I have two rOS routers (R1 lan: 192.168.1.0/24, R2 lan: 192.168.2.0/24) connected to cloudflare mesh via wireguard.
In my current setup I can access the hosts on the R2 lan from the R1 lan, however I'd like to set the default gateway of R1 to 192.168.2.1 (IP of R2), but that's not allowed since that IP is not directly reachable from R1, so a static route cannot be used. Cloudflare routes the packets between the two nets, so there is a third router in between, thus the multihop.
I've been reading that eBGP multihop could help, but I cannot figure out what are the main steps to make it work or rOS, since this seems like a pretty simple use case compared to what eBGP is capable. Or maybe you have a better idea on how to do it?
That's what I am already doing, as I wrote I can access hosts in the R2 lan from the R1 lan. Cloudflare has a routing table that you can customize, but I want to avoid adding a default route to R2 there, since it will affect all the routers that in the future will connect to cloudflare, in addition to R1.
The question is: how do you configure routing on one of routers (e.g. on R1) to allow access to devices on the other side of the other router (e.g. 192.168.2.0/24)? If you're using R2's wireguard IP address, then you should be able to do the same as default gateway. If you're using IP address of some third (cloudflare) router IP address, then you can't use it as default gateway, you'd have to run another (direct) IP tunnel between R1 and R2 (can be inside existing tunnels).
To access devices on 192.168.2.0/24 I have a route on R1 that forwards to the wireguard interface:
# R1 routing table
# DST-ADDRESS GATEWAY ROUTING-TABLE DISTANCE
1 As 192.168.2.0/24 wg-cloudflare main 1
then on cloudflare I have another identical route that forwards to the wireguard tunnel connected to R2. That's how I access devices on R1 lan.
However I want to add a default route, ideally like this:
# R1 routing table
# DST-ADDRESS GATEWAY ROUTING-TABLE DISTANCE
0 As 0.0.0.0/0 192.168.2.1 main 1
1 As 192.168.2.0/24 wg-cloudflare main 1
but that's not possible since 192.168.2.1 is not directly attached to R1.
As per your suggestion, I cannot add a direct tunnel, that's why I was looking into multihop and eBGP, since it looks like it can work in this scenario.
Well, you can create some tunnel over wireguard ... e.g. IPIP tunnel (or EoIP tunnel or even "inner" wireguard tunnel). Which would make connection between 192.168.1.1 and 192.168.2.1 a "direct", without intermediate routing hop. Without such direct tunnel, you would have to affect routing on that (or those if there are multiple) intermediate hop ... if you can actually do it (i.e. you're administrator of that/those hop/s).
I think you're right, no way to do it without controlling the intermediate hops.
I'd like to try something different of wireguard into wireguard, I'll have a look at IPIP and EoIP, any other suggestion? I have latest stable rOS on both ends.
Early in the use of IP there used to be a "source routing" option where a system (or router) could specify multiple hops for the routing of a packet. These were added as options in the IP header and taken away by successive hops.
Because this was a security nightmare, almost nobody supports it today. RouterOS still has the option "Accept source route" in IP settings (default no) but no capability to insert source route information.