First, apologies if my explanation is not clear. I’m very new to networking and trying to learn by doing. These terms and concepts are still unfamiliar.
My scenario is as follows:
- I have a remote WireGuard server. I am able to successfully connect to this from individual devices (e.g., iPhone) and route internet traffic via the server.
- I have just purchased my first Mikrotik router. I have successfully set it up so that all devices in my Home are connected and can access the internet.
- I’m trying to configure WireGuard on the Mikrotik. I want to be able to switch on/off a connection between the Mikrotik and the WireGuard server, so that internet traffic from my Home is routed via WireGuard.
I’ve learned a lot from information on this site, especially
https://help.mikrotik.com/docs/display/ROS/WireGuard and
https://forum.mikrotik.com/viewtopic.php?t=182340
But I’m still finding myself confused by new terms and concepts. I keep misconfiguring the router, being unable to access its IP, and having to factory reset the configuration and start over.
Grateful if someone could take a look over my approach and let me know if I’m on the right track. Appreciate any pointers in the right direction.
# create Wireguard interface using keys provided by the Wireguard server
/interface/wireguard
add listen-port=13231 name=WGinterface private-key="client-private-key"
# add Wireguard peer using the endpoint address and port provided by the Wireguard server. Permit requests to any IP/ the internet by allowing 0.0.0.0/0
/interface/wireguard/peers
add allowed-address=0.0.0.0/0 endpoint-address=server.public.ip.address endpoint-port=51820 interface=WGinterface public-key="server-public-key"
# assign IP address to the Wireguard interface
# Currently set to the interface address provided by the WG server, but I'm not sure whether this is correct.
/ip address
add address=10.1.1.2/24 interface=WGinterface
# add a routing table to direct internet traffic via Wireguard server
/routing table
add name=useWG fib
# add a rule to direct traffic to the routing table. If WG is down/inaccessible users can access the internet locally (i.e., action=lookup rather than action=lookup-in-table).
# For testing purposes src-address = all devices on my local network. I will probably constrain this to one or two specific devices once things are working.
# After reading the guides linked above I'm unsure whether a route for return traffic (replies) is also needed, or whether this is only necessary under specific circumstances (e.g., if there is a second WG tunnel connecting to remote/ offsite users).
/routing rule
add src-address=192.168.1.0/24 action=lookup table=useWG
# add a route to the useWG table to force all requests to the internet (i.e., 0.0.0.0/0) to use the WG interface
/ip route
add dst-address=0.0.0.0/0 gateway=WGinterface routing-table=useWG
# The Wireguard server provided an interface address of 10.1.1.2/24. As the server is expecting traffic from 10.1.1.2/24 I think I need to sourcenat, is this correct? Does this need to be assigned to the the useWG table?
/ip firewall nat
add action=masquerade chain=srcnat out-interface=WGinterface
I really appreciate any help to get this working. Or at least to identify what I am doing wrong that causes me to lose local IP access and have to factory reset the Mikrotik router. Please let me know if any additional information is needed.
