Issues with Ping between Wireguard Sites

RouterOS General
1

Dear all,

I am setting up a new network and have issues with wireguard and pinging hosts behind the router. I am not super experienced with networking, but I nearly got it to work as I need.
However, there is one connectivity issue that I cannot figure out and I am stuck also how to debug / get more information wher ethe problem might lie. I hope maybe someone here has an idea what’s going on or what I could look at closer?

Don’t have access to the devices at the moment, so I am the describing the network in the following as precisely as I can:

The network looks as in the attached image.
Router is on latest stable RouterOS 7 version, Switch is on latest stable SwitchOS version 2.

The bridged LAN network 192.168.1.0 works fine and I can ping any device amongst each other, Wifi works just fine etc…

The Wireguard Interface is added to the LAN Interface list.

Additionally. the following firewall rules are in place and way up in the order before any drop rules:

  • input accept icmp
  • input accept udp on WG endpoint port
  • input accept from WG interface
  • forward accept 192.168.3.0/42 to 192.168.1.0/42
  • forward accept 192.168.1.0/42 to 192.168.3.0/42

The WG on the Router has allowed IPs set to 192.168.1.0/24 and 192.168.3.0/24. The same is set in the Client WG.
On the Router additionally the Client IP is set to 192.168.3.1/24 so it receives this IP on the WG Router side to make sure there is no additional complexity/issue due to DHCP.
Router has IP 192.168.3.254/24 in IP/addresses for WG interface, 192.168.1.254/24 for LAN bridge.
Public Keys are correct and Router WAN IP (fixed) as well as endpoint also are correct on Client Side and Router Side.
Both are set to persistance keep alive of 25s.

Client additionally has fixed IP setting in the Wireguard network as 192.168.3.1/24 with gateway 192.168.3.254 plus added a route
192.168.1.0/24 via 192.168.3.254

Routes are configured as follow in the Router:
0.0.0.0/0 via 192..168.1.254
192.168.1.0/24 via %bridge
192.168.3.0/24 via %wireguard

The DHCP in LAN advertises the following networks:
192.168.1.0/24 via 192.168.1.254
192.168.3.0/24 via 192.168.3.254

The Switch has nothing configured like VLAN or similar, it is acting as an unmanaged Switch.

This is what I observe:
I can connect the wirguard Client to Router, see the handshake in the Router occuring, can ping the Router and the Switch from the Client.
I can ping the Client from the Router.
I can remotely access both WebFig interfaces of Router and Switch, but not of Wifi AP.

I cannot successfully ping the WiFi AP or the Host from the Client.
I do see with torch that the ICMP packages for Host exit the Router on the Interface Port between Router and Switch, however there is no RX coming back.

I tried to ping the Client from the Host, but the Host apparently did not receive the corresponding route from the DHCP server.
Note that the Host is Windows based, however external ping rule in Defender is setup and it can be successfully pinged by the Router.
After adding a manual route to 192.68.3.0/24 via 192.68.1.254 to the Host, I can actually ping the client on IP 192.168.3.1 sucessfully from the Host, and I see both TX and RX in torch on the LAN port between Router and Switch.
However, pinging from Client to Host is still not possible, only TX from 192.168.3.1 is shown, no RX.

I wrote a small python client for the Client and server application for the Host to test if actually other connections are possible.
So the Server listening on Host with a high port via TCP, waiting for data, printing it out and replying.
Client connecting to 192.168.1.2, sending data and waiting for answer.
Indeed, it worked flawlessly to connect, send data and receive an answer.

I am at a loss, my reasoning is being:

  • It cannot be the routing, as the python server/client test works and there are no ICMP specific firewall rules.
  • It cannot be the firewall, as the Ping in the other direction works without issue and I can ping the Switch behind the router, just not the Host or the WiFi AP
  • Host should be configured correctly, as it can be pinged by Router and it can ping the client
  • Client should be configured correctly, as it actually can ping the Switch.

There obiously has to be a problem, hope anybody can point me in the right direction.

Thanks in advance for anyone looking into it.
NetworkPlan.png

2

Generally speaking I would need to see both configs. I do note that probably your allowed IPs are the problem and possibly routing.
What is at the other end of the wireguard tunnel?

3 
# 2024-05-30 22:33:59 by RouterOS 7.12.1
# software id = NBL4-203W
#
# model = RB3011UiAS
# serial number = SERIAL
/interface bridge
add admin-mac=00:00:00:00:00:00 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether10 ] disabled=yes
/interface wireguard
add comment="Wireguard" listen-port=12345 mtu=1420 name=wireguard
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.1.100-192.168.1.199
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=10m name=dhcp-pool
/port
set 0 name=serial0
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4
add bridge=bridge comment=defconf ingress-filtering=no interface=ether5
add bridge=bridge comment=defconf ingress-filtering=no interface=ether6
add bridge=bridge comment=defconf ingress-filtering=no interface=ether7
add bridge=bridge comment=defconf ingress-filtering=no interface=ether8
add bridge=bridge comment=defconf ingress-filtering=no interface=ether9
add bridge=bridge comment=defconf ingress-filtering=no interface=ether10
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN lldp-med-net-policy-vlan=1
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set accept-redirects=no accept-router-advertisements=no disable-ipv6=yes forward=no max-neighbor-entries=8192
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add comment="wireguard" interface=wireguard list=LAN
/interface ovpn-server server
set auth=sha1,md5
/interface wireguard peers
add allowed-address=192.168.3.0/24,192.168.1.0/24 client-address=192.168.3.1/24 client-keepalive=25s comment=Client interface=wireguard persistent-keepalive=25s public-key="PUBLICKEY="
/ip address
add address=192.168.1.254/24 comment=defconf interface=bridge network=192.168.1.0
add address=11.12.13.14/20 interface=ether1 network=11.12.13.0
add address=192.168.3.254/24 comment=wireguard interface=wireguard network=192.168.3.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=192.168.1.1 client-id=1:00:00:00:00:00:00 comment=Host mac-address=01:02:03:04:05:06 server=dhcp-pool
/ip dhcp-server network
add address=192.168.1.0/24 comment=defconf dns-server=192.168.1.254 gateway=192.168.1.254 netmask=24
add address=192.168.3.0/24 gateway=192.168.3.254 netmask=24
/ip dns
set allow-remote-requests=yes servers=1.1.1.1
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="wireguard" dst-port=12345 protocol=udp
add action=accept chain=input in-interface=wireguard
add action=accept chain=forward comment="wireguard" dst-address=192.168.1.0/24 src-address=192.168.3.0/24
add action=accept chain=forward comment=wireguard dst-address=192.168.3.0/24 src-address=192.168.1.0/24
add action=accept chain=forward comment="wireguard selfrouting" in-interface=wireguard out-interface=wireguard
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="wireguard" in-interface=wireguard
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN log=yes
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip firewall service-port
set ftp disabled=yes
/ip route
add disabled=no distance=2 dst-address=0.0.0.0/0 gateway=01.02.03.04 pref-src="" routing-table=main suppress-hw-offload=no
/ip service
set telnet disabled=yes
set ftp disabled=
set ssh port=2345
set api disabled=yes
set api-ssl disabled=yes
/ip ssh
set host-key-size=4096 strong-crypto=yes
/ipv6 nd
set [ find default=yes ] disabled=yes hop-limit=64
/lcd
set enabled=no touch-screen=disabled
/lcd pin
set pin-number=XXXX
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/system clock
set time-zone-name=Europe/Berlin
/system console
set [ find ] disabled=yes
/system identity
set name="DEVICENAME"
/system note
set show-at-login=no
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool mac-server ping
set enabled=no

Here is the configuration of the router, I anonymized the external IP.
The Host ist a normal Windows machine, while the Client is a Linux Computer running a wireguard client.

But the Client wireguard is configured as follows:

-Endpoint Adress: 01.02.03.04 (anonymized)
-Endpoint Port: 12345
-Allowed IPs: 192.168.3.0/24,192.168.1.0/24

  • IP: Manual, Address 192.168.3.1, Netmask 255.255.255.0, Gateway 192.168.3.254
  • Route: 192.168.1.0, Netmask 255.255.255.0, Gateway 192.168.3.254, Metric 5
4

Before I look at the config, did you check the windows or linux PC host for its own firewall settings or the application perhaps has some blocking mechanisms???

This is nonsense and should be removed, there is no DHCP with wireguard. Also if you put in netmask manually remove it, not required.
/ip dhcp-server network
add address=192.168.1.0/24 comment=defconf dns-server=192.168.1.254 gateway=192.168.1.254 netmask=24
add address=192.168.3.0/24 gateway=192.168.3.254 netmask=24
Allowed IPs are weird!!
→ There is no keep alive required here
→ No such thing as client address required here, BUT we do put wireguard IP/32 of peer !
—> Allowed IP is all about the remote Users/Subnets, NOT LOCAL!! If connecting to a single device (roadwarrior), and not a router, then normally no other entry.

/interface wireguard peers
add allowed-address=192.168.3.0/24,192.168.1.0/24 client-address=192.168.3.1/24 client-keepalive=25s
comment=Client interface=wireguard persistent-keepalive=25s public-key=“PUBLICKEY=”

Change to:

/interface wireguard peers
add allowed-address=192.168.3.1/32, comment=Client
interface=wireguard public-key=“PUBLICKEY=”

5

Not fond of the messy firewall either chains not grouped etc…

Cleaned up version:
Did you really mean to give the wireguard user access to the input chain? If so, then it must be you as the admin for access.
In this case, lets make the security, access to the router better as well.

/ip firewall address-list
add address=192.168.1.X list=Authorized comment=“local admin PC”
add address=192.168.1.Y list=Authorized comment=“local admin laptop”
add address=192.168.3.1 list=Authorized comment=“remote admin linux”

/ip firewall filter
{default rules to keep}
add action=accept chain=input comment=“defconf: accept established,related,untracked” connection-state=established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
{admin rules}
add action=accept chain=input comment=“wireguard” dst-port=12345 protocol=udp
add action=accept chain=input in-interface-list=LAN src-address-list=Authorized comment=“admin access”
add action=accept chain=input in-interface-list=LAN comment=“user to services” dst-port=53 protocol=udp
add action=accept chain=input in-interface-list=LAN comment=“user to services” dst-port=53 protocol=tcp
add action=drop chain=input comment=“drop all else” { put this in as the very last rule }
++++++++++++++++++++++++++++++++++++++++++++++++++++
{default rules to keep}
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=“defconf: accept established,related, untracked” connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
{admin rules}
add action=accept chain=forward comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“wireguard to LAN” dst-address=192.168.1.0/24 in-interface=wireguard src-address=192.168.3.1/32
add action=drop chain=forward comment=“drop all else”

Note: I remove the rule for the entire LAN on the router to access the single linux device as it seemed also weird to me.

6

Dear anav,

Thank you so much for having a look at it!

I changed the wireguard and firewall configuration, it indeed is way cleaner this way.

However, I still observed the same symptom.
I confirmed that I can ping the windows machine via the RouterOS ping tool.
Also, I can ping the linux host from the windows machine.

So I found that the issue is the Windows Firewall, while I activated the ping, the default realm is only the local subnet.
Extending it to a larger net the ping works!

The issue with pinging the WiFi AP is still there, but I guess that this is another issue, as the WiFi AP is also not able to ping the Client.

Now that I know that these where two unrelated issues, I think I can dig around a bit more.

Thanks a lot!