Forget VPNs. The Real Problem Is Remote Router Management

3rd party tools
21

sure that's noted

22

(referring to place-before=0)

Okay, if you don't even know what's written in what you're proposing...
And the reason why it's wrong has already been written too many times on the forum
because I'll write it again and again...

23

I’m not sure which part you’re referring to. The provisioning generator I shared does not use place-before=0. Could you point me to the exact file or line where you see it?

24

Hey, Rextended, you were right about the place-before=0 issue. I went back to the drawing board and realized what you were pointing out.

Initially, I was correct to push back because I had not implemented any firewall manipulation in the provisioning script. The script was only creating the WireGuard tunnel, so forcing firewall order would have been the wrong approach.

Now that I started testing with firewall rules, I found the real issue: UDP traffic was being dropped because of existing firewall policies. I decided not to add automatic firewall changes because every user's MikroTik setup is different and I don't want TunGuard to modify or reorder their firewall rules.

Instead, I added documentation explaining how users can manually allow TunGuard traffic and move the rule above their drop rules when required.

You can find the documentation here:
https://mikrotik-provision.vercel.app/

Thanks again for the review. It helped me identify the issue much faster.