Different behavior in /routing rule and /ip firewall mangle

Expr · July 10, 2023, 9:17pm

I have two places (home and office) which are connected via wireguard interface. At “office” I have two networks 192.168.1.0/24 and 192.168.2.0/24 (let’s call them “remote networks”). At home I need two networks:

Home Router 192.168.99.0/24 (vlan 99)
a. Route traffic for remote subnets on Office router through wireguard connection
b. Route all other traffic through the local WAN at home.
It is just ordinary local network. Here I need access to “remote networks”. The trace to 8.8.8.8 must be smth like

192.168.99.1

87.87.87.87 ← It’s ISP gateway at home

Home Router 192.168.42.0/24 (vlan 42)
a. Route local traffic as expected ( either originating traffic on vlan XX to other local vlans, or return traffic/answer to those local vlans )
b. Route all other traffic through Wireguard to the office router.
It’s a route_everything_to_office_network. I want to route all traffic from unknown networks (aka default route) to “office” router. The trace to 8.8.8.8 must be smth like

192.168.42.1

192.168.4.1

88.88.88.88 ← It’s ISP gateway at office

In other words, for local network only packages with dest network 192.168.1.0/24 and 192.168.2.0/24 must be routed to the office router.
In contrast, for route_everything_to_office_network all packages but with dest network 192.168.42.0/24 and 192.168.99.0/24 must be routed to the office router.
I don’t need any device from remote networks has access any home networks.

The router at “office” is not a Mikrotik device. But I believe it was properly configured. Moreover I used to have openwrt router at home with similar setup and it worked just as expected.
My new Mikrotik router at home somehow works in configuration below.
I use a routing rule for route_everything_to_office_network.

/routing rule add action=lookup-only-in-table interface=vlan-office routing-mark=main table=office

But I need more complicated rules so I want use mangle instead of /routing rule. However as soon as I enable

/ip firewall mangle add action=mark-routing chain=prerouting disabled=yes in-interface=vlan-office new-routing-mark=office passthrough=yes

the route_everything_to_office_network don’t have access to any local network. I even cannot use DNS at 192.168.42.1. However all traffic goes to “office” router, and if I change DNS to 1.1.1.1 I could have access to the Internet from “route_everything_to_office_network” (via “office” router, just as expected).
Could someone explain what I missed and why it works with a routing rule but not with a mangle in my case?
Here is a config of “home” router

/interface bridge
add name=bridge_vlan pvid=99 vlan-filtering=yes
/interface lte
set [ find default-name=lte1 ] allow-roaming=no band=""
/interface wireguard
add listen-port=13231 mtu=1420 name=wg-office
/interface vlan
add interface=bridge_vlan name=vlan-local vlan-id=99
add interface=bridge_vlan name=vlan-smart vlan-id=10
add interface=bridge_vlan name=vlan-office vlan-id=42
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add comment=smart name=dhcp-pool-smart ranges=192.168.10.150-192.168.10.250
add comment=office name=dhcp-pool-office ranges=192.168.42.150-192.168.42.250
add comment=local name=dhcp-pool-local ranges=192.168.99.150-192.168.99.250
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=10m name=defconf
add add-arp=yes address-pool=dhcp-pool-smart comment=smart interface=vlan-smart name=dhcp-smart
add add-arp=yes address-pool=dhcp-pool-office comment=office interface=vlan-office name=dhcp-office
add add-arp=yes address-pool=dhcp-pool-local comment=local interface=vlan-local name=dhcp-local
/routing table
add disabled=no fib name=office
/interface bridge port
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge_vlan comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether2 pvid=10
add bridge=bridge_vlan comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether3 pvid=42
add bridge=bridge_vlan comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether4 pvid=99
add bridge=bridge_vlan comment=defconf frame-types=admit-only-vlan-tagged interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge_vlan tagged=bridge_vlan,ether5 untagged=ether2 vlan-ids=10
add bridge=bridge_vlan tagged=bridge_vlan,ether5 untagged=ether3 vlan-ids=42
add bridge=bridge_vlan tagged=bridge_vlan,ether5 untagged=ether4 vlan-ids=99
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=lte1 list=WAN
add interface=vlan-local list=LAN
add interface=vlan-smart list=LAN
add interface=vlan-office list=LAN
add interface=wg-office list=WAN
/interface wireguard peers
add allowed-address=0.0.0.0/0 interface=wg-office
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
add address=192.168.4.3/24 interface=wg-office network=192.168.4.0
add address=192.168.10.1/24 comment=smart interface=vlan-smart network=192.168.10.0
add address=192.168.42.1/24 comment=office interface=vlan-office network=192.168.42.0
add address=192.168.99.1/24 comment=local interface=vlan-local network=192.168.99.0
/ip dhcp-server network
add address=192.168.10.0/24 comment=smart dns-server=192.168.10.1 gateway=192.168.10.1
add address=192.168.42.0/24 comment=office dns-server=192.168.42.1 gateway=192.168.42.1
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1
add address=192.168.99.0/24 comment=local dns-server=192.168.99.1 gateway=192.168.99.1
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=mark-routing chain=prerouting disabled=yes in-interface=vlan-office new-routing-mark=office passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=src-nat chain=srcnat out-interface=wg-office to-addresses=192.168.4.3
/ip route
add disabled=no distance=1 dst-address=192.168.1.0/24 gateway=wg-office pref-src=0.0.0.0 routing-table=office scope=30 suppress-hw-offload=no target-scope=10
add disabled=no distance=1 dst-address=192.168.2.0/24 gateway=wg-office pref-src=0.0.0.0 routing-table=office scope=30 suppress-hw-offload=no target-scope=10
add disabled=no distance=10 dst-address=0.0.0.0/0 gateway=wg-office pref-src=0.0.0.0 routing-table=office scope=30 suppress-hw-offload=no target-scope=10
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/routing rule
add action=lookup-only-in-table disabled=no dst-address=192.168.1.0/24 routing-mark=main table=office
add action=lookup-only-in-table disabled=no dst-address=192.168.2.0/24 routing-mark=main table=office
add action=lookup-only-in-table disabled=no interface=vlan-office routing-mark=main table=office

cfg.rsc (8.25 KB)

anav · July 10, 2023, 11:40pm

Your explanation of requirements is weak, in fact you state something twice…

At the home router.
a. home network need to reach remote networks
b. office network needs to reach office network

but remote networks=office networks,

Thus you could have send the entire LAN at home needs to be able to reach the entire LAN at the office.
In other words would like to help once the requirements are made clear.
So no internet is required simply subnet(s) unknown to subnet(s) unknown traffic is the requirement.
++++++++++++++++++++++++++

Further you fail to state which routers config you are showing, presuming it to be the home router but what about the settings at the office router??

++++++++++++++++++++++++++++++

(1) Remove vlan99 from bridge definition (set it back to default 1)

(2) Why four pools and only 3 vlans, somethings not correct, ah the classic attempt to use bridge for DHCP and other crap.
Much prefer bridge does nothing but bridging once using vlans, and thus simply use another vlan.

(3) Whats On ether1
ethers 2-4 are to dumb devices ( access ports )
ether5 is going to smart device ( trunk port )

(4) What is the purpose of 192.168.88.0 if its not going anywhere?? not on any ports ???

(5) Why do you add wg-office interface to the WAN list, vice the LAN list for example…

(6) If this router is the client for handshake your peer settings are OFF.
first of all, if you are not using the internet of the office 0.0.0.0/0 is wrong and you are missing the rest of the peer information including persistent-keep-alive.
Maybe the house router is the server for the wg handshake??? Again, the allowed Ips would be wrong for this case.

(7) Your routes are potentially wrong.

++++++++++++++++++++++++++++++++++++

In summary its not clear so my assessment is not accurate I fear.
It may very well be that what you mean is that
vlan99 needs access to the subnets on the office router while vlan needs to go out internet of office router.

In any case clearer requirements, which router is server/client for wg handshake needs to be answered etc… and if possible the settings on the other MT router at the office would be helpful.
( Impossible to discuss the merits of routing rules vs mangling, when the config is not correct and the requirements are not clear )

Expr · July 11, 2023, 7:22pm

Thank you for the reply!

I’m sorry it’s all about naming. Here remote networks!=office network. In my example remote networks are 192.168.1.0/24 and 192.168.2.0/24 (at office). The office network is a 192.168.42.0/24 network (at home). I renamed it to route everything to office network in my original post, I’m not so good in naming but believe new name more clear describe the purpose of this network.

It’s what I need (and have done) for local network network:

/routing rule
add action=lookup-only-in-table disabled=no dst-address=192.168.1.0/24 routing-mark=main table=office
add action=lookup-only-in-table disabled=no dst-address=192.168.2.0/24 routing-mark=main table=office

And it works just as I expect.

I’ve tried to more clear describe what I need and changed bit my original post. In few words here I’ll try to explain it once more.
First of all everything at the local network works as expected. I have an access to remote networks (at office) and in case the wg interface is down for some reason the packets won’t be exposed to my home ISP. Any suggestions here of course very appreciated, but as for me it works OK.
The main question is about second newly named route everything to office network. I want this network to have access to all local networks (at home). Also all traffic to unknown networks (default rule) must be routed to the “office” router. It’s similar to private VPN case where ones want to route everything to VPN to hide traffic from ISP. I’ve changes my original post and hope now it’s more clear what I need.

I’m sorry again, indeed I was talking only about home router, since I believe everything OK with the office one. As for the office router in fact it’s not a Mikrotik router. It has quite a simple config, two networks, wg server. wg accepts packets only from 192.168.4.3 (that’s why I use src-nat on home router). I don’t think the office config really matter in my case since everything worked before (with openwrt router) and everything is working now (at least with with routing rules). Have no ideas what else from office router configuration could be useful in my case.

In fact it’s nice you asked about it. At first it was so, but when I looked at the vlan I saw a strange thing, it created vlan 1 on the bridge. Since it already added bridge as untagged port I decided that it’s better to specify here one of the existing network. And with that option this vlan 1 disappeared. Is it a bug in UI? If not why do you think it’s better to create one more vlan on the bridge?

I’m still testing the configuration, they are remnants of default configuration. As you could see it’s another bridge with the only port ether1. Right now I’m not ready to remove it since it could be very helpful in case I made an error in configuration and lost access to the router via local network.

The same as last one. In case of misconfiguration I just plug ethernet in ether1 to have access to the router.

/interface bridge port
add bridge=bridge comment=defconf interface=ether1

In fact I don’t think I need any incoming or forwarding rules for wg interface. So by now decided to threat it like WAN.

I’m sorry, I didn’t mentioned that I removed public ip addresses, macs, keys, etc. from config. But once more the tunnel is active, and everything works as expected (at least with routing rule). I’m absolutely sure it doesn’t matter, but indeed the home Mikrotik router is a client.

Thank you again for your suggestions, I’m not experienced in configuring Mikrotik devices, so of course any suggestions or improvements are welcome.
But the main problem here is that I don’t understand how mangle works in comparison with routing rules on Mikrotik devices. To be more precisely I don’t understand why adding mangle firewall rule blocks access to the local network. And it’s the only issue I still have unresolved. For example in my openwrt router I only need to mark packet in mangle rule and than use separate routing table for it. Here a bit different entities are used to describe routing and I don’t understand why as for me two identical configuration (one with /routing rule and another with /ip firewall mangle) behave differently.
I hope now I described more clear what do I need. Also I changed the original post and added two expected traces for those networks.

anav · July 11, 2023, 7:45pm

I will reread the first post and see if I can make sense of it. I am no expert and thus ask many silly questions!

Okay still the wording is off but I think I know what you mean.
I would describe it as so…

Home Router vlan99
a. Route traffic for remote subnets on Office router through wireguard connection
b. Route all other traffic through the local WAN at home.
Home Router vlan
a. Route local traffic as expected ( either originating traffic on vlan XX to other local vlans, or return traffic/answer to those local vlans )
b. Route all other traffic through Wireguard to the office router.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

The second requirement is a candidate for Routing Rules, a complete subnet needs to go through wireguard.
We typically use other routing rules in front of this to ensure local traffic works.
However you need to come clean?
Why does vlan42 ever need to reach vlan99 and vice versa… is it just a couple of users/devices on either side?
If its full access why two different vlans for example.

The first requirement should still be able to be handled with routing rules.
add src-address=subnet1-local dst-address=subnet1-office, action=lookup table=useWG
add src-address=subnet1-local dst-address=subnet1-office, action=lookup table=useWG

Expr · July 11, 2023, 8:53pm

Thank you for for describing my needs! You get it right. I’ll change my first post, so that it will be more clear for everyone, not only for me

The second requirement is a candidate for Routing Rules, a complete subnet needs to go through wireguard.
We typically use other routing rules in front of this to ensure local traffic works.

Indeed and it works just as I said before:

/routing rule
add action=lookup-only-in-table disabled=no dst-address=192.168.1.0/24 routing-mark=main table=office
add action=lookup-only-in-table disabled=no dst-address=192.168.2.0/24 routing-mark=main table=office
add action=lookup-only-in-table disabled=no interface=vlan-office routing-mark=main table=office

First two rules are applied to all interfaces and the last one only vlan-office interface. I use lookup-only-in-table to make sure such traffic won’t be exposed through home ISP.
But once again, I need more complex rules. For example I need to mark traffic not only by incoming interface but also by MAC. So I need to use mangle to mark the traffic and here we a going to the my initial question: Why when I use mangle instead of routing rules I lost access to the local network and more important to the router itself.
If I replace:

/routing rule add action=lookup-only-in-table disabled=no interface=vlan-office routing-mark=main table=office

with

/ip firewall mangle add action=mark-routing chain=prerouting disabled=no in-interface=vlan-office new-routing-mark=office passthrough=yes

I’ll lose access to the local network and more important to the router itself.

Why does vlan42 ever need to reach vlan99 and vice versa… is it just a couple of users/devices on either side?
If its full access why two different vlans for example.

Indeed it’s my legacy. In OpenWrt it was hard to mark packages by initial interface so it was much easier to introduce new bridge interface and new subnet. It looks like in future I could eliminate vlan42 if I manage to setup mangle rules. Right now I’m not 100% sure that I could get rid of vlan42, on some aspects it was useful.

The first requirement should still be able to be handled with routing rules.
add src-address=subnet1-local dst-address=subnet1-office, action=lookup table=useWG
add src-address=subnet1-local dst-address=subnet1-office, action=lookup table=useWG

Not sure why do I need to specify src-address here? If the packet is all allowed to route it doesn’t matter what src-address it has… Also I described why do I want to use lookup-only-in-table.
The rest is just as in my config… Did I missed something?

anav · July 11, 2023, 8:56pm

Notes:

Your access to the router is via ether1 OFF The bridge using a simple network of 192.168.55.0/24. Just plug in your laptop and manually input the ipv4 settings accordingly.
There is no need to add the sourcenat rule for Wireguard as this is done automatically as you have included the wireguard as a WAN list member!
Mangles removed
Peer settings clarified a bit.
Pvid REMOVED from bridge set back to default of 1.
Modifed the forward rules, so its clearer and better focussed on security.
Assumes you have setup your LTE connection (client) to accept the default route provided by the ISP as you have no manual route entry or IP address for the WAN. You need to use main table routes for your vlan99. In this way the router knows that for those specific subnets to send vlan99 out wireguard, otherwise the router will use the local WAN route for vlan99 traffic. The second manual route tells the router that for all traffic identified ( by “to-office” ) use the wireguard gateway.
…

/interface bridge
add name=bridge_vlan vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name=ether1-access
/interface lte
set [ find default-name=lte1 ] allow-roaming=no band=""
/interface wireguard
add listen-port=13231 mtu=1420 name=wg-office
/interface vlan
add interface=bridge_vlan name=vlan-local vlan-id=99
add interface=bridge_vlan name=vlan-smart vlan-id=10
add interface=bridge_vlan name=vlan-office vlan-id=42
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add comment=smart name=dhcp-pool-smart ranges=192.168.10.150-192.168.10.250
add comment=office name=dhcp-pool-office ranges=192.168.42.150-192.168.42.250
add comment=local name=dhcp-pool-local ranges=192.168.99.150-192.168.99.250
/ip dhcp-server
add add-arp=yes address-pool=dhcp-pool-smart comment=smart interface=vlan-smart name=dhcp-smart
add add-arp=yes address-pool=dhcp-pool-office comment=office interface=vlan-office name=dhcp-office
add add-arp=yes address-pool=dhcp-pool-local comment=local interface=vlan-local name=dhcp-local
/routing table
add disabled=no fib name=to-office
/interface bridge port
add bridge=bridge_vlan comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether2 pvid=10
add bridge=bridge_vlan comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether3 pvid=42
add bridge=bridge_vlan comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether4 pvid=99
add bridge=bridge_vlan comment=defconf frame-types=admit-only-vlan-tagged interface=ether5 comment="to access point"
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge_vlan tagged=bridge_vlan,ether5 untagged=ether2 vlan-ids=10
add bridge=bridge_vlan tagged=bridge_vlan,ether5 untagged=ether3 vlan-ids=42
add bridge=bridge_vlan tagged=bridge_vlan,ether5 untagged=ether4 vlan-ids=99
/interface list member
add comment=defconf interface=lte1 list=WAN
add interface=wg-office list=WAN
add interface=vlan-local list=LAN
add interface=vlan-smart list=LAN
add interface=vlan-office list=LAN
add ether1-access list=LAN comment="safe off-bridge access"
/interface wireguard peers
add allowed-address=0.0.0.0/0 interface=wg-office key="xxxx"  persistent-keep-alive=35sec \
 endpoint=IP-OfficeRouter endpointport=listeningPort-OfficeRouter
/ip address
add address=192.168.55.1/24 comment=defconf interface=ether1-access network=192.168.55.0
add address=192.168.4.3/24 interface=wg-office network=192.168.4.0
add address=192.168.10.1/24 comment=smart interface=vlan-smart network=192.168.10.0
add address=192.168.42.1/24 comment=office interface=vlan-office network=192.168.42.0
add address=192.168.99.1/24 comment=local interface=vlan-local network=192.168.99.0
/ip dhcp-server network
add address=192.168.10.0/24 comment=smart dns-server=192.168.10.1 gateway=192.168.10.1
add address=192.168.42.0/24 comment=office dns-server=192.168.42.1 gateway=192.168.42.1
add address=192.168.99.0/24 comment=local dns-server=192.168.99.1 gateway=192.168.99.1
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=forward comment="traffic out both local WAN and WG"  in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="allow portforwarding"  connection-nat-state=dstnat
add action=drop chain=forward comment="drop all else"   { this isolates the vlans at layer3 }
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip route
add  dst-address=192.168.1.0/24 gateway=wg-office routing-table=main 
add  dst-address=192.168.2.0/24 gateway=wg-office routing-table=main
add dst-address=0.0.0.0/0 gateway=wg-office routing-table=to-office
/routing rule
***** { placeholder but probably not needed }
add action=lookup-only-in-table  src-address=192.168.99.0/24 dst-address=192.168.1.0/24  table=to-office
add action=lookup-only-in-table  src-address=192.168.99.0/24 dst-address=192.168.2.0/24  table=to-office
add action=lookup-only-in-table  src-address=192.168.42.0/24 table=to-office
.................................

{ if there is any local traffic between vlan42 and other vlans, then we will need additional routing rules at the top but not convinced you do…

add action=lookup-only-in-table dst-address=192.168.99.0/24 table=main
add action=lookup-only-in-table dst-address=192.168.10.0/24 table=main

Expr · July 11, 2023, 9:06pm

Thank you once more, I need some time to understand the config and probably to experiment with it.

Expr · July 12, 2023, 3:18pm

Thank you for suggestions. 1, 2, 4 and 6 are clear for me.

Pvid REMOVED from bridge set back to default of 1.

I’ve already mentioned it. If I leave it default the router will create separate vlan on the bridge:

In fact I just found that I could specify frame-types=admit-only-vlan-tagged for vlan with the same result as with pvid. Now I’m quite sure that admit-only-vlan-tagged is a correct option for my case (at least it’s more clear), but still wondered, is it an error in Mikrotik active vlan presentation? And why is it wrong to specify Pvid? According to presentation it has the same result in the end.

Assumes you have setup your LTE connection (client) to accept the default route provided by the ISP as you have no manual route entry or IP address for the WAN. You need to use main table routes for your vlan99. In this way the router knows that for those specific subnets to send vlan99 out wireguard, otherwise the router will use the local WAN route for vlan99 traffic. The second manual route tells the router that for all traffic identified ( by “to-office” ) use the wireguard gateway.

It’s most controversial part for me.

Why do I need to specify source address in routing rules? If the packet is allowed to route (it comes from LAN) it doesn’t matter what src address it has. Why just don’t remove src-address here?

/routing rule
add action=lookup-only-in-table  src-address=192.168.99.0/24 dst-address=192.168.1.0/24  table=to-office
add action=lookup-only-in-table  src-address=192.168.99.0/24 dst-address=192.168.2.0/24  table=to-office

Why do you use src-address for default rule. Isn’t it better to use interface here instead?

/routing rule
add action=lookup-only-in-table  src-address=192.168.42.0/24 table=to-office

Why have you added route to 192.168.1.0/24 to main table? You have routing rules for this network which allows to search only in to-office table. In other words this rule in main table will never be applied.

/ip route
add  dst-address=192.168.1.0/24 gateway=wg-office routing-table=main 
add  dst-address=192.168.2.0/24 gateway=wg-office routing-table=main

In fact they are the only changes you made in the initial config in routes and routing rules. And as I said before right now with my initial config I have access from 192.168.42.0/24 to 192.168.99.0/24 and vice versa. So I don’t understand why do I need the rules you specified at the end:

{ if there is any local traffic between vlan42 and other vlans, then we will need additional routing rules at the top but not convinced you do…

add action=lookup-only-in-table dst-address=192.168.99.0/24 table=main
add action=lookup-only-in-table dst-address=192.168.10.0/24 table=main

I’m sorry, but my initial question still wasn’t covered. My initial configuration already works as expected. Your adjustments are very helpful but in general my old config works as expected.
As I said before I need to use mangle instead of routing rules to mark packets for to-office table (for example I want to use to-office routing for some MACs, even if device is connected to vlan-local). So as first approach I want to use mangle instead of routing rules for my trivial case.

Assuming that I have to use mangle instead of routing rules I still need the answer to my initial question from my first post:
What I missed and why the config with a routing rule works but the same config but with mangle doesn’t?

anav · July 13, 2023, 11:13am

We are at an impasse, there are many ways to achieve things in RoS, as far as VLANs go, nah your approach is sub optimal.
If you need finessing via mac addresses then you need to look at Bridge filter firewall rules not screw around with standard vlan setups.
And yes the defaulf vlan1 is always there, thats normal its transparent in the background.

I will relook at the mangling today.