Hello for all Mikrotik experts here..!
so my situation like this :
i have a wireguard tunnel built inbetween my mikrotik RB951ui and my windows machine and its working very well except i cant access my mikrotik LAN network from it :
what i mean..?
so here is my MT config:
ether-1 /as a DHCP Client and he get the IP:192.168.10.2 from my ISP-1/
ether-2 /as a DHCP Client and he get the IP:192.168.2.2 from my ISP-2/
ether-4/as a DHCP Client and he get the IP:192.168.40.22 from my VPN Router/
all this three interface are accessable from outside, i mean if i turn on my wireguard from outside network i can access my MT router using one of this ip .
ether-3 with the IP : 192.168.30.1/24 and he act as a DHCP server, and he give the VPN Router the internet //so from ether-3 in mikrotik to WAN interface in VPN router//
ether-5 with the IP : 192.168.42.1/24 and he also act as a DHCP server// and that represent my LAN with all device that connected to it//
so here is the problem i cant access any devices from this last two interface //ether-3 & ether-5// and that’s a big issue for me, becasue the main purpose from this wireguard is to get access to my LAN
by the way i don’t have a firewall rules.
here is my router config:
and the picture below is my wireguard interface in windows
MN.rsc (3.69 KB)
Of course, the router is doing what you told it to do…
Take traffic from ether3 and ether5 and force it out the WAN.
How do you expect any return traffic from wireguard will go back into the tunnel?
/routing rule ( besides the fact that you have duplicates and redundancy in routing rules…)
add action=lookup-only-in-table disabled=no src-address=192.168.30.1/24
table=ISP-2
add action=lookup-only-in-table disabled=no src-address=192.168.42.1/24
table=VP
Try
/routing rule ( so wireguard return traffic gets into the tunnel prior to being forced out wan.)
add action=lookup-only-in-table dst-address=172.11.2.0/24 table=main
add action=lookup-only-in-table disabled=no src-address=192.168.30.1/24
table=ISP-2
add action=lookup-only-in-table disabled=no src-address=192.168.42.1/24
table=VP
Hello anav..! hope you are doing well..!
well because this is exactly what i did in my office..! i have the same scenario except that i have two router entering to my MT..yet i can access all my LAN normaly..!
How do you expect any return traffic from wireguard will go back into the tunnel? well i didnt understand what you mean exactly by this one..?!
If you send traffic from wireguard remote user to one of the subnets, how do you expect the return traffic to be routed back into the tunnel?
As I showed, you have routing rules that force all traffic coming from the subnets out one of the two local WANS… So no wireguard user return traffic will return to the wireguard user.
yes Mr anav i understand what you meant..but my question is that in routing rules i didn’t set any rule that related to wireguard traffic.. so in this case why the wiregyard traffic doesnt go through the main
routing table from its own..!?
why i have to specify a routing rule for it..?
in my current scenario where the wireguard traffic goes..?
You are not listening, there is nothing wrong with your wireguard settings…
The wireguard traffic reaches the subnets no problem.
What happens next with the return traffic from the subnets…
You have to consider how that traffic is routed, traffic coming from subnets… not the wireguard…
Right now anything from the subnet is routed out either WAN1 or WAN2 and thus also including return wireguard traffic … so we ensure with a rule prior to those rules, that wireguard traffic is looked at first, before we force all the other traffic out WAN1, and WAN2. AKA the fix I noted.
You made the rules, you told the router what to do with subnet traffic, why cant you take responsibility for your decisions ;-PPPPP
well stil that didn’t work with your rule Mr.anav..!
i think my problem is with the VPN traffic itself, so as you see from the above config that all my LAN devices routed through VPN. so there is an encrypted channel out there.
so in this case the wireguard will not work and he will face a conflict due to pre existed VPN that already runing in the network.
any suggestion ..!?
No I dont see or understand LOL.
Please draw a network diagram.
Hello Mr.anav ..!
so to update my situation ..
i canceled the VPN from my network and now i have only
isp-1 in ether-1
isp-2 in ether-2
LAN=ether3
in normal situation all range are available but
i reliazed that when i put any routing rule to any IP this IP became unreachable through wireguard i mean this
in routing rule before i put any rule to 192.168.1.100 this IP was reachable, but when i put 192.168.1.100 /look up only in ISP-1
it became unreachable…!?
so why this happen, can you explain please..
my network diagram like this .. will come soon..
something to add ..
in all day hours the wireguard tunnel work normaly ..
but in the evening the tunnel become un reachable..i mean it stop working..!
so is it related to the traffic in the network..?
I suspect your equipment drinks blood and goes out at night …
A diagram will help,
then instead of rambling sentences that make no sense right down your user requirements with respect to wireguard.
Router X ( wg server for initial handshake) Router Y (wg client router for initial handshake ) laptop wireguard client - admin
User A on subnet? on Router X, needs to reach server(s) at Router Y in subnet(s)?
Group of users/Subnet on router X, need to reach internet through Router Y
etc…
Admin while local at router X, needs to configure Router Y
Admin while local at router Y, needs to configure Router X
Admin needs to remotely configure Router X
Admin needs to remotely configure Router Y
Admin needs to reach all LANS on Router X remotely
Admin needs to reach all LANS on Router Y remotely
1-my requirement that i want to access all My LAN devices that in the 192.168.1.1/24 range, yet as i mentioned previously due to the routing rule above in my config
i can’t access 192.168.1.100/32 through wireguard because i have a routing rule say src.add:192.168.1.100 look-up : only in ISP-1 . why i create such a rule for this device..!!?? because i have a port forwarding rule for it.
so i open some port on this device, and if i disable the routing rule for this device the open ports became close.yet i will be able to access this device through the wireguard in this case.
so what i aim to achieve is to make this device accessable via wireguard and also the port forwarding rule for it still work -(the port remain open)-.
here is my network diagram:
Great now provide the export
/export file=anynameyouwish ( minus router serial number and any public WANIP information )
here we are..
MTT.rsc (2.94 KB)
Well the config bares little resemblance to your first post, so not sure I can help as i dont know what is truth??
Also, on the config, it is unclear what you are doing with the two WANs?
Is WAN1 Primary and WAN2 secondary.
Is there failover between the WANS,
Are there some users that should not use the primary WAN1 but should use WAN2 and do they access WAN1 if WAN2 is not available.
Do you have users coming in on either WAN1 or WAN2 for servers ( you mention you want to keep them open to the public ) but on which WAN do they come in on.
Which WAN does wireguard come in on as remote users need to know the endpoint address etc…
Need to know that you actually have thought this through…before commenting on config.
you can consider WAN-1 as a primary and WAN-2 as a secondary -(this WAN-2 for only a specific users)- all ports forwarding rule is through WAN-1 not WAN-2
also the wireguard built using the public ip of the WAN-1.
the open port for a remote sip registration for a grandstream UCM.
So you dont have public IPs they are private IPs from some upstream router where port fowarding can be done??
This is all you need…
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat out-interface=ether2
add action=dst-nat chain=dstnat comment=PBX-1 dst-address=192.168.2.2
dst-port= protocol=tcp to-addresses=192.168.1.100 to-ports=
add action=dst-nat chain=dstnat comment=PBX-2 dst-address=192.168.2.2
dst-port=protocol=udp to-addresses=192.168.1.100 to-ports=
add action=dst-nat chain=dstnat comment=PBX-2 dst-address=192.168.2.2
dst-port= protocol=tcp to-addresses=192.168.1.100 to-ports=
/ip route
add disabled=no distance=5 dst-address=0.0.0.0/0 gateway=192.168.2.1 routing-table=main check-gatway=ping
suppress-hw-offload=no
add disabled=no distance=10 dst-address=0.0.0.0/0 gateway=192.168.3.1 routing-table=main
suppress-hw-offload=no
add disabled=no dst-address=0.0.0.0/0 gateway=192.168.3.1
pref-src=“” routing-table=WAN-2 scope=30 suppress-hw-offload=no
target-scope=10
/routing rule
add action=lookup disabled=no src-address=192.168.1.5/32 table=WAN-2
All users will go out WAN1 except 192.168.5.32 who will go out WAN2.
All traffic coming in on WAN1 will go out WAN1 (assuming external users come into servers).
using DMZ rule in routers .. yes that’s can be done..!
You have no firewall rules so traffic is not being blocked to your lan subnets for incoming wireguard.
Did you fix the other items… (what do the client devices have for allowed addresses for their single peer entry for the main router?)
Hello Mr anav this response is dedicated to thank you for your help..!
i apply your config above and it work well..!
thank you MAN..!!