MikroTik

anav

All three routers have to have WAN connections to reach each other. If one router goes down, then it is no longer in play period. The other two can still reach each other. The exception to the above, which may be a possibility in your case ( vague diagrams ), is if two routers of the routers can be ...

anav

Im going to slap an electron carbon tax fine on you for a waste of a post ( or awful humour ) take your pick ;-P

anav

In zyxel vernacular this one was one to one NAT............
I think in MT lingo you want to research NETMAP

anav

Just to note, on the first page of the article you stated you had already read............... PCUNITES vlan bible. quote: Native, Base, & MGMT (management) VLAN: As you create your VLANs and pick VLAN IDs for each one, understand that the base network that you used to initiate your first connect...

anav

The good news is that soon there will be a useable MAC and linux version of winbox. RIght now its a beta, not ready for beginners IMHO, heck I am not using it either. Infabo, put yourself in the shoes of newbie regarding usability and you will come to a different conclusion. By that I mean, dont ass...

anav

Remove your serial number from your post above! Is an AP so all router crap for the most part is removed. Ether 2 on the capax will be used as a SAFE off bridge port to configure or access the AP. ****** Remove client from AP, you have set correctly the AP to get a static set IP of 192.168.88.2 outs...

anav

What is the purpose of joining the two routers, clearly stated requirements drive the config.
In other words describe the user traffic that needs to be executed.

anav

Not sure what you mean.
Do you have two PPPOE WAN connections ( aka the router is a client to the ISP)

Same ISP, two different PPPOE logins?
Two different ISPs????

anav

No idea what mess you have without the configs of both routers. /export file=anynameyouwish ( minus router serial number, any public WANIP information, keys, etc. ) One has to ensure the correct allowed addresses in wirguard setting, matching with ip routes if required for remote subnets and finally...

anav

The rule of thumb when controlling both ends IS to match MTU, I think the default is 1420 not 1500 on the MT.
In any case, if one know the MTU setting at the other end, the first thing to try is matching it on the MT.
Then the rules above.

anav

Sorry I coudnt get you there, the WAN situation was a bit over my head for sure.

anav

My understanding is, at least for wireguard, if your router is the client for handshake, typically to 3rd party providers, then one can use either of these two settings, and depending upon the provider one may work better than the other. I have not heard of adding this setting to the Server (for han...

anav

Knowing which Netgear router would help....... Knowing which MT AP would also help. In general the idea is that the netgear gives each AP a different IP address. Each AP has a basic setup as follows..... ( yours may have less LAN ports for example ) ( assuming the Netgear subnet is 192.168.1.0/2 and...

anav

Correct! Wireguard on WAN2 will not work at the moment. PUt in the following dstnat rule and it should work... /ip firewall nat add action=masquerade chain=srcnat out-interface-list=WAN add action=dst-nat chain=dst-nat dst-address-type=local in-interface=l2tpBouyg-4G dst-port=13232 protocol=udp to-a...

anav

From the first link above............ Check it out. Simple Network Interface WireGuard works by adding a network interface (or multiple), like eth0 or wlan0, called wg0 (or wg1, wg2, wg3, etc). This network interface can then be configured normally using ifconfig(8) or ip-address(8), with routes for...

anav

In a nutshell, allowed IPs is the key to success, The server router (for handshake) denotes each peer individually by its /32 address. DO NOT DEVIATE. Each client typically for max flex denotes the server by the subnet address............ especially true and germane for client routers for handshake....

anav

Just to be clear everything except wireguard is working fine? Can you connect on wireguard ORG that is coming through on WAN1 fine? Only issue is not being able to connect directly on WAN2 ? If so that makes sense as the config seems fairly correct in terms of wireguard. The only problem should be f...

anav

You clearly do not understand how wireguard works, Its a peer to peer connection. That means you cannot on the server assign 0.0.0.0 .............................where is the peer to peer Furthermore, ALL traffic from the router (be it originating outbound over the tunnel or return traffic, will NEV...

anav

Did you make the changes I have provided in the last two posts yet??
When you do, then repost the config for viewing please.

anav

Apparently ARP is a very viable method of what you are doing with it. Similar to ping and the only difference is ARP would not be used recursive routing which is where I am used to it being used. As was explained to me, Ping is checking to see if if something is UP or ON, while ARP is checking if so...

anav

In terms of firewall.......... You have given access to configure the router to the ENTIRE LAN so all users could potentially access the config of the router....... Normally we do not do so as they have no need. We only give permission to the admins YOu can do that by source address list hence the b...

anav

I see red lines on your mangle rule so will start there....... Did you put the red colors in or did the router?? Why do you have the word add?? its not part of the config???? Get rid of icmp protocol........... Should be: /ip firewall mangle action=mark-connection chain= input connection-mark=no-mar...

anav

Network diagram and configs of both routers
/export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc.)

anav

I did, your allowed IPs are wrong. I gave you an example of how to fix them. The remote laptop and android phone, should now be able to reach any LAN subnet or your router for config purposes if your firewall rules permit that. No special dstnat or sourcenat rules required at all for wireguard in th...

anav

Whats your point.............. Send a supout if youve found a bug.

anav

Sweet shouldnt take too long to fix up then.. Sadly capsman screws up my knowledge of vlans and how they are supposed to be configured but will attempt anyway I find it strange that you do not have pool for vlan TH ?? I find it very strange that you do not have dhcp-server for TH ?? Why you are hidi...

anav

reviewing Just to be clear a. You are setting up this device as ROUTER not only a switch b. The ATT router gets a public IP address ****** c. You can forward ports on the ATT device to the LANIP of the Mitkrotik device. ( on the lan subnet of the ATT ) ****** your IP cloud setting shows the public I...

anav

Sounds like your firewall rules are the problem...... use something like the default rule set with proper modifications /ip firewall address-list { dhcp leases set statically } add address=adminIP1 list=Authorized comment=adminPC add address=adminIP2 list=Authorized comment=adminlaptop add address=a...

anav

Draw a diagram, your explanation is more confusing than helpful.
and post complete config
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

If this is an internet facing router your firewall rules suck.
Side note: If you have a vlan fully open to another vlan ( two way comms), perhaps it should just be one vlan?

anav

Traffic flow is directed by the /interface bridge ports and /interface bridge vlans. In other words they instruct where VLANX goes in and out of ports and whether or not its flowing out of a port tagged or untagged and whether or not its tagged coming into a port etc.. The firewall rules are there t...

anav

What most do is simply have a rule at the end of the forward chain for example add chain=forward action=drop comment=Drop all Else Thus unless you have rules above this allowing traffic, EVERYTHING else is blocked. So typcially one has allow LAN interface list to WAN interface list for internet allo...

anav

1. In your config I see this... Which indicated an error that needs to be resolved. /interface pppoe-server server add interface= *B service-name=service1 AND /ip address add address=100.0.41.1/20 disabled=yes interface= *B network=100.0.3 2.0 AND add address=10.14.0.2/16 disabled=yes interface= *15...

anav

Yeah my bad, there is no script for DHCP server its just one long winded DHCP Client script LOL.

Looking at your routes........
What is check-gateway=arp not familiar with that usage............ how does it compare to ping........ or more accurately , why using arp?

anav

It is fine for the basic generic setup the OP was looking for in terms of: TAKING the default firewall set of rules and a. make them efficient b. change concept to block all and identify needed traffic above block all rule. If its good for your scenario, if different from a single subnet one bridge ...

anav

Lists within lists is not possible.
What is your requirement exactly that would require such a functionality for home or even small business..........
That cannot be solved via existing interface list and firewall address list. ???????????

anav

..............................

yup.jpg

anav

To assist, you need to detail all the requirements clearly since there is a lot going on a. identify each user/device, groups of users/devices including admin and external users b. identify what traffic they need to accomplish. Discuss what each WAN is expected to be used for. Part of PCC group of W...

anav

Yes, that would be the best way.
Another method is to rent a Server and setup CHR MT instance in the cloud, they can be had for around $8 a month.

anav

/export file=anynameyouwish ( minus router serial number, any public wanip information, keys, etc.)

anav

Complete rewrite! ip firewall filter {input chain} add action=accept chain=input connection-state=established,related,untracked add action=drop chain=input connection-state=invalid add action=accept chain=input protocol=icmp +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ add action=accep...

anav

Wow, glad you managed that, I would have been lost in that WAN setup. Changes/additions only. Not asking you to delete any config, just modify existing config or add config. # model = CCR1036-12G-4S /interface list add name=WAN add name=LAN /interface list members add interface=ether2-MGTM list=LAN ...

anav

What is the purpose of FOUR routes, I was only expecting two?? /ip route add comment="To connect ORG srv" dst-address=10.42.0.0/24 gateway=10.42.17.121 add comment="To connect to Bouygue srv" dst-address=89.81.69.0/24 gateway=10.223.130.120 add comment="Default route via Ora...

anav

Okay, all good info, yes it should load balance any connection coming from vlan7,ether10. I dont understand the purpose of your complex scripts.......... Why are they needed especially the dhcp server???? You seem to have two sets, DHCP server and DHCP clients etc.... THe dhcp client assuming ISP......

anav

Okay, much clearer thanks!!

So is the purpose of the two separate wireguard interfaces is to have both up at all times, one for WAN1 and one for WAN2.. makes sense to me.
Which is primary WAN and which is secondary WAN?

anav

Why use all these complicate code, when you can just go to IP Cloud and turn it on. Then router does everything for you. To get the IP address in code: :put [/ip cloud get public-address] Jotne, I want to put the dynamic wanip in a dstnat rule. Note the comment for identification/location purposes....

anav

Remove serial number above. To be clear. a. are you using the MT as a server for handshake for two wireguard interfaces. b. are you using the mT as client for handshake for two wireguard interfaces. c. are any of your WANIP addresses public? d. if No, can you forward the wireguard port to your MT ro...

anav

So is the mikrotik AX3 not the server for your wireguard network??? If it is, which I conclude as you have the input chain rule to accept the handshake, then your allowed IPs are incorrect. Each road warrior needs their specific config line. Its peer to peer VPN, thus one rule for all makes no sense...

anav

Until I see the config, I am unable to comment further

/export file=anynameyouwish (minus router serial number, any public wanip information, keys etc. )

anav

Okay that is excellent progress!
Now you only want to load balance vlan7 to all the ISPs correct?
Your laptop you want to use a specific ISP?
What is on etherports 5,6 ??
What is the purpose of SFP and which ISP should it use......

anav

On routerB, the allowed IPs entry for routerA then require only one entry 0.0.0.0/0 as it covers all possible IP addresses. If you intend to ask a million followup questions simply post both configs when you do. /export file=anynameyouwish (minus router serial number, any public wanip information, k...

anav

With clarity and truth, comes better discussion and solutions!!! In this case there is no difference to anything Ive said thus far. No need to mangle for WAN1 as its primary. For WAN2, again no change for what Ive stated, but the only difference is the addition of a wireguard work around rule due to...

anav

viewtopic.php?t=210523#p1094206

anav

Yes, that should work........ /interface bridge ports add bridge=bridge1 ingress-filtering=yes frame-types=admit-priority-and-untagged interface=ether2 pvid=10 comment="home subnet" add bridge=bridge1 ingress-filtering=yes frame-types=admit-priority-and-untagged interface=WLAN5ghz pvid=10 ...

anav

The diagram is extremely helpful if nothing else to point to as a reference. It would seem that the logical config entails the following 1. R1 is the SERVER for handshake on WAN1 for all routers. Thus R1 is a wireguard server on WAN1 FOR: R2 (client peer), R3 (client Peer), R4 (client peer ). 2. Via...

anav

I would assume that he ordered initially a switch but needed a router ???

anav

Why are you complaining here instead of simply asking for assistance, like normal people do??

anav

Regarding use of the routing table action.......... a. lookup --> basically means use the preferred table but if not available router can look at main table for an alternative active route --> out the local WAN for example. b. lookup-only-in-table ---> means if the preferred table is not available t...

anav

examples of firewall rules
viewtopic.php?t=153581#p855249

simply in the forward chain, prior to the last rule ( Drop all else )
Add in the traffic required device A to Subnet B or Subnet C to device D for example.........

anav

examples of firewall rules
viewtopic.php?t=153581#p855249

simply in the forward chain, prior to the last rule ( Drop all else )
Add in the traffic required device A to Subnet B or Subnet C to device D for example.........

anav

A provided full config, for review would be helpful (minus router serial Number, and any public WANIP information )

anav

When I saw that rules and you have your chains mixed up, I threw up and left for awhile.
Just came back to say, put chain rules together, makes it much easier to read and troubleshoot issues, as rules are processing within a chain, in the order they are presented and order is important.

anav

In general, and to keep it SIMPLE, for the main router with DHCP, all vlans are tagged with bridge.
For MT devices not being the primary router, aka acting as an AP/Switch, ONLY the management VLAN needs to:
a. be identified as a vlan
b. be tagged on the bridge.

anav

1. Did you forward port 45586 on the upstream router to the LANIP of the mikrotik router?? Easy to do if you go the path I suggested /ip address add address= 192.168.xx.yy interface=ether1 network=192.168.xx.0 Vice this........ /ip dhcp-client add interface=ether1 +++++++++++++++++++++++++++++++++++...

anav

Anything is possible, but in isolation I would be leery of providing any advice before understanding the complete config. /export file=anynameyouwish (minus router serial#, any publicWANIP info,keys, etc.) WHy for example do you not have table main routes for all three WANs?? in addition to any requ...

anav

Yes! The problem is the traffic reaches the server but the return traffic does not!! Its being forced to WAN2 by the routing rule!!! Think about it if you have: /routing table add fib name=useWAN2 /ip route add dst-address=0.0.0.0/0 gwy=ISP2 routing-table=useWAN2 AND the appropriate routing rule: /r...

anav

First, how are you considering the two WAN connections? In general one should assign a clear non-ambiguous hierarchy for WAN traffic. Primary Route distance=1 table=main gwy=ISP1 Secondary Route distance=2 table=main gwy=ISP2 This applies if WAN1 is the go to and WAN2 is the backup obviously. This i...

anav

Congrats Normis! In terms of changes dont feel pressured to go one way or another. I prefer user-selectable. In other words, for example, one may prefer tabs and another may prefer pull-downs. I am assuming there were good reasons for your developers to provide pull-downs etc. Same with contrast, on...

anav

The article is wrong from the start.
There is no need for both sides to have a publicly reachable IP address, only one side need have it.
Didnt bother to look at the rest..........

anav

Can you provide a network diagram as detailed as possible so I can try to figure out what is going on. To help with the diagram please provide teh following. a. identify all the users/devices or groups of users devices on the router b. identify all the external users coming into the router c. all th...

anav

Seems like ert fell asleep.............

anav

What is preferential if the ISP router does not provide some benefit that the MT router cannot, is to find out the bridge mode if possible. In other words pass the public IP to the Mikrotik. If you cannot do that then you simply use a static LANIP address on the ISP address and it is used as the WAN...

anav

The only thing you need on the SERVER handshake Router A, with fixed IP. Mandatory: /wg allowed IPs = wireguard-address-of-routerb/32 interface=wireguard-name public-key="key generated by router B to use here" /fw rules Input chain rule = accept incoming port on WAN optional: allow wiregua...

anav

Which means you initially let the router config wireguard for you instead of doing it yourself manually LOL............ Glad you took control!!

anav

I use it, many do. If your a business, then you should have a backup plan or use the MT one as a backup and use a paid service.
I have also used free one, many out there, with no issue.

anav

Can you provide more detail tangent. The server device normally does not require to NAT ---> Responses from single external clients. The traffic comes in hits an MT router subnet and goes back out same way, or even the router itself for config purposes. AKA no NAT required. However if the OP wants t...

anav

MOre importantly, is it a. a public IP that gets to your router?? If not it then gets to the upstream ISP router? If so then b. can you forward ports on the ISP router to your Mikrotik router. Mikrotik device has a dyndns service IP cloud built in, so you can use that or a free dyndnu address on the...

anav

Hehe. Remember English is not my first language. So the most accurate wording would probably be "been there, fucked that up myself, more than once"

Well to be accurate my fair feathered friend, "been there", rubbed my nose in it! ;-P

anav

You should send in a report to Mikrotik about this behaviour..............

anav

Still, doesn't explain the "ALL of SUDDEN". If it was working all this time with EoIP interfaces, what flipped the switch so to speak ???

anav

Yes, from an iphone or android phone, aka from another device, not a router, using BTH and depends on which MT router you do have at the other end.

anav

They dont have a road map, they make it up as they go............... NOT.
Its really none of your business, aka what their business plans are. They provide cheaper products with great flexiblity, buy it or not.........

anav

Well one cannot design a config in a vaccuum and each part is related. So to ask to one thing and later to ask another question about another need is the wrong approach. 1. Identify all the user(s)/device(s), groups of users/devices, including admin and external users 2. State all their traffic requ...

anav

What went wrong is MT not providing you with a first post path and process that ensures you get your issues answered in a sane manner.

/export file=anynameyouwish ( minus router serial#, any public WANIP information, keys etc.)

anav

Correct, the easiest thing to do is turn the device into a router and do it that way. Its how most of us would approach given that the intent is only for the wifi users on the device to go out the tunnel.

anav

Nor should there be on the hex in this setup.

anav

Well what I stated is important to understand.
The hex is unable to make such decisions acting as a switch, nor can any other L2 device ( switch ).

anav

OKay so what you are saying is that the hex is not a router in your network and its acting as a switch. Its connected to a TPLINK Switch on ether3. In this case your question or request may be unreasonable. Whether or NOT, any device in one vlan can reach a device in another vlan IS THE RESPONSIBILI...

anav

Didnt think any existed that were any good. I am aware of high end routers $$$, and then you need to pay subscriptions $$$.

anav

You have some ideas but they are not concrete enough. Clearly you have an inkling of dividing up available bandwidth for the user gropus, aka send vlans x,y,z to one ISP and vlans a,b,c via another ISP and think you can call it a day. What it appears you are aiming for is what we call load balancing...

anav

Why? just uses wireguard.
On allowed IPs, router1, put the remote subnets coming in.
On allowed IPs router2, put the remote subnets going to
On each router put IP routes main table, interface wireguard, dst-remote subnet...
Firewall rules as required.

anav

Well if thats the case, you simply need to port forward on the CHR into the tunnel. I would use one wireguard tunnel for local router users and your mobile warrior and the other tunnel for port forwarded traffic as a natural separation. So users have two things, DYNDNS or staticIP of CHR and port en...

anav

I asked some questions above because your config makes no sense and none were answered. You have dhpc for the bridge, but have two vlans defined without any dhcp, Your config is full of errors in your interfaces................. You have scripts for UN EXPLAINED reasons for your routes...... What is...

anav

viewtopic.php?t=143620

anav

Sadly, anything you day is pure fabrication without evidence or at least opinion without any substantiation.
Llamajaja led your dehydrated self to water and you refused to drink

anav

Amazing you can diagnose problems without information, can I hire you as my doctor too.. ;-P By the way the reason to put connection-mark=no-mark in the mangle rules,a s the OP has done --- oh look at me using evidence!! ----, is to ensure that on the fastrack rule one simply adds connection-mark=no...

anav

Great input from gigabyte and gotsprings. I too am happier with the old capac vice the ax series. The programming of the AX is not intuitive in terms of WIFI. Since they still dont have a handle on it, I would handle WIFI differently and have two checkboxes, capsman and roaming LOL. Also config entr...

anav

Why no firewall rules? Why no interface list or members? Why do you have the bridge giving out DHCP when you have vlans. What is the purpose of the vlans. Why is vlan associated to sfp plus1, when spfplus one is also attached to the bridge. Besides the answers to these questions the complete config ...

anav

Not enough info. 1. Do you have any servers on the LAN that people need to reach from external locations? 2. Do you have any subnets or individuals that need to go out a specific WAN vice be load balanced 3. Do you have any incoming traffic externally going directly to the router ( aka vpns like wir...

anav

Not going to attempt to understand your config....... however in terms of wireguard. Its all wrong for a client Router device. First why are there two peers entered. The router is a client (at handshake) peer and thus should only have one entry. Is your intent to access the other router, config both...

anav

Did you try using port 443?

anav

MIght work, let me review the config. What you FAIL to mention is what you are connecting to ??? Another mikrotik router and a friends, your CHR in the cloud, a third party VPN provider??? The Mikrotik device should be on the same LAN as your main router and in that case better to use a fixed lanIP....

anav

perhaps someone is dancing samba in your house?
good as guess as any without seeing config.

anav

Well you certainly have a plethora of options. I would recommend to use ONE interface on the CHR and on both routers. If you want separation from router to router traffic then you can use two different subnets on the CHR ( both with same interface ) Typically remote/mobile clients ( laptops, smartph...

anav

I will say it for the last time, stop with the config speak.
Talk plainly to describe requirements based on user or device traffic.
If you cannot clearly describe traffic requirements there is no point in even starting modifying or creating a config.

anav

Is this some sort of joke?? Why are you adding special table for routes that already exist on the router. When you create a subnet a route is automagically created add dst-address=192.168.88.0/24 gateway=192.168.88.1 routing-table=main add dst-address=192.168.99.0/24 gateway=192.168.88.1 routing-tab...

anav

Was wondering there for a sec, is this guy sure he wants to program RoS......

anav

Interface bridge ports are typically ethernet ports and wlan ports. Vlan99 can be identified and not associated with any port on the router in terms of an access port but it will exist as a tagged vlan going out a port to be used with other smart devices for managment purposes.......... ( they will ...

anav

Not sure what you are getting at..........
The routing rule is not about forcing internal router DNS services out WAN2.
Its strictly about forcing any query to 1.1.1.1 out WAN2.

In any case, since you dont want to provide config, I am outta here.

anav

Correct, remove bridge from LAN interface list. Vlan1 is used in the background by the router/bridge, do not touch. Yes ether4 would then be an access port. An access port can only have one vlan associated, untagged when leaving the port tagged when entering the port. Keeping vlans on the bridge is ...

anav

Very little info provided. Network diagram is a great start which shows ISPs, intent of wireguard etc Config of both routers /export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc..). Which Router has a publicly accessible IP ( or can forward ports from ISP r...

anav

Then post complete config as the issue may be elsewhere
/export file=anynameyouwish ( minus router serial number any public wan IP information, keys etc. )

anav

my understanding is that BTH is for remote devices, not remote routers.

anav

Did you try this.....dont think you need connection marks here. /ip mangle add chain=output dst-port=53 protocol=udp new-routing-mark=isp2_table passthrough=no add chain=output dst-port=53 protocol=tcp new-routing-mark=isp2_table passthrough=no assuming routes like add dst-address=0.0.0.0/0 gw=ISP1-...

anav

Why two wireguard interfaces on CHR?

anav

Nor should you, lets look at the history: You had, /interface bridge port ... add bridge=bridgeVLAN interface=ether3 I recommended, /interface bridge port ... add bridge=bridgeVLAN ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether3 You put instead, ...... /interface bridge por...

anav

@sciencys By the way this didnt work....... /ip route add address=0.0.0.0/0 gateway=wan2-gatewayIP table=use-WAN2 /routing/rule add action=lookup-only-in-table dst -address=fixed-static-public-IP-of-WAN2 table=use-WAN2 because I think it should be........ /routing/rule add action=lookup-only-in-tabl...

anav

You want a generic solution that fixes wireguard specifically LOL. Doesnt sound generic to me. But here ya go. /ip firewall nat chain=dstnat dst-address-type=local in-interface=WAN X protocol=udp dst-port= YYYYY action=dst-nat to-addresses=ip.of.wan. PRIMARY WANX = any WAN other than wanPRIMARY and ...

anav

Sure think will take a look! By the way actually not, the client peer for handshake should be identified as its /32 address!! Hey will be visiting your fair city for one day, night in September!! 1. What is the point of vlan10 if you dont have a pool or dhcp server etc...............Further you are ...

anav

Im not an ugly bird

, but the sindy solution IS speicific, the port is targeted!!

anav

Oh wow, just saw the diagram after posting the post below. Sindy exorcised my misunderstandings so that its clear....... Okay so rereading your requirements...... Laptop is never directly connected to MT router. You use debian server to make the central connecting point between laptop and MT router ...

anav

Yeah, the first WireGuard handshake is like a secret handshake between two routers (Peer A and Peer B) that want to communicate securely. Peer A sends a "hello" (handshake initiation packet) to Peer B which responds with a "hello back" (handshake response packet). But because th...

anav

Read --> for proper setup of vlans biggest change off the bat is dont use vlan1, simply change it to 11 and your golden. https://forum.mikrotik.com/viewforum.php?f=23 Assuming ether3 is going to the managed switch. /interface bridge port add bridge=bridgeVLAN ingress-filtering=yes frame-types=admit-...

anav

It doesnt work because your requirements are not clearly stated. Do you mean USE the DNS services of the router via WAN2 ( USE DNS server of the router ) OR Do you mean use some DNS server you have on LAN via WAN2 ( port forward to DNS server on the LAN) Finally, how do you propose or better WHY, ar...

anav

Until I there is a clear need for more than one wireguard interface, I would stick to one tunnel. My amusing friend sindy tends to overcomplicate issues ;-P The reason to go to two separate wireguard interfaces is if one has multiple cases or conflicting cases of 0.0.0.0/0 to deal with. If you want ...

anav

Mikrotik has had a few supout reports on this matter and is hopefully working on a fix. The problem we are facing is that the response to the handshake leaves WAN2 and then ends up bleeding out WAN1. Therefore the originating device gets a response from an unknown destination address and is rejected...

anav

No what he is saying is stop asking questions about setting up Non-Mikrotik devices....... THere is no need for second wireguard networks, just ensure the firewall rules on the debian side allow the traffic and ensure allowed IPs are set correctly on all devices, and that any routes required are add...

anav

Yeah, that was the solution I was thinking of but I had NAT in mind and just didn’t have the energy to figure out a good variation like the one you just showed.

Wasnt me, I have the nergy but not the smarts............ you can thank Sindy for that one.

anav

Well this fix assumes one is still mangling to ensure traffic coming into wan2 goes out WAN2 and using a special route table for the WAN2. If you are talking using Routing Rules, if the situation permits it, and it works, then that is another approach which uses same table and same route as above. D...

anav

Then you have never stated clearly there is another router acting as the Wireguard server...... that is the router config I need to see.

anav

Do you understand wireguard? If you do then you would realize this is nonsensical for the Server for handshake /interface wireguard peers add allowed-address =0.0.0.0/0,::/0 endpoint-address=87.XXX.XXX.191 endpoint-port=51820 i nterface=WG.UDM name=peer6 persistent-keepalive=25s preshared-key="...

anav

Very efficient config

anav

Post the CHR config and the main router config
/export file=anynameyouwish ( minus router serial #, any public WANIP information, keys etc. )

anav

If you are talking R1 being the server for handshake.
R2 is connected as a second router ( client peer for handshake)
Device1 is a PC or laptop that needs to go out the internet of R2?

All very doable, where are you getting stuck.

anav

Yes, in that the response goes back from WAN2 not WAN1.

anav

Mangle as per normal for wan2 (traffic coming to wan2 leaves wan2)
- input chain-mark connections
- output chain mark route

Apply rule.
/ip firewall nat
chain=dstnat dst-address-type=local in-interface=WAN2 protocol=udp dst-port=wg-port action=dst-nat to-addresses=ip.of.wan.1

anav

/ip firewall mangle Your mangling looks like a mess........ not going to try and read it..... but will show conceptually the mangling you should have for wireguard on wan3, which basically says any traffic to wan3, should go back out wan3 add chain=input action=mark-connections connection-mark=no-ma...

anav

So even on version 7.15.3 this is still happening???........... We thought it had been fixed. When mangling which should work does not work............ Okay, the 'dirty' trick that we used to get around the problem which you probably came close to solving on your own it sounds is the following. /ip ...

anav

Hey have you got a config for wireguard over TLS, that sounds MF. sexy.

anav

ok, so if i dont want the subnets to reach each other then i should omit this "add min-prefix=0 table=main" rule, right? WRONG, what makes you think routing rules are firewall rules?? You decided if traffic is allowed at L2 with firewall rules. IP routes, routing rules, tables etc, simply...

anav

Nope, your config needs to be fixed first, then we can properly assess if you still have issues. Since others are using 7.15.3 with secondary WAN without issue, its likely the config. The config is so hosed and confusing........ I dont know where to begin................... which means its so nonese...

anav

There was an issue pre 7.15.3 where the second WAN for wireguard ( secondary wAN) would not work even if one mangled for wireguard. So Im assuming before looking at the config, that there may other issues at play since you are using 7.15.3. Can you clarify why there are two Configs for one device? T...

anav

When you do regain access, suggest you create an off bridge port. Just give the port an IP address 192.168.44.1/30 interface=etherX network=192.168.44.0 Ensure that port is part of any trusted Interface list or whatever you have designated for neighours discovery and mac winbox-mac server. Then you ...

anav

Awesome, its the interplay and settings of OSPF and BFD very unfamiliar with for this relatively 'simple' scenario.

anav

No problems to use MT rouer with Unifi APs. Sampling of vlans management vlan10 unifi SSID purpose1 vlan20 5ghz trusted unifi SSID purpose2 vlan30 2ghz trusted unifi SSID purpose3 vlan40 ( only unifi 1) guest 5ghz unifi SSID purpose4 vlan40 (only unifi 2) guest 5ghz The Unifi management subnet and w...

anav

Ahh okay, didnt realize nichky was asking for help!

anav

OSPF + BFD with two tunnels/routes (one per channel) is really easy to set up, very robust and provides rerouting in just a few milliseconds. That is great news.................. EASY!!! How bout whip up a solution for........... CHR connected to MT router via two ISP connections: pppoe and starlin...

anav

What about netwatch, you can set the time parameter !!!!

anav

If you do have managed switch TP link, then the easy solution is create a subnet just for the printer and then its easy peasy with firewall rules to ensure traffic is allowed as required.
So even a cheap managed switch will do the trick.

anav

Well I can only help with MIKROTIK devices. For switches or any device acting as a switch or AP switches its quite simple. One bridge, only one vlan identified to the bridge - aka the trusted or management vlan The rest of the vlans are either identified on /interface bridge ports ( access port to d...

anav

Provide full config,
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.)

anav

Where did the OP say anything about hotspot?? I must be blind.

anav

@anav i was waiting you there. For some reason that will not work. I've tested today, OVPN does. i'm connected to public internet(hotspot), where all the ports have been disabled except 443 Sounds like a personal problem, no reason why 443 UDP should not work, unless its a company that restricts po...

anav

Nothing is as simple as adding to the table,
One has to carefully consider all the traffic being affected......... but generally subnets are very easy to deal with

anav

wIreguard depend of the situation. Regarding the performance - I will alway go with WG, however if the IPS is blocking the ports, then OVPN is better solution, as no one is blocking 443. One more note, OVPN interface is exactly the same as physical interface (mac-address), capable for vlans. .... n...

anav

If its a fair number of users but not a full subnet, then you will need to capture/identify via mangling rules and possibly create another table and routing rule for the traffic. In any case, once you know all the requirements, I dont chase a changing config, then articulate them and an efficient co...

anav

Yes, that is the whole point, you use static DHCP leases for trusted devices and only they require access on the input chain. The LAN only requires access to specific services normally DNS and sometime NTP. Yes if not doing port forwarding, then the rule can be removed. Read the posts by SINDY, on t...

anav

You bought a switch.
Show me this product on the Router Product page of Mikrotik????

Realistically, as a router you will max out around 200Mbps 0.2Gbps.

thruput.JPG

anav

/ip firewall filter Forward chain { default rules to keep } add action=fasttrack chain=forward connection-state=established,related add action=accept chain=forward connection-state=established,related,untracked add action=drop chain=forward connection-state=invalid { admin rules } add chain=forward...

anav

Setting up vlans --> viewtopic.php?t=143620

anav

Why would you use it as a router??? Is your ISP throughput less than 200Mbps??

anav

need a wireguard capable device as server for handshake.
do you have a MT router or device?
Do you have a public IP or can you forward ports from an upstream ISP router device?

anav

Why is it safer? If its just plain text password, I am not sure it offers extra security. If it was encrypted, then yes definitely. So the question is the pre-shared key encrypted in some fashion, OR only shared after the handshake is established (and thus checked after the tunnel is made and thus t...

anav

add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN What is this rule REALLY DOING as it was intended in the default rule setup! a. its blocking WAN to LAN traffic unless there is a corresp...

anav

There are many possible solutions to the scenario you provide. Recommend at least go latest, think its 7.15.3 ....... The easiest options is not to divide at the router by traffic type, (very challenging and sometimes impossible) but put USERS into different subnets or vlans. Then its easy as pie to...

anav

wIreguard

anav

No one I know uses preshared key with wireguard?? Perhaps thats why its not working?

anav

https://www.youtube.com/watch?v=YLtGQAQ8iS0&t=1601s

anav

Do you know if the internet or tv traffic is coming over vlan tagged???

anav

I am still waiting for the hapax3 config !!!

anav

Okay starting to get a clearer picture LOL You dont need endpoint address on wg3, because the hapac is the SERVER for this wireguard network. Only client peers for handshake require to put the endpoint it. Wg3 has nothing to do with the hapax3. That wg interface connectiong to the axe3 is wg2, where...

anav

Very interesting, I didnt know that you could
a. create the vlans and do DHCP on the switch
b. run the fw rules on the router.

anav

Didnt understand a word of that post, please answer questions asked and/or confirum assumptions made.
Also, the routes were a mess, surprised anything worked.

anav

Looking at routes........ the only people being forced are mobile clients on wg3........ Also still dont know why you have VPN1 and VPN2 ??????????????? /routing table add fib name=direct1 add fib name=direct2 /ip route add dst-address=0.0.0.0/0 gateway=ether1-gatewayIP routing-table=main add dst-ad...

anav

brief comments on hapac config shown. Suggesting modify interface list members ( plus missing wg1 ) /interface list member add comment=defconf interface=bridge list=LAN add comment=defconf interface=ether1 list=WAN add interface= wg0 list=WAN comment="WG1 VPS" add interface= wg1 list=WAN c...

anav

New Questions. Do you also have mobile clients going directly the hapax3 as well? ( at least the admin for config purposes or to reachLAN, two devices being common, laptop and smartphone/ipad )??? Understand mobile clients connecting directly to hapac are for two purposes. a. some to go through the ...

anav

Almost there.............
The VPS VPN servers, do you mean in the cloud somewhere?
The purpose of this is to access internet from a different location for clients ( hapac or mobile ) ??

Why dont you use CHR in the cloud LOL.

anav

I always recommend it be set to NONE. Does that have the same affect as OFF.

anav

Based on your first post I would make WAN1 the primary WAN in routes. This means one only has to guide/force a smaller set of users heading to WAN2. The question I have is what do you exactly mean by wifi ROUTER. Assuming these are dumb consumer devices and you dont mind the double nat created. How ...

anav

Hopefully very little or at least it can be ignored as part of the bread and butter of getting wireguard working first.
Otherwise it may be Larsa on his own.

anav

I am lost in your explanation. Let me state what I think is true. You have ISP1 router/modem connected to the hapax3. Does the hapax get a public IP or private IP but you can forward port from ISP device to AX3 You have ISP2 router/modem connected to the hapac. Does the hapac get a public IP or priv...

anav

Rextended is simply attempting to dissuade the perp from future posts of such nature. The OP wants to ensure that his mikrotik device can handle two ISP connections so that his LAN can take advantage of them. Its not a request to change routing devices, nor to provide bonding. Thus the post is nothi...

anav

Whats the fun in working from facts and evidence??

anav

Yes its a config error on your part.........

anav

Thanks for letting us know!! Good info for future use!!

anav

Read this and the simple solution is to create a third vlan for the third subnet.

viewtopic.php?t=143620

anav

/interface list add name=Trusted /interface bridge port add bridge=bridge interface=ether1 add bridge=bridge comment=defconf interface=ether2 add bridge=bridge comment=defconf interface=ether3 add bridge=bridge comment=defconf interface=ether4 /ip neighbor discovery-settings set discover-interface-...

anav

For the Main Site MT switch or device, do not call it a router.
Can you confirm, that the main router is forwarding the Wireguard Port to the MT device.

anav

Ray of sunshine there Sindy....... ECMP is then used to choose a particular one among these active ones, not "to choose an active route". ( but how randomly?? )
Then mrz blocked the sun.........

anav

Good point, So the switch does DHCP etc, and one only hits router routing limits when going to the internet?? More specifically, what happens when vlanX needs to hit VLANY, is this somehow routed between subnets at wirespeed then?? (function of switch).???? Cause when I look at ethernet test results...

anav

What is with eth4?? and ether1 ?? The starlink comes in on vlan400 on FO trunk and is terminated on the router??? Your diagram does not show any other WAN feed.......!! 5009 /interface bridge add name=bridge vlan-filtering=no ( change to yes after finishing vlan setup ) /interface ethernet set [ fin...

anav

Yes, the CRS305s purpose should only be as a switch a. to carry the starlink signal to the 5009 to be terminated on the 5009 b. to carry the other 5009 vlans (to the switch and hex for management purpose), and to the hex for data flows. why do have sfpplus3,4 doing anything nothing is connected on t...

anav

The last one point is key. MT router knows nothing about if wireguard tunnel is up or down and thus routing rule action of LOOKUP, will not do anything if the tunnel goes down on you. Thus you need to monitor it recursively add distance=1 dst-address=0.0.0.0/0 gateweay=ether1_IP distance=1 {if you d...

anav

Router 2. # model = RB2011UiAS /ip firewall address-list add address=10.0.0.x list=Authorized comment="remote admin PC from R1" add address=10.0.0.Y list=Authorized comment="remote admin laptop from R1" add address=192.168.19.3 list=Authorized comment="remote wireguard admi...

anav

You never state why you have three ports for WAN bridge, there is only one connection to the ISP. Assuming its on combo........ # model = CCR1009-7G-1C-1S+ /interface bridge add name=bridge-LAN port-cost-mode=short /interface wireguard add listen-port=13231 mtu=1420 name=WG-TEHAS /interface bridge p...

anav

Router1 To me seems illogical to have an IP strictly for management of the MT router. Router management is NOT done via WANIP. Its done from internally connected devices or wireguard connected devices from behind to the router, TO THE ROUTER ( aka input chain ) If your intent is to be able to reach...

anav

...And I found it - I needed to tell my Gateway Router (192.168.1.1) to route 192.168.100.0/24 traffic to 192.168.1.31 - the MT running the Wireguard server. Maybe not a NAT issue exactly, but a routing issue instead. Renaming topic in the hopes it'll help others. As an aside what has 192.168.1.31 ...

anav

mrz, you must be related to sindy, both of you put my brain into a fog.

anav

Some comments. 1. Avoid trying to use sourcenat like firewall rules. This suffices /ip firewall nat add chain=srcnat out-interface=wg-nordvpn action=masquerade adding the source address subnet does nothing......... In fact when doing third party vpn another option is: /interface list members add int...

anav

Sounds like your ingesting non-medicinal drugs there milllenium. One cannot increase the speed of single session unless you have the cooperation of the iSP and bond on both sides of the connection. The problem here is not the MT, its the OP figuring out the ISP connectivity parameters, and whether o...

Search found 21034 matches