hAP AC - Setup repeater with partial wireguard traffic

themax · October 9, 2024, 11:11pm

Hi, I want to use my hAP AC to connect my LAN devices and some 5G devices to my 2.5G network.
Furthermore, while most devices should directly connect to the internet, several devices (LAN and WIFI) should use a wireguard connection.

Rough setup scetch:
Router.drawio.png
While I completed the first part, and setup wireguard, I have no clue how to achieve that specific LAN ports or wifis (bound to a bridge, currently only one port) use the wireguard connection.
I.e. firewall, routing etc.

Here is my current config after reading some posts with similar topics:

# 2024-08-26 10:46:20 by RouterOS 7.15.2
# model = RB962UiGS-5HacT2HnT

/interface bridge
add admin-mac=XX:XX:XX:XX:XX:XX auto-mac=no comment=defconf name=bridge
add name=wgbridge

/interface wireguard
add listen-port=53107 mtu=1420 name=wg1

/interface list
add name=WAN
add name=LAN

/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys name=wifi_spot supplicant-identity=""
add authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys name=wifi_internet supplicant-identity=MikroTik

/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX country=germany disabled=no distance=indoors frequency=auto installation=indoor security-profile=wifi_internet ssid=KDG-FC598_EXT wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX country=germany distance=indoors frequency=auto installation=indoor mode=ap-bridge security-profile=wifi_spot ssid=Spot wireless-protocol=802.11

/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=wgpool ranges=192.168.89.100-192.168.89.200

/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
add address-pool=wgpool interface=wgbridge name=wgserver

/routing table
add comment="WireGuard" disabled=no fib name=wg

/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes

/interface bridge port
add bridge=bridge interface=ether2
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=sfp1
add bridge=bridge interface=ether1
add bridge=bridge interface=wlan2
add bridge=wgbridge interface=ether5

/ip neighbor discovery-settings
set discover-interface-list=LAN

/interface list member
add interface=bridge list=LAN
add interface=wlan1 list=WAN
add interface=wg1 list=WAN
add interface=wgbridge list=LAN

/interface wireguard peers
add allowed-address=192.168.33.0/24,192.168.44.0/24 endpoint-address=xx.xx.xx.xx:51821 interface=wg1 name=peer2 persistent-keepalive=25s \
    public-key="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
add address=192.168.22.8 interface=wg1 network=192.168.22.8
add address=192.168.89.1/24 interface=wgbridge network=192.168.89.0

/ip dhcp-client
add comment=defconf interface=wlan1

/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1
add address=192.168.89.0/24 dns-server=192.168.89.1 gateway=192.168.89.1

/ip dns
set allow-remote-requests=yes

/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan

/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=accept chain=forward comment=WireGuard in-interface=wgbridge out-interface=wg1

/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN

/ip route
add comment=WireGuard dst-address=0.0.0.0/0 gateway=wg1 routing-table=wg

/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6

/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" dst-port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN

/routing rule
add action=lookup comment=WireGuard src-address=192.168.89.0/24 table=wg

/system clock
set time-zone-name=Europe/Berlin

/system note
set show-at-login=no

/tool mac-server
set allowed-interface-list=LAN

/tool mac-server mac-winbox
set allowed-interface-list=LAN

Can someone help me out with a working setup or point me in the right direction

anav · October 9, 2024, 11:25pm

Not sure on your diagram,
It would appear that you have the hapac wired directly to the ISP router ( the hapac is also setup as a router ).
I am assuming that the ISP router gets a public IP and that you can forward the wireguard port from the ISP router to the MT router??

So need to confirm that and the part I find confusing is that 2.5 G connection which you state is a WAN connection to the internet, if so to what and from where??

themax · October 10, 2024, 7:47am

The hAPac is connected to the ISP router (called it “WAN Router” in my setup) via 2.5Ghz (in client mode) as I do not have the option to install cables there.
The hAPac should then route the traffic on wgbridge via wireguard to the external wireguard server (“other network”, which is public reachable)
currently no port forwarding

themax · October 20, 2024, 9:07pm

any more info required?

anav · October 21, 2024, 12:25am

Okay so I understand the diagram now.
It does not matter if the WANIP is public or if you can forward ports from the ISP router if the Mikrotik is simply a client device here.

Okay I see, your two LAN bridgse, no clue why you call it wireguard bridge, very confusing… is 192.168.89.0/24
What I Do see is that youve created two LAN subnets and are using bridges to separate them.
I hate that approach with a passion, either use one bridge with two vlans or most simple in your case…

Use the current bridge for .88 network as most all ports use that, and then simply put the other subnet directly on ether5
/interface bridge port
add bridge=bridge interface=ether2
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=sfp1
add bridge=bridge interface=ether1
add bridge=bridge interface=wlan2
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
add address=192.168.22.8 interface=wg1 network=192.168.22.0
add address=192.168.89.1/24 interface=ether5 network=192.168.89.0

/interface list member
add interface=bridge list=LAN
add interface=ether5 list=LAN
add interface=wg1 list= LAN
add interface=wlan1 list=WAN

In terms of wireguard almost there on the settings, it would appear you are trying to reach remote subnets 192.168.33.0/24 and 192.168.44.0/24, super but you missed the wireguard address

/interface wireguard peers
add allowed-address=192.168.22.0/24,192.168.33.0/24,192.168.44.0/24 endpoint-address=xx.xx.xx.xx:51821 interface=wg1 name=peer2 persistent-keepalive=25s
public-key=“xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx”

Get rid of DNS static setting… and add a server to current settings…
/ip dns set-allow-remote-requests=yes server=1.1.1.1

Firewall Rules… Modify for better security.

/ip firewall filter
add action=accept chain=input comment=“defconf: accept established,related,untracked” connection-state=established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
add action=drop chain=input comment=“defconf: drop all not coming from LAN” in-interface-list=!LAN
add action=accept chain=input **comment=“admin access only” src-address-list=**Authorized
add action=accept chain=input comment=“users to services” dst-port=53 protocol=udp in-interface-list=LAN
add action=accept chain=input comment=“users to services” dst-port=53 protocol=tcp in-interface-list=LAN
add action=drop chain=input comment=“Drop all else”
+++++++++++++++++++++++++++++++++++++++++++
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related
add action=accept chain=forward comment=“defconf: accept established,related, untracked” connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=forward comment=“internet access” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“allow users to wg” src-address=192.168.89.0/24 out-interface=wg1
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat disabled=yes { enable if required }
add action=drop chain=forward comment=“drop all else”

Note: add the input chain rule last AFTER you have the firewall address filled out otherwise you will lock yourself out.
Note: use dhcp static leases in address list where applicable.

/ip firewall address-list
add address=192.168.88.XX list=Authorized comment=“local admin PC wired .88 network”
add address=192.168.88.YY list=Authorized comment=“local admin laptop/smartphone wifi .88 network”
add address=192.168.89.BB list=Authorized comment=“local admin wired on .89 network”
add address=192.168.22.C list=Authorized comment=“remote admin laptop/smartphone”
add address=192.168.33.EE list=Authorized comment=“remote admin when at other site”

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

themax · November 5, 2024, 9:34pm

Thank you for your suggestions and helpful comments.

I was able to solve my problems:

It turned out that I was missing additional (manual) routes for the remote networks reachable by wireguard.
While 192.168.22.0/24 had an auto route due to the assigned address, there were none for 192.168.33.0/24, and 192.168.44.0/24
I was under the false impression that the allowed-address would somehow dynamically provide the routes

anav · November 5, 2024, 10:24pm

No worries, the only automagic created routes are those from the IP address part of the config.
Or if you have selected use default route in IP DHCP Client settings.