Much appreciated, thank you. I’ll take a look once I’ve sorted out my, er, crappy configuration.
Coming to anav’s reply:
Thanks for taking the time to look at this. In hindsight, that was a poor choice of name. What do you use? bridge1, BR1, etc.?
You should read this reference… > your vlans are WRONG!
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
Once you have vlans, there should be no dhcp by the bridge, and thus no subnets associated with the bridge.
That was a very informative thread. It makes sense conceptually, but I want to see if I’ve understood the rationale behind it.
So far, I’ve mostly been using VLANs as an organizational tool. The only form of inter-VLAN access control was the tagged/untagged list on each port. However, the linked thread explains how to use VLANs for segregation, including explicitly defining a separate ‘base’ VLAN (which I believe is an implicit default VLAN in my case) and blocking all except specific inter-VLAN routes. If I have a DHCP server on my bridge, though, I’m offering that DHCP configuration not just to the implicit VLAN but to everything connected. Have I got that right?
Interface list should contain the vlans, not etheports!!!
I was going to ask you to elaborate on this, but I think I see how that makes more sense in the context of isolation.
If you redact wireguard peers then one cannot see the errors and from the rest of the crappy config, there are most likely errors.
Do not enter endpoint address, any keys, the rest is not an issue.
Here you go (please excuse the peer names; this is the full list, and I use comments in the real configuration):
/interface wireguard peers
add allowed-address=1.4.2.9/30 interface=wireguard2 name=peer7 \
persistent-keepalive=25s
add allowed-address=1.4.1.9/30 interface=wireguard1 name=\
peer8 persistent-keepalive=25s
add allowed-address=1.4.2.13/30 interface=wireguard2 \
name=peer9 persistent-keepalive=25s
add allowed-address=1.4.1.13/30 interface=wireguard1 name=\
peer10 persistent-keepalive=25s
add allowed-address=1.4.3.9/30 interface=wireguard3 name=\
peer11 persistent-keepalive=25s
add allowed-address=1.4.2.17/30 interface=\
wireguard2 name=peer12 persistent-keepalive=25s
What is your expectation of wireguard, to come in a specific WAN??
No, any WAN. My devices have multiples of the same WG configuration for each WAN’s public IP.
Are you hosting wireguard or only using third party servers?
Hosting.