7.17 wireguard - do not initiate handshake when peer is configured as responder;

RouterOS General
1

It seems that v7.17 with following change:

*) wireguard - do not initiate handshake when peer is configured as responder;

Which broke my wireguard configuration. I’ve upgraded from 7.15.3 to 7.18.2.

I’ve upgraded two devices rb5009 router and cAP-ax, both had working wireguard connection to linux VPS.

I’ve remember setting this option, because I’ve seen lots of logs regarding wireguard.

I’ve even found old version of docs which mentions this issue:

https://help.mikrotik.com/docs/pages/diffpages.action?originalId=277348361&pageId=283574344


It seems that with responder setting enabled RouterOS won’t even try connecting to peer as stated in changelog and validated by sniffing traffic.

But for me docs are misleading, because my wireguard VPS peer is server with public IP address and is waiting for mikrotik peers to initiate connections, because both rb5009 and cAP-ax are behind nat.

Could we get clarification regarding this setting?

2

In the documentation it states:

Specifies if peer is intended to be connection initiator or only responder. Should be used on WireGuard devices that are used as “servers” for other devices as clients to connect to. Otherwise router will all repeatedly try to connect “endpoint-address” or “current-endpoint-address”.

If your MikroTik device is serving as server (receiving connections) it should be set to Yes (if your VPS was running RouterOS, you should set it to Yes). If your MikroTik device is acting as “client” (whereas client is not the best word, but that is your situation) the responder setting should be set to No. It is supposed to initiate the connection with your public available Wireguard server.

3

The responder checkbox as stated in previous post is ONLY to be used by the router if it is the SERVER for handshake.
It tells the router that if connection is interrupted and lost with the client dont keep attempting to reach the client…

a. ensure responder checkbox is not used
b. ensure you have a persistent-keep-alive set on your wireguard peer settings on the router for VPS peer.

4

Thanks for clarification. It all makes sense now.