Can't reach LAN behind Wireguard client

flyfinlander · October 3, 2025, 2:26pm

Hi, all

I need two way connection between two servers.

The first server (SR1) is using IP (192.168.100.63/24) from the LAN subnet (192.168.100.0/24) behind the Mikrotik router. I have WG server deployed on it.

The second server(SR2) is installed on a Win 10 PC which is using IP (192.168.68.101/22) from ISPs dummy router (192.168.68.0/22). I have installed WG client on this PC and when I connect to WG server I can reach LAN behind Mikrotik with no problems, respectively SR2 can initiate session with SR1. So far so good.

The problem is when SR1 needs to initiate session with SR2. LAN subnet behind Mikrotik can’y reach IP address set on the PCs LAN adapter. I tried to disable the Defender, to make static route in Windows and etc. When I ping -S 192.168.101.112 192.168.68.101 there is no ping which leads me there is something in the Windows setup that I have to change.

anav · October 3, 2025, 2:52pm

could be a number of reasons,

no route to server on pc
no firewall rule to server on pc
etc.
Post full config
/export file=anynameyouwish (minus router serial number, any public WANIP info, keys)

flyfinlander · October 6, 2025, 7:49am

Hi, Anav,

Thank you for your interest in the topic!

To be honest, this router is a hub in a large topology, the configuration is large and contains information that is not a good idea to share.

Assuming we are talking about a configuration from scratch, feel free to suggest another alternative solution. WG is not mandatory, the goal, as I mentioned, is to have two-way communication between SR1 and SR2.

anav · October 6, 2025, 1:12pm

Sorry cannot help without config and need basic details on the wan (private/public, static/dynamic)
The config requested does not show any details that are concerning.
To be clear
DO NOT also INCLUDE dhcp leases or any scripts you may have added as sometimes there are items there one may not wish to share.
There is no other information that I can think of thats of concern.

flyfinlander · October 6, 2025, 3:20pm

Hi, tomorrow I will make a lab environment with a clean configuration and the same requirements and I will post the configuration.

flyfinlander · October 7, 2025, 10:57am

Hi, this is the config below. Everything is the same, only 192.168.68.0/22 has been changed to 192.168.68.0/24. WG is connected, SR2 can ping everything behind the Mikrotik, SR1 can ping only the WG adapter address(192.168.101.112) on the SR2 PC, but can’t ping LAN adapter IP: 192.168.68.101

2025-09-28 11:32:36 by RouterOS 7.20

model = CRS212-1G-10S-1S+

/interface bridge
add admin-mac=B8:69:F4:DD:77:E6 auto-mac=no comment=defconf name=bridge
/interface wireguard
add listen-port=13231 mtu=1420 name="WG Server"
/interface list
add name=WAN
add name=LAN
/ip pool
add name=dhcp ranges=192.168.100.3-192.168.100.254
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=8h name=dhcp1
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge comment=defconf disabled=yes interface=ether1
add bridge=bridge comment=defconf interface=sfp1
add bridge=bridge comment=defconf interface=sfp2
add bridge=bridge comment=defconf interface=sfp3
add bridge=bridge comment=defconf interface=sfp4
add bridge=bridge comment=defconf interface=sfp5
add bridge=bridge comment=defconf interface=sfp6
add bridge=bridge comment=defconf interface=sfp7
add bridge=bridge comment=defconf interface=sfp8
add bridge=bridge comment=defconf interface=sfp9
add bridge=bridge comment=defconf interface=sfp10
add bridge=bridge comment=defconf interface=sfpplus1
/interface list member
add interface=ether1 list=WAN
add interface=bridge list=LAN
/interface wireguard peers
add allowed-address=192.168.101.112/32 interface="WG Server" name=Peer1
public-key="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
/ip address
add address=192.168.100.1/24 comment=LAN interface=bridge network=
192.168.100.0
add address=10.10.10.1/30 comment=WAN interface=ether1 network=10.10.10.0
add address=192.168.101.97/27 comment=WG interface="WG Server" network=
192.168.101.96
/ip dhcp-client
add disabled=yes interface=ether1
/ip dhcp-server network
add address=192.168.100.0/24 dns-server=192.168.100.1 gateway=192.168.100.1
netmask=24
/ip firewall filter
add action=accept chain=input comment="WG inbound" dst-address=10.10.10.1
dst-port=13231 protocol=udp
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/ip route
add disabled=no dst-address=192.168.68.0/24 gateway=192.168.101.112 \

anav · October 7, 2025, 12:51pm

so you are using a wireguard switch for a router?
is it behind an ISP modem router ( aka where is internet from ).
assuming its providing you an IP address from ether1 connection.

If you added netmask manually to dhcp server network, remove it, not required to enter.
Your firewall rules are extremely lacking, but lets assume the ISP modem router has a public IP and you can forward a port from this device to 10.10.10.1 /32 the private WANIP of your MT device.

Can be only:

add action=accept chain=input comment="WG inbound" dst-port=13231 protocol=udp

The Route should look like

add dst-address=192.168.68.0/24 gateway="WG Server"  table=main

The wireguard allowed IPs on the windows 10 PC should be:
either 0.0.0.0/0 for all
OR

allowed-Ips=192.168.101.97,192.168.100.0/24

Finally you have a CONFLICT. the wireguard subnet of 192.168.101 Should NOT be the same as the LAN the windows pC is using from its pC.

So change windows PC LAN or change the wireguard subnet.........

flyfinlander · October 7, 2025, 1:26pm

So, the WAN network in the lab (10.10.10.0/30) is not a problem, it is just needed to establish a connection between MT and a 3rd-party router. The connection between the WG server and the WG client is fine, no problem.
If I change the route to the WG gateway instead of the WG client, the route becomes USI.
The WG allowed IPs on the windows 10 PC (SR2) are 192.168.100.0/23
There is no conflict between the WG subnet and Win PC (SR1), nor with Win PC (SR2).

In short:

Win PC SR1 is using: 192.168.100.63 from the MT LAN subnet - 192.168.100.0/24

WG Server on MT is using: 192.168.101.97 from the WG subnet - 192.168.101.96/27

Win PC SR2 is using: 192.168.68.101 from the 3rd-party router subnet - 192.168.68.0/24

I am adding an updated topology with more details. I hope this helps to better understand the idea and the result I am looking for.

anav · October 7, 2025, 4:28pm

Now your wans are on the same subnet ???
Going from bad to worse trying to fake a real world situation.
If the MT is the server for handshake, then SR2 being the client connections to the MT wireguard service.
SR2 depending upon firewall rules can.
a. via input chain rule modify the MT device config
b. via forward chain rule reach LAN devices.

b is predicated by having either 0.0.0.0/0 on the clients device for allowed IPs
OR
b is predicated upon having 192.168.101.97/32,192.168.100.0/24 for allowed IPs.

AND route on MT device of
add address=192.168.68.0/24 gateway="Wiregard Server" table=main

++++++++++++++++++++++++++++++++++++++++++++++

Also On the Mikrotik device
allowed-address=192.168.101.112/32,192.168.68.0/24

flyfinlander · October 9, 2025, 7:34am

I'm a little confused, what do you mean by "same subnet"?

I changed Mikrotik device allowed-address=192.168.101.112/32,192.168.68.0/24 - no change

I changed as you said, but the result is:

anav · October 10, 2025, 9:06pm

Im sorry i need to see the config to make assessments of the changes made.

flyfinlander · October 13, 2025, 12:15pm

Hi,

This is the config;

2025-10-04 04:48:49 by RouterOS 7.20

/interface bridge
add admin-mac=yyyyyyyyyyyyyyy auto-mac=no comment=defconf name=bridge
/interface wireguard
add listen-port=13231 mtu=1420 name="WG Server"
/interface list
add name=WAN
add name=LAN
/ip pool
add name=dhcp ranges=192.168.100.3-192.168.100.254
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=8h name=dhcp1
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge comment=defconf disabled=yes interface=ether1
add bridge=bridge comment=defconf interface=sfp1
add bridge=bridge comment=defconf interface=sfp2
add bridge=bridge comment=defconf interface=sfp3
add bridge=bridge comment=defconf interface=sfp4
add bridge=bridge comment=defconf interface=sfp5
add bridge=bridge comment=defconf interface=sfp6
add bridge=bridge comment=defconf interface=sfp7
add bridge=bridge comment=defconf interface=sfp8
add bridge=bridge comment=defconf interface=sfp9
add bridge=bridge comment=defconf interface=sfp10
add bridge=bridge comment=defconf interface=sfpplus1
/interface list member
add interface=ether1 list=WAN
add interface=bridge list=LAN
/interface wireguard peers
add allowed-address=192.168.101.112/32,192.168.68.0/24 interface="WG Server"
name=Peer1 public-key="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
/ip address
add address=192.168.100.1/24 comment=LAN interface=bridge network=
192.168.100.0
add address=10.10.10.1/30 comment=WAN interface=ether1 network=10.10.10.0
add address=192.168.101.97/27 comment=WG interface="WG Server" network=
192.168.101.96
/ip dhcp-client
add disabled=yes interface=ether1
/ip dhcp-server network
add address=192.168.100.0/24 dns-server=192.168.100.1 gateway=192.168.100.1
netmask=24
/ip firewall filter
add action=accept chain=input comment="WG inbound" dst-address=10.10.10.1
dst-port=13231 protocol=udp
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/ip route
add disabled=no distance=1 dst-address=192.168.68.0/24 gateway=192.168.101.97
routing-table=main scope=30 suppress-hw-offload=no target-scope=10

anav · October 13, 2025, 2:59pm

Personal prefence: Do Not name interface names like they were comments aka no quote marks.
/interface wireguard
add listen-port=13231 mtu=1420 name=WgServer
/interface wireguard peers
add allowed-address=192.168.101.112/32,192.168.68.0/24 interface=WgServer
name=Peer1 public-key="xxxx"
Remove netmask=24 if you added this manually........
Fix route and add missing route.
/ip route
add dst-address=192.168.68.0/24 gateway=WgServer routing-table=main
add dst-address=0.0.0.0/0 gateway=10.10.10.2 routing-table=main
As this is a router I would add the missing components..... but try what you have so far with the changes noted.

flyfinlander · October 20, 2025, 7:24am

Hi,

Anav, thanks for your efforts! I did it with routers.