal WIREGUARD APP, aka on smartphone or PC etc. ( stating that the BTH app is NO...

anav

Stuffing a wet noodle up a straw request.

anav

IF all your allowed is one device, then why place it right away inside four walls. If anything I suspect a ceiling mount would be better (guessing)
However, you should really have posted in the wifi forum as keen wifi folks hang out there ......
...

Screenshot 2024-11-26 233758.jpg

anav

Not sure what you mean. Data flow is two way. If you mean can you have a dual WAN setup. Two modems, lets say cable from rogers, and fibre from bell, the answer is yes. Typically one uses the etherport for the WAN client, 3 common options. 1. pppoe setup 2. Dynamic public IP 3. Static public or priv...

anav

Not sure what you mean. If a user (not admin) uses the BTH app to setup a BTH tunnel after receiving the QR code, or URL link or export config file generated on the admins smartphone, then the user access is done through the BTH app, not the standard wireguard app. Now what has not been explained at...

anav

Got it, you host a bunch of users that you would like to push out the internet at some other location via Wireguard. Are these hotspot users on their own subnet? Can you separate your home or private use on a different subnet or would like to Do you want the ability to use wireguard to reach your ro...

anav

Not clear it sounds like only one subnet is going through wireguard??
Do you have control over the other end??

need config!!

anav

So to be clear you want to use the far router for DNS when the wireguard tunnel is up and to allow local WAN access and local DNS when the tunnel is down. Is this for a single subnet, all subnets, some users??? Will need to see full config /export file=anynameyouwish (minus router serial number, any...

anav

Post both latest configs for review

anav

Did the ISP provided you with a static WANIP with its associated gateway? If so then simply add this as an address entry ( and disable the ip dhcp client entry ) /ip address add address=ISP_provided_IP/24 gateway=ISP_provided_gateway-IP network=ISP_provided_network ( typically if IP is 192.168.55.1/...

anav

It's WG, so all are peers. The app and /ip/cloud just always create ONE peer upon enabling it. If you need more, you need the "managed shared" (or /ip/cloud/back-to-home-users). On the "shared" ones, there is the additional option to allow-lan= so that the only difference AFAIK....

anav

You are in charge, not the MT device LOL. You decide based upon requirements. What I see is a two vlan requirement spanning 5009 to HAPAX3 (setup as an AP/switch) It is the logical choice. The only reason I would make the hapax3 as a router is if I wanted to use it for wireguard and not the 5009

anav

anav

Post your own thread instead of hijacking this one! ;-PPP

anav

First off, well done, the safest way to access home servers is coming in on VPN and then accessing the server from behind the router. Second, if your request was to do something similar using standard port forwarding, a proxy server would not be required. For example, if you wanted users to come in ...

anav

Wont say you are wrong, I would rather use obtuse! ;-) First though, I would agree that the associated MT router probably receives the new peer information UPON creation on the admin's smartphone. My assumption was that the router gets populated upon first hookup attempt. However after reading your ...

anav

I quite agree with you that native windows VPN app is very limited but as well as Mikrotik has some limitations to achieve this scenario. Not at all. MT as per normal wireguard protocol assigns a unique IP address to each peer. Further it has firewall rules to assign permissions as required for eac...

anav

Sorry, but ASSUME is not in my vocabulary............................
I have one size HAMMER............... it works 95% of time................ the other 5%, is when you and mkx get lucky first, on the whackamole game you like to play.

anav

If you provide jpegs of all vlan setting pages on TP link switch ( at least two, maybe three if pvid is a separate setting page ) Full config of hex. /export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.) It should be fairly quick to straighten out. ++++++...

anav

While my two esteemed colleagues, okay they are professionals, Im just the floor washer in their office, jump around like frogs, please provide the config. /export file=anynameyouwish (minus router serial number, any public WANIP info, keys etc.. ) Also if you are wireguarding to another device, als...

anav

To be clear.
What is the purpose of wireguard in this setup.

For you as admin to reach the router while away from the main site?
Something else??

anav

I just use LANIP ;-P
Another option is to use DNS settings to point all internal users, aiming at webserver be redirected to LANIP.

anav

Wow, such trick phuckery. I also need to see the final config, as to try and understand, the magical fairy wizard dust Sindy contrived.

Basically, will help better solidfy ones understanding of some basic stuff, power of ip address, dst-nat and source-nat.

anav

Here is the problem, you want the hapax to be a simple AP switch, but then you try to add a second network behind the router. This is not possible be it assigning a subnet to a WLAN, creating a second bridge etc.............. The fact of the matter is you only have one subnet reaching the hapax3.......

anav

Not necessarily. Lets say each user has to login into the PC. Lets say each user has their own wireguard APP on the PC. Lets say each user gets a different wireguard IP address on the MT ROuter wireguard subnet (in fact we will actually make the subnet different for each user but attached to same wi...

anav

anav:1 ammo:0 ( but whose counting) - by the way it looks my advice after inauguration day will cost 25% more jajajaja ( ps dont worry only applies to USA, rest of the world, same free advice, quality not guaranteed until reviewed by mkx/sob and a few others.......... ) Edit................... Damn ...

anav

Hi Normis, Understood, the One Time user available on the ROUTER itself, is for the ADMIN, to use. I presume this is meant to be put on the admins phone and from there he can easily generate additional qr codes or configs to send to as many clients as he/she,it,they,them etc desires. I also understa...

anav

Diagram please detailing the wans etc.... It could be a well known wireguard routing issue but a diagram will help orient me to your network.

anav

1. Is this router BEHIND the RB5009, in double NAT, or acting as a switch/AP OR Is this router in front of the Rb5009 and public IP facing. 2. Why is this error showing?? /interface bridge port add bridge=bridge comment=defconf interface=*6 internal-path-cost=10 path-cost=10 3. Why do you have two b...

anav

okay hopefully NORMIS will provide his usual clarity. :-) :-)

anav

Belgian chocolate makes one smarter, apparently. Screenshots are hard on my eyes so I try to avoid them.

anav

Thank you emarj, I misunderstood your question and gave you a duff answer, now I understand that additional BTH config, and will be able to assist others more accurately down the line. Thanks to @Normis, for clearing that up................... Suggest you add it to the MT document section on BTH so ...

anav

Your firewall rules are over the top complex and simplifying them will enable troubleshooting to some extent. However far more worrisome.......... if assuming 8295,8296 are something to do with accessing winbox and your router is public facing, you are asking to be hacked . Also without seeing the F...

anav

Just to be clear, ether1 and ether2 are WAN links Ether 3 reserved ---> what I would do NOW, is to make this an OFF BRIDGE access for doing all the vlan configuring, much safer , trust me !! /interface ethernet set [ find default-name=ether3] name=OffBridge3 Ether4-10 would be on the bridge. Create ...

anav

Okay my bad, I read so many posts, I can easily get confused........ may also be an old brain thing :-) So you have you own private VPN server hosted in the cloud. That is super so assuming you want to use it for a myriad of things a. users to come in and access your game servers b. for you to remot...

anav

Read the docs y.......... Connect to router Enable DDNS Cloud service: `/ip/cloud/set ddns-enabled=yes` Enable Back To Home: `/ip/cloud/set back-to-home-vpn=enabled` Print tunnel configuration: `/ip/cloud/print` Scan QR Code (`vpn-wireguard-client-config-qrcode`) or Copy config (`vpn-wireguard-clien...

anav

No understood. Here is the point If you have public IP then you dont need nordvpn wireguard Be advised NordVPN is NOT for people coming to you. Its strictly outgoing traffic from your side, usually to avoid local WANIP restrictions etc... As noted your best bet is a. Rent a cloud server, get a CHR l...

anav

So on this HAP device, a. you have a public WANIP ?? and b. you have nordguard vpn............ WHY you can access your router as admin or guests or another router via Wireguard without nordvpn. c. Perhaps you want users to go out a different internet public IP then your own and that is the reason? d...

anav

You know the drill Post the config of the MT router ( assuming its acting as peer Server for handshake )? Since you have a public IP this should be fairly easy to fix. If you have multiple WANs, then provide a detailed diagram for clarity as well as config. /export file=anynameyouwish (minus router ...

anav

You cannot do it with a mikrotik device,
You need an $$router with a $$subscription service.
Your School IT staff would know this,,,,,,,

If this is a single school with little resources, not much you can do.
However, students shouldnt be on their cell phones in the classroom anyway.

anav

I think @ToTheFull refers to the requirement that one has to be "active" on the forum in order to maintain their official consultant status. But the particular kind of activity is not specified. I guess it would be complicated to verify conformance to a more specific requirement, like &qu...

anav

No problem at all. You haven't stated what kind of VPN service, do you mean a third party VPN provider or something else? By the way, if the third party Cloud is hosting it, it cant be as per your title is HOME SERVER Hosting LOL Im assuming two things forcing you to a VPN provider. a. no public IP ...

anav

Screw MT, what is important is that you are feeling better!!!

anav

You get what you measure...

Hi Ammo, cant recall did it long ago but on a 1gig connection on either end same city same provider, rb4011 to RB450G maybe,????? while ago....
I got around 300Mbps or so........... Sorry havent tested in a while.
Perhaps I should test with holvoe sometime.

anav

Well the instructions are not difficult.
Open BTH app on smartphone and import QR code.
It will be up to you to make easy follow instructions for users.
Suggest you try it a couple of times to figure out how best to describe it to users

anav

Well here is the scoop to use wireguard NORMAL, manual config, or port forwarding for that matter you need a. a public IP address OR b. an upstream router/modem, usually the iSP one, with a public IP AND the ability to forward ports. If you have the above then you dont need to use BTH. +++++++++++++...

anav

IPSec has its place in the enterprise world, but here in home soho user land, wireguard is easier to setup and reasonably fast and secure. Sure it takes a hit but looking at IPSEC stats on the MT routers, its not a shining star either. I trust mozerd, who deals with a wide variety of NON enterprise,...

anav

I still don't understand your setup. Typically the Router has a public WANIP, either static or dynamic. OR if not a Private IP from an upstream router for example. Behind the router is a DIFFERENT private subnet, so not sure what you are doing or what kind of network you have. It would appear you ne...

anav

The listen port is a horrible name I will agree. It only pertains to a wireguard router that is server for handshake. In the case of a client that port (typically identified under Wireguard Interface) is simply the outgoing port the initial connection uses to reach the Server etc......... So in a cl...

anav

Detailed diagram please.

anav

Draw a detailed network diagram as your explanation is NOT understandable

anav

1. You forgot to include your 5ghz wifi WLAN in /interface bridge port settings /interface bridge port add bridge=Bridge-LAN interface=ether2-LAN add bridge=Bridge-LAN interface=ether3-LAN add bridge=Bridge-LAN interface=ether4-LAN add bridge=Bridge-LAN interface=ether5-LAN add bridge=Bridge-LAN int...

anav

@Mesquite - remember Your kind words the next time you ask for help at a car repair shop, or at a birthday present, or when painting your room...

Your post makes no sense, suspect language barrier, try google translate next time.

anav

Hi Ammo reading the docs there is only one qr/code one can generate from the router itself, the rest if I read this right, is that you can easily create and manage additional Qr codes and send them all from the admin smartphone.

anav

As per https://mikrotik.com/consultants . Additionally, as a consultant we expect you to participate in the MikroTik Forum and attend the MUM events in your country as a presenter conducting RouterOS case studies or workshops. @muaazteladia - Wow, one post in DEC 2022 and now a few posts today out ...

anav

From my understanding, one uses your smartphone to create an initial tunnel while behind the router. Then one can use the smartphone BTH app ( under MANAGED SHARES) to generate qr codes or config files for other smart phones/laptops etc...... (laptops use the wireguard app itself). THe router is cap...

anav

The MT router can provide 1 QR codes or config file for that special client that is remote. I believe but not certain, the way to create multiple accounts ( Qr codes or config files) is from the BTH app on your smart phone. Step1: Create a BTH tunnel on your smartphone while behind the MT router aka...

anav

Trying to understand BTH some more. It would appear that it does not function as I thought. One cannot create QR codes for all remote users and send them each their own QR code, at which time the BTH app on android or Iphone could then simply use to setup their end. It would appear this can only be ...

anav

Okay I added a bunch more questions above,,,,,,that need answering. You only need one wireguard network now that I know your wireguard requirements but only when two things happen. a. you fix your guest VPN and bridge setup. recommend create vlan for bridge subnet, put both vlans on same bridge as p...

anav

Okay will see what I can figure out, just confused why you have two different WIREGUARD NETWORKS??? Can you provide network diagrams for each side, its very confusing due to all the extra subnets showing that are not complete subnets. For Example. Router A has a Bridge network of 192.168.88.0/24 But...

anav

1. Remove serial number from post. 2. DO NOT USE bridge firewall rules, this is an advanced setting for specific cases, use normal firewall rules for most needs. 3. Clean up pools 4. Fixed up /interface bridge port and bridge vlan 5. Wireguard settings are incorrect. It would appear that the MT is a...

anav

I asked for config at both ends? Which Router is supposed to be the Server for wireguard handshake?? Missing the wireguard address in allowed addresses ( depends upon if server or client for handshake what it should be). Why do you limite wg to /30 at least make it /29 so you can as admin remotely c...

anav

Not sure but if the answer is YEs, I will be sure to make recommendations except for Alex from Malaysia

anav

Need a coherent plan.
Provide a network diagram detailing what is supposed to travel over ports, from that, takes 2 minutes to configure okay maybe 5

anav

1. Remove vlan and datapath from wifi setting, we will apply it on the bridge ports/interface settings. 2. Only need one bridge 3. I am not sure if this is LEGAL. your slave WLAN for wireguard has a different BAND from the master. Is this allowed, I know the frequency and such is copied over...........

anav

MikroTik and CloudFlare business relationship would be a good idea. Even on a limited level with ClouldFlare Free plain. It would be a start.

Would require open minds and forward thinking business planning! Will see if both exist.

anav

Please post config at both ends.
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

Utah and North Pole have spoken. Cloudflare or bust!

anav

Assuming you are talking about segregating users when they are coming on ether8 or that AP, when they are on the same SUBNET as other users???
If so, why not simply create a separate vlan for those users....

anav

Most of us turn internet detect to NONE, as it can have bad effects.

anav

Great.
When done post config of both devices for review.
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.)

anav

We would need to set forum.mikrotik.com DNS to be handled by CloudFlare (or any other 3rd party service). We don't want to pay for that.. Fixed for accuracy. :-) For the really unspoken....... We would need to set forum.mikrotik.com DNS to be handled by CloudFlare (or any other 3rd party service). ...

anav

The hidden point here, is that before you start configuring anything have a plan.
The plan should start with a detailed network diagram ( and in this case would have shown the issue prior to changes on the router).

anav

Awesome!!!

anav

Now, @anav: what was you question in the post above?

Oh no question, I was giving you the FACTS, the bible so to speak.
I was hoping for you to state where I was dead wrong........
Apparently, I speak truth.

anav

I think he might get the picture if you stick those fangs into him..............

anav

1 Persistent Keep alive is not required at SITE A wireguard. THe client for handshake requires it, not the server at handshake. 2.Normally client (for handshake) peer devices usually more than one, are identified by singular IP address .. 3. ONLY one dhcp client interface is valid, I suspect its the...

anav

1. The listening port on the wireguard interface does not have to match the endpoint of the server router, there is no direct correlation. 2. 192.168.50 is a local subnet, allowed addresses is for REMOTE addresses (those local user may have as dst address, or that may be coming into the local router...

anav

inside joke there wfburton, but yes anything at this point.

anav

Or use cloudflare in between WWW and server. Now if only cloudflare zerotrust was available as an options package on at least ARM routers and newer.......!!!

anav

As for SWOS barn switch. Keep in mind, the trusted vlan is 20 and thus all smart devices should get an IP address on this vlan, preferably by taking mac address and asssiging a static DHCP lease on the RB router. Port - VLAN MODE / VLAN RECEIVE / VLAN ID SFP1 - strict / allow only tagged frames / de...

anav

Okay so basically on the router one uses IP DCHP client
/ip dhcp-client
add interface=ether1 use-peer-dns=no
add interface=WAN_VLAN use-peer-dns=no

and remove IP address for WAN_VLAN.

anav

Thats like asking to use a rowboat to sail to the moon. Hah, thanks for putting it in perspective. I don't have the experience to know if I just need a different approach. I guess if I upgraded the switch to a router, even the same RB2011 model, it would make things quite a bit simpler. Perhaps tha...

Search found 21954 matches