Hi folks! I set up AmneziaWG server on the VPS side and am trying to create a client on mikrotik using wiktorbgu’s solution. I am nearly there (I think).
I used the AmneziaVPN app on the local PC to add a new peer (Share → New connection (use ‘AmneziaWG native format’ option), which provided me with the keys, parameters and config (and also appended a peer record in amneziawg container’s wg0.conf file on the VPS-side).
I added the firewall rules to client’s config, specifying my VETH interface. Here’s my resulting \docker_configs\amnezia_wg_conf\awg.conf which was mounted to MikroTik container:
[Interface]
Address = 10.8.1.3/32
DNS = 1.1.1.1, 1.0.0.1
PrivateKey = MaGbE…..=
Jc = ..5
Jmin = ..0
Jmax = ..0
S1 = ..5
S2 = ..6
H1 = ..95
H2 = ..36
H3 = ..60
H4 = ..51PostUp = iptables -t nat -A POSTROUTING -o AMNEZIAWG -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o AMNEZIAWG -j MASQUERADEPostUp = iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
PostDown = iptables -D FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtuTable = awg
PostUp = ip rule add priority 300 from all iif AMNEZIAWG lookup awg || true
PostDown = ip rule del from all iif AMNEZIAWG lookup awg || true[Peer]
PublicKey = pEKN1…..=
PresharedKey = AeHKC…..=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = xxx.xxx.xxx.xxx:51820
PersistentKeepalive = 25
On RouterOS I added VETH to the docker bridge, specified networks (192.168.254.0/24) and mangle rule to route certain hosts (firewall list) via this tunnel. Further, I added the following rules in RouterOS /ip/firewall/:
/ip firewall filter
add action=accept chain=forward comment="AWG: Allow outbound VPS connection" dst-address=xxx.xxx.xxx.xxx dst-port=51820 protocol=udp
add action=accept chain=forward comment="AWG: Allow Return from VPS" connection-state=established,related dst-address=192.168.254.4 in-interface=ether8/ip firewall mangle
add action=mark-routing chain=prerouting dst-address-list=AWG_list new-routing-mark=awg-tunnel passthrough=no/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=redirect chain=dstnat dst-port=53 protocol=tcp
add action=redirect chain=dstnat dst-port=53 protocol=udp
add action=masquerade chain=srcnat comment="AWG NAT rule" out-interface=ether8 src-address=192.168.254.0/24
When spinning up the container I can see incoming packages on the VPS side, but there’s very few packets received and the hosts from my AWG_list are timing out. Container’s shell ‘awg’ command returns the following:
interface: awg
public key: S1H…=
private key: (hidden)
listening port: 57165
jc: ..5
jmin: ..0
jmax: ..0
s1 = ..5
s2 = ..6
h1 = ..95
h2 = ..36
h3 = ..60
h4 = ..51peer: pEK…=
preshared key: (hidden)
endpoint: xxx.xxx.xxx.xxx:51820
allowed ips: 0.0.0.0/0, ::/0
latest handshake: 9 minutes, 19 seconds ago
transfer: 276 B received, 330.05 MiB sent
persistent keepalive: every 25 seconds
I suspect I messed up my firewall rules somehow. Is there something obvious that I am missing?