MikroTik Wireguard as Peer - Handshake working but no ping

RouterOS General
1

Dear MikroTik-Forum,

Since yesterday I try to get my MikroTik Router to work as a WireguardPeer.

Setup:
RaspberryPi (Wireguard Server via PiVPN) ↔ Router ISP ↔ MikroTik Router (Wireguard Peer) ↔ Local Network
|_______________ Network 1 _______| | Network 2 _________________|

Connecting from other Wireguard-Peers outside of Network 1 to the Wireguard-Server works fine.

Problem:
I configured my MikroTik Router (RouterOS 7.1.1) and the Handshake to the Wireguard-Server is successfull.

wg show

on the Wireguard-Server shows a latest Handshake which is updatet every 1-2 minutes.
But when I try to ping my Wiregurd-Server from the MikroTik Router I will get a timeout.

This is the Wiregurd-Server peer config:

[Interface]
PrivateKey = ******
Address = 10.6.0.5/24
DNS = 9.9.9.9, 149.112.112.112

[Peer]
PublicKey = ******
PresharedKey = ******
Endpoint = ******:6969
AllowedIPs = 0.0.0.0/0, ::0/0

This is my MikroTik config:

feb/01/2022 10:09:25 by RouterOS 7.1.1

[code] model = RBD53iG-5HacD2HnD
/interface bridge
add admin-mac=******* comment=defconf name=bridge
/interface wireguard
add listen-port=13231 name=Wireguard
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk mode=dynamic-keys name=W-LAN_PASS \
    supplicant-identity=MikroTik
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    distance=indoors frequency=auto installation=indoor mode=ap-bridge name=\
    wifi2 security-profile=W-LAN_PASS ssid=******* \
    wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
    20/40/80mhz-eeCe distance=indoors frequency=auto installation=indoor \
    mode=ap-bridge name=wifi5 security-profile=W-LAN_PASS ssid=\
    ******* wireless-protocol=802.11
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=yes interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4
add bridge=bridge comment=defconf ingress-filtering=no interface=ether5
add bridge=bridge comment=defconf ingress-filtering=no interface=wifi2
add bridge=bridge comment=defconf ingress-filtering=no interface=wifi5
/ip firewall connection tracking
set enabled=yes
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=******* endpoint-port=\
    6969 interface=Wireguard persistent-keepalive=10s public-key=\
    "*******"
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
/ip dhcp-client
add comment=defconf interface=ether1 use-peer-dns=no
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes cache-max-ttl=1d servers=192.168.88.112
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment=SSH dst-port=1124 in-interface-list=\
    WAN protocol=tcp to-addresses=192.168.88.112 to-ports=22
add action=dst-nat chain=dstnat comment="Webserver HTTP" dst-port=80 \
    in-interface-list=WAN protocol=tcp to-addresses=192.168.88.112 to-ports=\
    80
add action=dst-nat chain=dstnat comment="Webserver HTTPS" dst-port=443 \
    in-interface-list=WAN protocol=tcp to-addresses=192.168.88.112 to-ports=\
    443
add action=dst-nat chain=dstnat comment=OpenVPN dst-port=1126 in-interface=\
    *FFFFFFFE in-interface-list=WAN protocol=udp to-addresses=192.168.88.112 \
    to-ports=1126
/ip service
set www port=8080
/ip socks
set auth-method=password version=5
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=*******
/system routerboard settings
set cpu-frequency=auto
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Thanks for your help!

Cheers.

2

You’re missing route(s):

/ip route
add dst-address=<whatever subnet is at the other side> gateway=Wireguard

Repeat if you have more. Also peer’s endpoint on server looks wrong, it has port 6969, but WG on RB has listen-port=13231. And you may want some 10.6.0.x/24 address for WG inteface, but it’s not strictly required.

3

Hi Sob,

thanks for your fast reply!
It worked setting the Route and the /ip address add … route. I also matched the endpoint port and the listening port!

One question left, why do the Listening port in the Interface and the Endpoint Port match? Isn’t the Listening-Port the port on the RouterBoard and the Endpoint the port on my RasperryPi Server?

Thanks and cheers

4

Listening port on your router = endpoint port used by peer defined on remote router.
Endpoint port of peer defined on your router = listening port of remote router.

That’s if both peers have public addresses and open ports, i.e. any peer can reach the other one at any time. If one is behind NAT and can’t accept incoming connections, its listening port is not important, and endpoint for this peer on other router should be empty.

5

Perfect thanks.

Maybe you can help me some more, which I really appreciate!!
I would like to route all my outgoing traffic through the WG interface.
(ELI5: If I open a website they will see the IP of the WG-Server and not the IP of my current ISP)

Thanks!

6

If the intent was to connect from the MT Remote device to the PI server to establish the tunnel, the listening port on the MT is something not to get ones panties in a knot over.
Furthermore an IP address for the WG interface is not required.
As noted what was missing is the IP routes required.
(***Yes the IP route sob noted has its merits but I will tackle that at the bottom.)

Lets take a look at the Wireguard Server PI Interface Settings
Address=10.6.0.5/24 I have no idea of the purpose of this on the PI Setup.
Im assuming its the address of the pi server itself?

WIreguard PI Peer Settings
Endpoint port 6969 which means the you are able to port forward port 6969 on the ISP device to your PI device.
Allowed IPs: 0.0.0.0/0 ???

What is the purpose of this setting from your point of view ???
I am assuming that you are not going out to the remote sites for internet so I dont think this is an outgoing address select and match process to enter the tunnel.
Which then means then that the secondary function of allowed IP is being met. It addresses all traffic inbound, in other words like a filter, if its on the list the inbound traffic is allowed to exit the tunnel at the PI site.

In this case its not wrong but its technically horrible and not a good security practice. IP addresses should be specific here!!!
If you want subnet users from your MT device to be able to exit the tunnel at the PI site, it should look like,
allowed IPs = 192.168.88.0/24, ANDROID IP, IPHONE IP, LAPTOP IP ( so all the device you have out there connecting to the PI should be identified).

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Now lets go to the MT Device.
What is strange is that you setup the tunnel but without the user part, and perhaps why not working.
The practical functionality you wish to have is to allow the users on the subnet to go out the PI router for internet.

Hence in your MT Wireguard Peer Settings.
allowed address = 0.0.0.0/0 makes sense as you want all internet addresses as potential destination addresses for the user subnet so the router will match outgoing requests to the peer address list and match and such traffic will then enter the tunnel outbound.

You need an IP route to match…
dst-address=0.0.0.0/0 gwy=Wireguard table=usePI

You need to create the table
/ip routing table add table name=usePI fib

YOu need to create a Route Rule associated
source-address = 192.168.88.0/24
Action = Lookup-only-in-table
Table= usePI

Thus all traffic for this subnet headed to the internet, will go enter the tunnel vice go out the local ISP.
Note that your router can contain another subnet 192.168.10.0/24 and it will use the normal default routes to go out internet locally and NOT through the tunnel.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

***** Now the route Sob was referring to was that without a use case, user traffic, there was no tunnel traffic setup done in routing.
So to be able to ping IPs at the other end one needed a route.
dst=IP at other end of tunnel gwy=Wireguard table=main.

Note that nothing funky with tables needs to be done, because a specific request for an IP address takes precedence over a wide ranging IP route.
Tyipically the default route is
dst=0.0.0.0/0 gwy=ISP gateway table=main

Now if we want to reach an IP on the other side of the tunnel lets say there is a server at 192.168.50.5/32, the all we need to do is the following
dst=192.168.50.5/32 gwy=Wireguard table=main.

and because 192.168.50.5 is more specific than 0.0.0.0/0 (or has higher value) then the router will select the Wireguard gateway for traffic.
Now we had to create the funky route because we would have two routes identical.

dst=0.0.0.0/0 gwy=ISP
dst=0.0.0.0/0 gwy=Wireguard

There is no clear choice for the router!! So we ensure that we FORCE the subnet traffic out the Wireguard interface.

Also you should note that if your desire is to reach 192.168.50.5, then that address should also be in your allowed IPs for the MT Remote PEER settings.
In this case you already have 0.0.0.0./0 which includes it, so in this case it would not be required. In the case where one is not using internet at the other side and only wants to connect to the server then you would need the single address included.

7

Hi anav,
thanks for your reply. Maybe you can clarify something for me.

I am interested in the use case described in the quote.
I have now two routes:

dst-address=0.0.0.0/0  gwy=Wireguard  table=usePi
dst-address=0.0.0.0/0  gwy=ISP

How does the MK know which gateway to use by default when I do not set any rule?

8

Router by default uses routing table “main”.

9

Perfect, thanks!

10

I my ip/route I use my Wireguard Interface as a gateway.
But my Wireguard Interface does not know anything about the Endpoint IP and Endpoint Port? This information is only in the Peer config of my MT Router. So does the Interface use the information from the Peer? What happens if I have multiple Peers with different Endpoints?

BTW: Thanks for your help! I dont take this for granted

11

Routing sends the traffic to correct wireguard interface, in case you have multiple.
Allowed addresses in peer determine what is allowed where.
That’s how it should work.

12

You enter peer’s enpoint address and port when it accepts incoming connections, otherwise it should be empty. So for site to site tunnel, where both routers have public addresses, you’ll enter it on both ends. For road warriors, where only server has public address and client is dynamic, peer’s (server’s) endpoint will be configured on client, but peer’s (client’s) endpoint won’t be configured on server, because it’s not known.

WG is different from other VPNs. The endpoints you enter are only to get it going, but they can change dynamically. If either side changes source address or port, then the other, when it receives packet from there, immediatelly changes peer’s endpoint to this new address and port. It doesn’t change the values you enter, but you can see it in:

/interface/wireguard/peers/print detail

as current-endpoint-address and current-endpoint-port.

13

As explained without the route rule, the gwy-wg route would never be used as all traffic would get shunted out table=main
The more interesting question I have for Sob, is what if we add distance.

dst-address=0.0.0.0/0 gwy=Wireguard table=usePi distance=5
dst-address=0.0.0.0/0 gwy=ISP distance=20

If one was not to make the accompanying route rule as was asked, what would happen this time ???

14

You really should start your own thread for these good questions but okay.
Lets consider the initial connection first. One needs an originating location (client) and the receiving location (server). This is to establish the tunnel.
After that, either side can originate traffic and the discussion becomes, which side is the source of traffic and which side is the receiving source of traffic.

On the client device, FOR A WIREGUARD INTERFACE 1 - Its the peer settings where one puts in the endpoint IP and associated port.
NOTE: ALL THE PEERS under this WG-1 will have the same entpoint address: port. Their public keys they have to give to the Server Device is the difference!!

If you want to create a new tunnel, WG-2, then the endpoint IP and port will differ from WG-1 and will apply to all the peers under this interface WG-2)

On the server device, under wireguard settings, one puts in the listening port.

15

@anav: There are priorities. First routing table, you select one and no longer care about anything in others. Then you select most specific route (e.g. 192.168.1.0/24 wins over 192.168.0.0/16) and no longer care about others. Only if at this point you have more than one route (it means that all have same dst-address), you look at distance and select lowest. And if you still end up with more than one, you’ll have ECMP.

16

To sort the wheat from the chaff, or more precisely, to cut to the chase, or more clearly GET TO THE POINT.
in the above example distance has no effect because table main has precedence over table WG for all regular traffic.
The reason for the route RULE is to overcome this fact and state that the source address traffic is being forced out the table WG.

To expand
dst-address=0.0.0.0/0 gwy=ISP table=main
dst-address=0.0.0.0/0 gwy=WG table=useWG
Without a route rule for WG, all traffic will still go out table main

dst-address=0.0.0.0/0 gwy=ISP table=main distance=10
dst-address=0.0.0.0/0 gwy=WG table=useWG distance=5
Without a route rule for WG, all traffic will still go out table main

dst-address=0.0.0.0/0 gwy=ISP table=main distance=10
dst-address=0.0.0.0/0 gwy=WG table=useWG distance=5
dst-address=192.168.50.0/24 gwy=WG table=useWG distance=1
Without a route rule for WG, all traffic will still go out table main

17

Hi,

I just did all the steps explained by anav for accessing the Internet at the end of the tunnel (RaspberryPi with Wireguard Server).
Is there anyway I can debug something like this.

When I use traceroute at one of my local devices, I see that it only reaches my MK Router (IP of the Router not the Wireguard Peer). Is something blocking?

My current config:

ip/route
 0  As   dst-address=0.0.0.0/0 routing-table=via-Wireguard pref-src="" gateway=Wireguard immediate-gw=Wireguard distance=1 scope=30 target-scope=10 suppress-hw-offload=no
 
routing/rule
0   src-address=192.168.88.110 dst-address="" action=lookup-only-in-table table=via-Wireguard 

routing/tables
 1     name="via-Wireguard" fib

As you can see, I just want to route the traffic of the device with the 192.168.88.110 address.

Thanks guys!

18

Would need to see MT wireguard peer settings too!!

19

Sure thing, thanks.

interface/wireguard/
 0  R name="Wireguard" mtu=1420 listen-port=6969 private-key="..." public-key="...."

interface/wireguard/peers
interface=Wireguard public-key="...." endpoint-address=**DNSNAME** endpoint-port=6969 current-endpoint-address=**IP**
     current-endpoint-port=6969 allowed-address=0.0.0.0/0 preshared-key="..." persistent-keepalive=1m rx=66.7KiB tx=1487.6KiB last-handshake=51s

Thanks.

20

So it appears the MT is configured properly and is making a handshake.??

The problem seems to lie with the traffic at the PI, and ISP router end!!