BTH provides easy VPN to your router, even if you are behind NAT. Main use - take the phone app and enable the new feature, then connect to your home network, while abroad or anywhere.
In the background it takes care of all the configuration in the router, makes a Wireguard setup, configures the firewall, communicates with our cloud.
Then use the same phone app to go “back to home” when you are away. Use internet through your home network, to have pihole block ads, or just to change your IP and watch content only available “back home”.
In case your router is behind NAT, somewhere inside a private network, the connection will be made though our relay servers.
Feature is in BETA (Gradual rollout to see what our relays are capable of, to slowly test load) and is currently available on ARM/ARM64/TILE.
(If used) Relay does not decrypt your tunnel and has no access to your data
It secures your router with firewall, it does not open up full access to your router in any way
It is not a feature for anonymity, it is a home user feature for maximum ease of use.
If you wish, after you have enabled it with our BTH app, you can also connect using Wireguard on your computer. You can use the QR code in Winbox IP CLOUD menu to get the needed config to your computer
Could you perhaps consider making a NAT helper for routerOS, that would make a router act as a relay like your BTH relay.
That can be applied to a small number of UDP ports.
Some maybe simplifications.
Server connects via one port clients connect via another port. (does this make it simpler?)
Only on devices with good amount of flash.
Silly question, but is it safe to just use the wireguard app with the QR code as I already installed that on the other-halves phone which seems to work ok but took ages to connect? Android by the way.
Of course you can just keep using Wireguard. This new feature is also using Wireguard, but it has one advantage, it can work even if your router has no public IP
If the router has no public ip (4G connection) all traffic goes through MikroTik servers, am I right?
If yes, are there any speed or traffic limits?
Or does it work as a ZeroTier relay?
Yes that’s true. Currently there are no limits. It might change in the future, but there is no plan for that at the moment.
If we run into traffic problems, we will just add more relays around the world.
Did quick test if iOS app. Seems to work, at least against two different router, using LTE/CGNAT on device with BTH iOS app.
Was able to connect to a BTH-enabled router with public IP. And was also able to connect using relay with a host behind a CGNAT address e.g. remote end also uses LTE, so BOTH ends behind a CGNAT – this later case isn’t possible with WG alone without the BTH relay (or using ZeroTier).
Although latency is pretty bad if relayed, things do route/connect. I see ping times in the 600-800ms range using BTH with relay from phone to router. This router also has ZeroTier, so if disconnect from BTH and use ZT as VPN instead, latency is about 150-250ms in same ping test. I’d imagine difference is ZT roots are closer than Latvia…not that ZeroTier is inherently faster, just way closer in proximity to California.
Can we get answer on the xMIPSx situation with BTH?
That really is where BTH be more useful. e.g. I used ZeroTier to enable BTH to test it – so really didn’t need BTH since I already had ZeroTier. On xMIPSx, there are no options for a VPN from a CGNAT to a CGNAT, without building your own VPN hub.
Nice feature specially for the ones that are stuck with CGNAT!!!. I like to see as a feature virtual stacking for CRS switches (CRS3xx and CRS5xx) for HA core Switches!
Is it possible to open source/release the server side of the BTH relay? I’d love the ability to roll my own relay - which would remove the traffic from going through Mikrotik’s server (would save Mikrotik cost as well)
While in Beta, we have a relay in the MikroTik data center in Latvia. Depending on demand, we will expand to other regions and will lauch relays in other countries. If somebody here works in a well connected data center with high speed connectivity, you are welcome to drop us an email
Why? Instead of a relay you could just run a Wireguard server with public IP address. The point of the relay is that Mikrotik is not able to decrypt your traffic - you do not need traffic for yourself, do you?
