After Wireguard Client configuration successfully, lan area cannot access wireguard area.

RouterOS General
1

Hello everyone.

I have a remote wireguard server A as the wireguard server, and the local routerOS B connects to it as the client, and I hope that the lower-level devices in the LAN area of the RouterOS B can access the host in the remote VPN area.

I am sure that the wireguard client in my local RouterOS B has been configured successfully, because I can already access the remote wireguard gateway and remote hosts in VPN area through ping in RouterOS B, but the devices in the LAN area of my RouterOS B can never access the remote wireguard VPN zone.

I have also done similar operations on other routerOS, that is, serving as a wiregurad client to provide local devices with access to the VPN area many months ago. But I haven’t been able to successfully config it this time and I don’t know what went wrong.

The WAN area of my RouterOS, that is, eth1 obtains an IP through DHCP and connects to the Internet, eth2-eth5 aggregates into a LAN Bridge, and creates a wireguard interface. Now I hope that the devices under the LAN Bridge can access the devices in the remote VPN area through the wireguard interface. The wireguard tunnel works over ipv6, but the internal VPN subnet is still ipv4.

Wireguard VPN subnet: 192.168.100.0/24
remote wireguard peer’s ip: 192.168.100.1
local wireguard peer’s ip: 192.168.100.2
remote subnet: 192.168.200.0/24
eth1 wan area gateway: 192.168.1.1
LAN bridge area subnet: 192.168.88.1

Router config from /export file=config.txt is below, any helps are appreciated.

# 2023-11-25 10:01:06 by RouterOS 7.12.1
# software id = XXXX-XXXX
#
# model = XXXX
# serial number = XXXX
/interface bridge
add admin-mac=XXXX auto-mac=no comment=defconf name=bridgeLan
/interface wireguard
add listen-port=13231 mtu=1420 name=wgPeer_Client
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridgeLan lease-time=10m name=defconf
/port
set 0 name=serial0
/interface bridge port
add bridge=bridgeLan comment=defconf interface=ether2
add bridge=bridgeLan comment=defconf interface=ether3
add bridge=bridgeLan comment=defconf interface=ether4
add bridge=bridgeLan comment=defconf interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridgeLan list=LAN
add comment=defconf interface=ether1 list=WAN
/interface wireguard peers
add allowed-address=192.168.100.1/24,192.168.200.0/24 \
    endpoint-address=XXXX endpoint-port=51820 interface=\
    wgPeer_Client persistent-keepalive=25s preshared-key=\
    "XXXX" public-key=\
    "XXXX"
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridgeLan network=\
    192.168.88.0
add address=192.168.100.2/24 interface=wgPeer_Client network=192.168.100.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=src-nat chain=srcnat dst-address=192.168.100.0/24 dst-limit=\
    1,5,dst-address/1m40s limit=1,5:packet psd=21,3s,3,1 src-address=\
    192.168.88.0/24 time=0s-1d,sun,mon,tue,wed,thu,fri,sat to-addresses=\
    192.168.100.2
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN src-address=192.168.88.0/24
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.1 \
    pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
    target-scope=10
add disabled=no distance=1 dst-address=192.168.200.0/24 gateway=wgPeer_Client \
    pref-src=192.168.100.2 routing-table=main scope=30 suppress-hw-offload=no \
    target-scope=10
add disabled=no distance=1 dst-address=192.168.100.0/24 gateway=wgPeer_Client \
    pref-src=192.168.100.2 routing-table=main scope=30 suppress-hw-offload=no \
    target-scope=10
/ipv6 address
add address=::1 from-pool=wanv6_dhcpClient interface=ether1
/ipv6 dhcp-client
add add-default-route=yes interface=ether1 pool-name=wanv6_dhcpClient \
    request=prefix
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
2

Allowed peer should be 192.168.100.0/24, not 192.168.100.1/24

3

I tried, but still not work.

4

This likely needs fixing.

add action=src-nat chain=srcnat dst-address=192.168.100.0/24 dst-limit=\
    1,5,dst-address/1m40s limit=1,5:packet psd=21,3s,3,1 src-address=\
    192.168.88.0/24 time=0s-1d,sun,mon,tue,wed,thu,fri,sat to-addresses=\
    192.168.100.2

Needs perhaps a dst-address list and include 192.168.200.0/24
Also for testing remove all the limits, time, etc.

Alternatively If not supposed to nat traffic to the remote subnet,

check remote wireguard will accept 192.168.88.0/24
And router has routes to send this traffic back via wireguard.
Also, remote router is the default gateway for that subnet?
(or it does appropriate src nat)

5

About check remote wireguard will accept 192.168.88.0/24, I have also configured the client on routerOS before and allowed the lower-level subnet devices to successfully access through VPN. However, the LAN subnet of the client RouterOS is not specifically configured on the server side (remote wireguard peer).

So things get very strange, I don’t understand why now RouterOS B itself can access remote devices through wireguard, but LAN lower level devices cannot. Did the recent system update change something?

In addition, I have tried adding 192.168.200.0/24 to the dst-address list you mentioned. Now the RouterOS B LAN subnet can access the remote 192.168.200.0/24 area device, but it still cannot access 192.168.100.1 and the devices in 192.168.100.1/24 area.

And also, I did not add firewall nat rule (src-nat) before in previous successful try. I don’t know why now it is needed.

6

What is the remote wireguard server - mikrotik or something else??

Concur lets fix that sourcenat mess… (drop the crap rule)
/ip firewall nat
add action=src-nat chain=srcnat dst-address=192.168.100.0/24 dst-limit=
1,5,dst-address/1m40s limit=1,5:packet psd=21,3s,3,1 src-address=
192.168.88.0/24 time=0s-1d,sun,mon,tue,wed,thu,fri,sat to-addresses=
192.168.100.2
add action=masquerade chain=srcnat comment=“defconf: masquerade”
ipsec-policy=out,none out-interface-list=WAN src-address=192.168.88.0/24

TO:
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade”
ipsec-policy=out,none out-interface-list=WAN

Now if your wireguard server is a Third Party VPN service where it only expects a single IP address coming from your end then you will need also
add action=masquerade chain=srcnat out-interface=wgPeer_Client

7

So assuming the SERVER is not third party, then the problem is also at the other end at the server end!!

SeRVER CONSIDERATIONS:
a. do you have 192.168.88.0/24 as allowed IPs at the server wg peer settings for router b??
b. do you have 192.168.100.2/32 as allowed IPs at the server wg peer settings for router b??
c. do you have a route that allows return traffic from 192.168.88.0/24 to get back into the tunnel at this server.
d. do you have a firewall rule that allows routerB subnet traffic to reach server LAN