Hi everyone, I have a specific challenge on a MikroTik CHR (v7). I have two WireGuard interfaces (wg1 and wg2) that are connecting to the exact same remote Endpoint IP address. I need to force each interface to reach that same IP through different WAN gateways: wg1 must reach the Endpoint via G…

Maybe something like: /ip firewall mangle add chain=output action=mark-routing protocol=udp src-port=56860 \ dst-address=146.70.187.130 dst-port=51820 new-routing-mark=wg1 passthrough=no add chain=output action=mark-routing protocol=udp src-port=14037 \ dst-address=146.70.187.130 dst-port=5…

Isn’t “mangle” the old way and for v7 you should simply use policy-based-routing ?? Go to “routing” , then “rules” and then create at least 1 rule to “intercept” traffic from a certain wgX interface and throw it out whatever WAN-port you want ? Make sure your NAT config is also correct. …

I would want to see a network diagram first as its not clear to me what devices are involved and what subnets are involved etc.. In both cases is the CHR acting as server for handshake for both WGs? Are you attempting to different tunnels to CHR from same MT router??? If so how many WANS does th…

If I understand the situation correctly, the proper solution for you is to simply assign different listen ports to the two interfaces, and point one of the wg tunnels to your appropriate vrf. The vrf feature for underlay traffic is a relatively new feature. If you don't have a vrf, create one. Vrfs…

As far as I have understood, “Mangle” is the more advanced/complex way of doing PBR. Routing-Rules are the easy, fast way to do things - but with a lot less options. But I think it is by design difficult to PBR WireGuard. Is it not possible to say WG0 hat the IP 172.16.0.1, WG1 has 172.16.1.1 (all…

2026-04-19 17:41:40 by RouterOS 7.19.4 system id = QEn38+9e4EM /interface ethernet set [ find default-name=ether1 ] disable-running-check=no /interface l2tp-client add connect-to=92.38.132.67 disabled=no name=Admin user=aa /interface wireguard add listen-port=56860 mtu=1420 name=wg1 /interface w…

[image] fivestar: Would setting different listen-port values on my side allow me to capture that traffic in Mangle and apply different routing-marks? I think this would be the easiest solution for your needs. Your two wg1 and wg2 interfaces are probably already listening on two different port…

[image] fivestar: /ip route add disabled=no dst-address=0.0.0.0/0 gateway=wg1 routing-table=wg1 suppress-hw-offload=no /ip route add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=wg2 routing-table=wg2 scope=30 suppress-hw-offload=no target-scope=10 DO NOT have these two routes in your…

i try this but no work on mangle dont show anything

MikroTik community forum

Change Wireguard src-address

RouterOS General

Znevna April 19, 2026, 8:35am 3

RouterOS blatantly ignores pref-src. Can this really be a bug? General

I was planning on writing out an example, so just for your reading pleasure: the official “rabbit hole solution” to multi-wan wireguard hosting. We have two WANS. For this example, the two WAN connections are actually EoIP tunnels to another router. The base configuration is: Interfaces: /interface eoip add name=eoip-wan1 remote-address=[other_router] tunnel-id=10 add name=eoip-wan2 remote-address=[other_router] tunnel-id=20 Addresses: /ip address add address=192.168.111.10/24 interface=eoi…

show post in topic

Home
Categories
Guidelines

Powered by Discourse, best viewed with JavaScript enabled