I have successfully configured WireGuard on the first router and I am able to access the routers web config site. However when I try to connect to my local LAN, I am not able to get access. I tried different configurations on both 1st and second router but without success. Hope someone can advice how to get it working.
Architecture:
WWW → Router 1 (Latest RouterOS on VM - public IP: 12.34.56.789; Private IP: 10.210.0.1) ←-- [VPN Tunnel pptp-out1] --→ Router 2 (Latest RouterOS on RB4011iGS+ - IP: 192.168.50.1) → Local LAN (different networks, main has IP: 192.168.50.xxx)
Situation:
Trying to access local LAN (192.168.50.xxx), not working getting timeout. Able to access Router 1 on 10.210.0.1 through WWW and WireGuard connection on MAC.
Missing your local subnet on IP address ?? /ip address
add address=192.168.100.1/24 interface=wireguard1 network=192.168.100.0 ???
/ip dhcp-client
add !dhcp-options interface=ether1
What is the purpose of this rule…
More to the point you have a config mostly CONSUMED by different VPNs, ( i would get rid of all except wireguard and perhaps keep sstp as backku)
So why do you allow what looks like a public IP direct access to the router?? add address=92.60.203.156/30 list=MGMT-Allow
I am not sure what these are, but they be a problem as well!! add address=management-jaap.odin-ict.nl list=MGMT-Allow
add address=management-bryan.odin-ict.nl list=MGMT-Allow
Firewall rules are very hard to read, much better to put input chain together and forward chain together…
I would firewall totally differently but to enable wg to lan, perhaps stick in an explicit rule?? add action=accept chain=forward comment=“Allow WireGuard Traffic” src-address=
192.168.100.0/24
I will have to study your comments as this setup was made by someone else and I need to understand this better as well.
I had just noticed that there was something wrong with the routing after the upgrade to OS7 last week, so I decided to restore a backup incase something was changed during upgrade. After this suddenly I had access to my internal LAN. Which of course surprised me.
The different VPN’s are tunnels that are used to communicate between the two routers and also to the individual managing the first router, additionally some fall back VPN’s as well. We have not updated to WireGuard setup as the guy helping had not yet been able to implement it successfully in the past for other things and he is to busy to investigate more, so this is the reason it was not done and the reason I am trying to work on it now.
If not mistaken you are very knowledge able with setting up on configuring Mikrotik routers. Would you be interested to help me change over all the configuration to wireguard? I would be happy to compensate for your time.
If its two Mikrotik routers
Primary VPN WG.
a. use only wireguard between the routers.
b. wireguard can be give to users who need lan access remotely to both routers
c. wireguard can be used to configure/reach both routers by the admin
Backup VPN IP-IP using ipsec secret between the routers.
This is efficient and works well and is relatively easy to implement.
I would throw out completely the dogs breakfast you have inherited.
I will put something together that seems to meet the requirements at least for router1 which appears to the be the Server Peer for handshake.
R1 Sample… ( add back in things you need )
Assuming WAN is a dynamic public IP, not a static public IP.
Lots of rough edges, but the drift is eliminate all the VPN noise and settle on wireguard and will look at what alternative we have for backup.
If Router2 also has a public IP we can put a separate wireguard interface on that one, in case the issue is R1, and thus can still access R2.
Lots of unknowns to pin down.
/interface bridge
add name=bridge
/interface ethernet
set [ find default-name=etherX ] name=OffBridge-X
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface list
add name=WAN
add name=LAN
/ip pool
add name=10.210.1.0/24 ranges=10.210.1.2-10.210.1.254
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes
/ipv6 firewall settings
add chain=input action=drop
add chain=forward action=drop
/interface list member
add interface=ether1 list=WAN
add interface=bridge list=LAN
add interface=wireguard1 list=LAN
add interface=Offbridge list=LAN
/interface wireguard peers
add allowed-address=192.168.100.2/32 interface=wireguard1 name=Laptop
public-key=“xxxxxx”
add allowed-address=192.168.100.3/32 interface=wireguard1 name=
“Nvidea Shield” public-key=“xxxxxxxx”
add allowed-address=192.168.100.4/32 interface=wireguard1 name=Mac
public-key=“xxxxxxxx”
add allowed-address=192.168.100.5/32 interface=wireguard1 name=iPhone
public-key=“xxxxxxxx”
/ip address
add address=192.168.100.1/24 interface=wireguard1 network=192.168.100.0
add address=10.210.1.1/24 interface=bridge network=10.210.1.0
add address=192.168.55.1/30 interface=OffBridge-X network=192.168.55.0
/ip dhcp-client
add interface=ether1 set default route=yes
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,9.9.9.9
/ip firewall address-list { use static dhcp leases where applicable }
add address=10.210.1.XX list=Authorized comment=“local admin device1”
add address=10.210.1.YY list=Authorized comment=“local admin device2”
add address=192.168.100.2 list=Authorized comment=“remote admin laptop”
add address=192.168.100.5 list=Authorized comment=“remote admin iphone”
add address=my.netname.net list=MyWAN { if public IP is dynamic, otherwise replace with static IP on the dstnat rules }
{ others ?? }
/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input comment=“wireguard handshake” dst-port=13231 protocol=udp
add action=accept chain=input comment=“admin access” in-interface-list=LAN src-address-list=Authorized
add action=accept chain=input comment=“users to DNS services” in-interface-list=LAN dst-port=53 protocol=udp
add action=accept chain=input comment=“users to DNS services” in-interface-list=LAN dst-port=53 protocol=tcp
add action=drop chain=input comment=“drop all else” { insert this rule last }
++++++++++++++++++++
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“wireguard to local LAN” in-interface=wireguard1 dst-address=10.210.1.0/24
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat
add action=drop chain=forward comment=“drop all else”
