Hi,
Just purchased a hEX RB750Gr3.
ether1 is connected to my network, and got an internal IP.
Managed to configure surfshark and got the VPN connection working on det hEX istelf.
DNS is working. I can ping google.com.
But connecting to ether2,ether3,ether4 or ether5 is not working.
What I would like is to connect to
ether2 - and get VPN connection to Denmark
ether3 - and get VPN connection to Finland
ether4 - and get VPN connection to USA
ether5 - and get VPN connection to Germany
How do I brigde/connect the ether-ports to be able to use different VPN connections ?
Ah, that makes sense. Thank you. Only one VPN connection can be enabled with wireguard.
Next step is to get PC that are connected to ether2-5 to be able to use the VPN then.
You can have many connections even with single WG interface. But remote addresses must not overlap. But when you want to route traffic to internet over it (i.e. remote address can be anything), they would always overlap. So you need separate WG interface for each.
Well stated as the op seemingly wants internet access to various sites and since such an allowed IP setting is 0.0.0.0/0 on the wireguard, it becomes clear that a different wireguard interface is required as the router would always pick the first peer for every internet attempt. ( order counts ) and never attempt to reach the rest of the sites.
Wont give any advice until you decide what the requirements are, seems to be a bit disjointed at the moment.
Try drawing a network diagram to show your intentions.
Then post full config
/export file=anynameyouwish ( minus router serial number or any public WANIP information )
Okey, so what i’m trying to figure out is how to use this device, as a “easy connect to different vpn countries”.
Did manage to enable dhcp server and when I connect PC to ether2/3/4/5 - check whatsmyip - and I can see that i’m using the VPN tunnel. I can ping google.com etc, but I cannot use web or netflix.
Not interested in a config with a firewall that is non-existent. If its facing the internet you should at least have a decent firewall. https://forum.mikrotik.com/viewtopic.php?t=180838 /ip firewall filter ???
add action=accept chain=output
add action=accept chain=input disabled=yes
add action=accept chain=forward
What I dont understand are your routes.
You need
a. standard route for going out your WANIP address
THen for wireguard you need.
a. table
/routing table
add name=use-WG-Denmark fib
b. a route.
add dst=address=0.0.0.0/0 gwy=Wireguard-Denmark table=use=WG-Denmark
c. a routing rule to force people out wireguard and not the local WANIP.
but we dont know quite enough yet to formulate …
+++++++++++++++++++++++++++++++++
Now we need to know what your requirements are.
Which LAN subnet should go out wireguard and if wireguard is not working for whatever reason should they be able then to fall back on and use the local WANIP?
If you are planning on buying enough vpns from a provider, then
a. as many tables needed, one for each wg configuration
/routing table
add name=use-WG-Denmark fib
add name=use-WG-Finland fib
add name=use-WG-USA fib
add name=Use-WG-Germany fib
+++++++++++++++++++
As stated need more info for routing rules. Which Subnet going out which wireguard tunnel.
You could have users select this on a WIFI basis, with SSIDs identifying the vlan/subnet and thus users decide.
In addition another consideration is subnet to subnet traffic. You should note that user will NOT be able to visit other subnets UNLESS you add additional rules allowing this PRIOR to the subnet being forced out the internet via wireguard.
Typically one uses a destination address add dst-address=subnetA action=lookup-only-in-table table=main { all users in every other subnet wanting to go to subnet A, will be sent to main table and thus will reach subnet A }
The device is behind a firewall, pfsense, already and gets an internal ip from the firewall/dhcp server.
The “allow all firewall” on the hEX is just to make sure that its not dropping anything.. but this I can adjust and tighten again, when I know it works
Okey, I will try to setup the device all over again. Really want this to work.
Its easy to the the surfshark software on a pc, but would be nice to have it working on the device - so I could just connect to see netflix from another country
Yup it should just work.
Post your latest config and I will have another look.
Lets start with one good wireguard connection, after that just buy more connections from the provider one for each country.
