The UDM is located at my house, while at the moment I’m abroad.
I will have a look at the thread you quote, but I thought that, in mikrotik, the peer section is also use to connect to the wireguard server.
But maybe I’ll find the answer in the thread.
On UDM I don’t see a persistent-keep-alive value to set
I can surf, but when I try to ping the public IP of the WG_Server, from both the Mikrotik and the Macbook terminal, I get a timeout response.
The strange thing is that if I connect the Macbook to the WG_Server using the WG app, it connects, and then I can ping the public IP of the server (only from the Macbook).
This is the actual setup:
CLIENT
ISP Router —> Mikrotik hAPac2 —> Macbook
SERVER (ISP Fiber cable connects directly to the UDM Pro)
UDM Pro hosting the WG server
I understand you have a UDM router at home and this device has wireguard Server instance.
You also have a hapac2 but where is it located??
Assuming you have some sort of connection to the internet wherever you use it either from a wifi at hotel or plugged in matters little.
As stated you have a wireguard client setup on the router to phone UDM home.
I will repeat myself,
For the allowed Peers on the MT client device this is wrong!! /interface wireguard peers
add allowed-address=192.168.50.1/32,192.168.50.5/32,0.0.0.0/0 comment=UDM
endpoint-address=XX.XXX.XX.XX endpoint-port=62930 interface=WG1
public-key=“UDM_WG_Server_Public_Key”
Tell me what you hope to accomplish with the allowed peers you have chosen!! Explain it in words!!
Yes it needs persistent-keep-alive setting on the hapac2, and specifically on the peer setttings above for the UDM.
For sourcenat you need /ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat out-interface=WG1
NOW set a fixed static lease on your macbook or PC to an IP of 10.0.0.5/32 (wired for example) and a different one for wifi so you could access local WAN for ex.
Add A table and a Routing Rule /routing table add fib name=useWG
/routing rule add src-address=10.0.0.5/32 action=lookup table=useWG
The idea being you need to connect to the regular internet and IP route, to create the tunnel and then you want one use to go through the tunnel.
I connect the MT to whatever network I found while traveling.
In this case, it’s wired connected to a Movistar (Spanish ISP) modern/router
I will repeat myself,
For the allowed Peers on the MT client device > this is wrong!! /interface wireguard peers
add allowed-address=192.168.50.1/32,192.168.50.5/32,0.0.0.0/0 comment=UDM
endpoint-address=XX.XXX.XX.XX endpoint-port=62930 interface=WG1
public-key=“UDM_WG_Server_Public_Key”
Tell me what you hope to accomplish with the allowed peers you have chosen!! > Explain it in words!!
My only aim is to driven all the traffic via the wireguard interface. I changed it to 0.0.0.0/0
Yes it needs persistent-keep-alive setting on the hapac2, and specifically on the peer setttings above for the UDM.
For sourcenat you need /ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat out-interface=WG1
NOW set a fixed static lease on your macbook or PC to an IP of 10.0.0.5/32 (wired for example) and a different one for wifi so you could access local WAN for ex.
Add A table and a Routing Rule /routing table add fib name=useWG
/routing rule add src-address=10.0.0.5/32 action=lookup table=useWG
I tried with the IP I set for the bridge interface, but when I add this
But I don’t understand why if I ping my UDM I can’t get an answer, while if I’m connecting using the Wireguard app via that Macbook it connects w/o problem.
Also, is it normal for the last handshake timer to reset every 5/6 seconds? (video below)