Mikrotik as road warrior Wireguard client to Unifi UDM

arjans90 · December 21, 2023, 1:57pm

Hi,

I find myself struggling with setting up my Mikrotik as a road warrior wireguard client.
The config which I get from the server does work on my phone and laptop, but I’d like to configure this straight in my Mikrotik router

Site A (client):
Mikrotik LTE dish (RBLHGGR)
WAN: super floaty, behind ISP NAT, terrible but nothing we can do about it
LAN: IP and subnet: 192.168.188.1/24
Desire: act as a Wireguard client to the Wireguard server set up at site B

Site B (server):
Ubiquiti Unifi UDM
IP and subnet of LAN: 10.103.14.1/24
WAN IP: fixed 12.34.56.78 (<== I’ll replace my actual IP everywhere to this one to make it as easy as possible)

[Interface]
PrivateKey = <private key Y>
Address = 192.168.2.2/32
DNS = 192.168.2.1

[Peer]
PublicKey = <public key Z>
AllowedIPs = 192.168.2.0/24, 10.103.14.0/24
Endpoint = 12.34.56.78:51820

(this exact same config works on my phone when imported into the app)
(I also added Y and Z, just in case in the future we find ourselves needing to copy/post more then one public/private key value)

As you see the UDM has seperate subnet for wireguard clients, basically assigning the Mikrotik one IP for the tunnel and thus (assumption on my side) we probably need to play around with NAT.

What did I do so far: lots of research, found some interesting topics on this forum as well, but got my main inspiration from https://forum.mikrotik.com/viewtopic.php?t=182340 adapting for the part mentioning third pary VPNs (which I belief I can consider my UDM to be).

Last but not least my Mikrotik config. Basically I have only made changes to the default configuration as the default config does serve my purpose very well.

# 2023-12-21 14:52:34 by RouterOS 7.13
# software id = **ELIDED**
#
# model = RBLHGGR
# serial number = **ELIDED**
/interface lte
set [ find default-name=lte1 ] allow-roaming=no band=""
/interface wireguard
add listen-port=51820 mtu=1420 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=default-dhcp ranges=192.168.188.10-192.168.188.254
/ip dhcp-server
add address-pool=default-dhcp interface=ether1 lease-time=10m name=defconf
/port
set 0 name=serial0
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=ether1 list=LAN
add comment=defconf interface=lte1 list=WAN
/interface wireguard peers
add allowed-address=10.103.14.0/24,192.168.2.0/24 endpoint-address=\
    12.34.56.78 endpoint-port=51820 interface=wireguard1 public-key=\
    "<public key Z>"
/ip address
add address=192.168.188.1/24 comment=defconf interface=ether1 network=\
    192.168.188.0
add address=192.168.2.2/24 interface=wireguard1 network=192.168.2.0
/ip dhcp-server network
add address=192.168.188.0/24 comment=defconf dns-server=192.168.188.1 \
    gateway=192.168.188.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.188.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=forward out-interface=wireguard1 src-address=\
    192.168.188.0/24
add action=accept chain=forward dst-address=12.34.56.78 in-interface=\
    wireguard1
add action=accept chain=forward in-interface=wireguard1 out-interface=lte1
add action=accept chain=forward dst-address=10.103.14.0/24 src-address=\
    192.168.188.0/24
add action=accept chain=forward dst-address=192.168.188.0/24 src-address=\
    10.103.14.0/24
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat out-interface=wireguard1
/ip route
add disabled=yes distance=1 dst-address=10.103.14.0/24 gateway=wireguard1 \
    pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
    target-scope=10
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/Warsaw
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

My goal: be able to reach the UDM and other things in site B by devices on site A and vice versa.

Issue: i see packages going out, but not returning and have no idea where i should look to solve this.

llamajaja · December 21, 2023, 8:00pm

(1) Dont understand your Server UDM settings.

a. You should show all the peers on the UDM.
b. Each peer client gets a separate line entry.
c. Each peer client in allowed IPs should be show as the actual IP/32 of that client peer.
d. The UDM does not require an endpoint in allowed IPs, IT IS the endpoint LOL.
Note: The client devices at the remote folks and the client MT router on their single peer setting to the server use 0/24 for the wireguard subnet.

(2) The allowed IPs on the mikrotik seem fine, assuming that the 10 subnet is on the UDM and either its users come into the MT or your users need to visit the UDM subnet or both are true.
However what is MISSING is you need to add persistent-keep-alive=35

(3) One thing about allowed IPs, for any remote subnet entries, there will be an ip route needed to match as the router will not know where to send that traffic.
MISSING!!!
/ip route
add dst-address=10.103.14.0/24 gateway=wireguard1 routing-table=main

(4) BIG PROBLEM why did you give the UDM server device and the MT router the same wireguard IP address. change to 192.168.2.1 for the UDM and stick to 192.1268.2.2 for the MIKROTIK

(5) Firewall Rules ISSUES.

a. Get rid of these nonsense rule:
**** add action=accept chain=forward dst-address=12.34.56.78 in-interface=wireguard1
add action=accept chain=forward in-interface=wireguard1 out-interface=lte1

All you need is to allow LAN to WAN traffic as per the rest of the traffic and the wireguard will do the rest.

b. The bold rule below ***** is NOT required and can be removed, as prior to this rule you already allow your subnet to enter the tunnel.
( add action=accept chain=forward out-interface=wireguard1 src-address=192.168.188.0/24 )

******* add action=accept chain=forward dst-address=10.103.14.0/24 src-address=
192.168.188.0/24**

c. Do you really want the 10 remote subnet to be able to visit your local .88 subnet, if so rule you have will suffice but this is clearer.
add action=accept chain=forward dst-address=192.168.188.0/24 in-interface=wireguard1 src-address=
10.103.14.0/24

arjans90 · December 21, 2023, 8:28pm

Thanks for your feedback. The first config part is not the UDM server config, but a specific peer config it offers as a download.

I’m not sure if I understand your fourth point, I imagine my clarification might help.

I’ll try the suggestion, they seam logical

llamajaja · December 21, 2023, 8:45pm

Why would you even consider posting a peer config the UDM thought the peer should have MAKES ZERO LOGIC.

Need to see actual UDM config (server)
and actual peers (clients) of interest CONFIGS.

arjans90 · December 21, 2023, 9:14pm

The config I posted is the one, that if I import it on (e.g.) my phone would connect it to the UDM. It would create a peer on my phone using those settings. My assumption is that I would need to interpret that config to configure my MT accordingly as in essence the MT and my phone from the UDM point of view would be the same. Obviously i have seperate client entries in my UDM for my phone, MT and other clients.

Hope this clarifies and makes sense, if not i woud like to seek understanding.

arjans90 · December 21, 2023, 9:28pm

Unfortunately it doesn’t seam to be working. Please find below my updated config. I included all required modifications and most of your suggestions.

Points I’m not sure about:

the IP address of the wireguard interface is set to 192.168.2.2/24, doesn’t it need to be /32 as per the “template”?
there is only one mentioning of srcnat, is this really all? Does it need more? Do we need it at all?

# 2023-12-21 22:23:47 by RouterOS 7.13
# software id = DB4X-BA83
#
# model = RBLHGGR
# serial number = HCW08DWDQHK
/interface lte
set [ find default-name=lte1 ] allow-roaming=no band=""
/interface wireguard
add listen-port=51820 mtu=1420 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=default-dhcp ranges=192.168.188.10-192.168.188.254
/ip dhcp-server
add address-pool=default-dhcp interface=ether1 lease-time=10m name=defconf
/port
set 0 name=serial0
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=ether1 list=LAN
add comment=defconf interface=lte1 list=WAN
/interface wireguard peers
add allowed-address=10.103.14.0/24,192.168.2.0/24 endpoint-address=\
    12.34.56.78 endpoint-port=51820 interface=wireguard1 \
    persistent-keepalive=35s public-key=\
    "<public key Z>"
/ip address
add address=192.168.188.1/24 comment=defconf interface=ether1 network=\
    192.168.188.0
add address=192.168.2.2/24 interface=wireguard1 network=192.168.2.0
/ip dhcp-server network
add address=192.168.188.0/24 comment=defconf dns-server=192.168.188.1 \
    gateway=192.168.188.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.188.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=forward out-interface=wireguard1 src-address=\
    192.168.188.0/24
add action=accept chain=forward dst-address=10.103.14.0/24 src-address=\
    192.168.188.0/24
add action=accept chain=forward dst-address=192.168.188.0/24 in-interface=\
    wireguard1 src-address=10.103.14.0/24
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat out-interface=wireguard1
/ip route
add disabled=no distance=1 dst-address=10.103.14.0/24 gateway=wireguard1 \
    pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
    target-scope=10
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/Warsaw
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

anav · December 21, 2023, 11:08pm

Two things.
a. the UDM must have 192.168.88.0/24 as part of its allowed Ips, for the peer settings for the MT router.
If you do have this on the uDM device settings, then you do not need to masquerade the traffic from the MT router and thus should remove it.

b. if you cannot add that to the UDM then the masquerade out wireguard, which you currently have makes sense.

In either case I would add a forward chain rules
add chain=forward action=accept in-interface=wireguard dst-address=192.168.88.0/24
add chain=forward action=accept out-interface=wireguard src-address=192.168.88.0/24

rplant · December 21, 2023, 11:31pm

Hi,
It seems mostly good.

Double Check (again) the public key at each end is correct.

At the UDM:
Are the packets arriving at the UDM.
Is the UDM sending anything back?
Does the UDM actually have 192.168.2.1/24 assigned to wg interface.

arjans90 · December 21, 2023, 11:40pm

Thanks for the clarification. Its the second case, so in that case i need the nat.

I actually had already those rules. Your first one was less strict as mine, so i had good hope. Unfortunately it didn’t help.

I do have extra input. The traffic counters on those two rules: the one with the out interface has seen traffic, the other one, even as loose as not defining any dat address, is still at 0 received. The counter of the nat rule is also increasing and thus used.

arjans90 · December 21, 2023, 11:54pm

Here a screenshot of the UDM side. The key under the long green marking is used in the MT.

I will see if i can check if traffic is received and or send back.
IMG-20231222-WA0000(1).jpg

arjans90 · December 22, 2023, 9:33am

The UDM doesn’t have a way (to my knowledge) to see some decent logging on the firewall. Next best thing I could do to publish as much info as possible on this is the output of “iptables -L”
I’ll keep looking if I can find some actual logging. The main reason why I would think the firewall on the UDM side is not the issue is because other clients are able to connect to the UDM wireguard server.

I have tripple checked the keys, but no luck

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
UBIOS_INPUT_JUMP  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
UBIOS_FORWARD_JUMP  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
UBIOS_OUTPUT_JUMP  all  --  anywhere             anywhere

Chain UBIOS_FORWARD_IN_USER (1 references)
target     prot opt source               destination
UBIOS_WAN_IN_USER  all  --  anywhere             anywhere             /* 00000001095216690482 */
UBIOS_LAN_IN_USER  all  --  anywhere             anywhere             /* 00000001095216690483 */

Chain UBIOS_FORWARD_JUMP (1 references)
target     prot opt source               destination
UBIOS_FORWARD_USER_HOOK  all  --  anywhere             anywhere

Chain UBIOS_FORWARD_OUT_USER (1 references)
target     prot opt source               destination
UBIOS_WAN_OUT_USER  all  --  anywhere             anywhere             /* 00000001095216690482 */
UBIOS_LAN_OUT_USER  all  --  anywhere             anywhere             /* 00000001095216690483 */

Chain UBIOS_FORWARD_USER_HOOK (1 references)
target     prot opt source               destination
UBIOS_FORWARD_IN_USER  all  --  anywhere             anywhere             /* 00000001095216690481 */
UBIOS_FORWARD_OUT_USER  all  --  anywhere             anywhere             /* 00000001095216690482 */

Chain UBIOS_INPUT_JUMP (1 references)
target     prot opt source               destination
UBIOS_INPUT_USER_HOOK  all  --  anywhere             anywhere

Chain UBIOS_INPUT_USER_HOOK (1 references)
target     prot opt source               destination
UBIOS_WAN_LOCAL_USER  all  --  anywhere             anywhere             /* 00000001095216690481 */
UBIOS_LAN_LOCAL_USER  all  --  anywhere             anywhere             /* 00000001095216690482 */

Chain UBIOS_IN_GEOIP (0 references)
target     prot opt source               destination

Chain UBIOS_LAN_IN_USER (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             10.103.14.0/24       match-set UBIOS_local_network src ctstate NEW /* 00000001095216670481 */
RETURN     all  --  10.103.14.0/24       anywhere             match-set UBIOS_local_network dst ctstate NEW /* 00000001095216670482 */
RETURN     all  --  10.103.14.0/24       anywhere             /* 00000001095216720481 */
NFLOG      all  --  anywhere             anywhere             limit: avg 50/sec burst 100 nflog-prefix  "[LAN_IN-RET-2147483647] DESCR=\"no rule description\"" nflog-threshold 16
RETURN     all  --  anywhere             anywhere             /* 00000001097364144127 */

Chain UBIOS_LAN_LOCAL_USER (1 references)
target     prot opt source               destination
NFLOG      all  --  anywhere             anywhere             limit: avg 50/sec burst 100 nflog-prefix  "[LAN_LOCAL-RET-2147483647] DESCR=\"no rule description\"" nflog-threshold 16
RETURN     all  --  anywhere             anywhere             /* 00000001097364144127 */

Chain UBIOS_LAN_OUT_USER (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             10.103.14.0/24       /* 00000001095216720481 */
NFLOG      all  --  anywhere             anywhere             limit: avg 50/sec burst 100 nflog-prefix  "[LAN_OUT-RET-2147483647] DESCR=\"no rule description\"" nflog-threshold 16
RETURN     all  --  anywhere             anywhere             /* 00000001097364144127 */

Chain UBIOS_OUTPUT_JUMP (1 references)
target     prot opt source               destination

Chain UBIOS_OUTPUT_USER_HOOK (0 references)
target     prot opt source               destination

Chain UBIOS_OUT_GEOIP (0 references)
target     prot opt source               destination

Chain UBIOS_WAN_IN_USER (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED /* 00000001095216690481 */
DROP       all  --  anywhere             anywhere             ctstate INVALID /* 00000001095216690482 */
RETURN     tcp  --  anywhere             DESKTOP-0R7JA9I.localdomain  tcp dpt:ms-wbt-server /* 00000000004294997301 */
NFLOG      all  --  anywhere             anywhere             limit: avg 50/sec burst 100 nflog-prefix  "[WAN_IN-D-2147483647] DESCR=\"[WAN_IN]Drop All Other Traffic\"" nflog-threshold 16
DROP       all  --  anywhere             anywhere             /* 00000001097364144127 */

Chain UBIOS_WAN_LOCAL_USER (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere             match-set UBIOS_6581e9d759441b6e278bb5ec dst /* 00000001095216680480 */
RETURN     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED /* 00000001095216690481 */
DROP       all  --  anywhere             anywhere             ctstate INVALID /* 00000001095216690482 */
RETURN     udp  --  anywhere             anywhere             match-set UBIOS_ipsec_ports dst /* 00000000008589964597 */
RETURN     esp  --  anywhere             anywhere             /* 00000001095216690486 */
RETURN     udp  --  anywhere             anywhere             match-set UBIOS_wireguard_ports dst /* 00000000008589964599 */
NFLOG      all  --  anywhere             anywhere             limit: avg 50/sec burst 100 nflog-prefix  "[WAN_LOCAL-D-2147483647] DESCR=\"[WAN_LOCAL]Drop All Other Traf\"" nflog-threshold 16
DROP       all  --  anywhere             anywhere             /* 00000001097364144127 */

Chain UBIOS_WAN_OUT_USER (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere             /* 00000001097364144127 */

arjans90 · December 22, 2023, 9:41am

I found the issue!

The private key mentioned in the template config form the UDM needed to be set as the private key on the interface at the MT

Does that make sense? Is that standard practice? Did I read over this the whole time?

anav · December 22, 2023, 8:41pm

That is weird,
Normally that is only done by third party DNS providers because they have no way to get your public key generated by your device, in this case the public key generated by the MIkrotik.

Third party providers get you to put their generated PRIVATE KEY in your MT PRIVATE KEY settings for the interface, so that they will automatically KNOW the public key you would have sent them as the the same key will be generated by the same private key entry. So its convenient but also dangerous as the private key is now in email or circulating…

The only reason UDM is forcing you to use their private key should be if there is no way you to put the MT public Key into the UDM.
I find this hard to believe.

For me the problem is the UDM has to have a wireguard IP address of 192.168.2.1 can you confirm??

arjans90 · December 22, 2023, 9:28pm

Hi, yes everything you just mentioned is true. I have no option to enter a public key of my MT in the UDM, so your reasoning makes sense. You are able to setup an own IP range, this one so happens to be the default.