NEW FEATURE: Back to Home VPN

[Amm0]

1. Do I need to keep the IPV6 addresses, even though I am strictly using IPV4, in other words does MT relay server require that for all devices??

IPv6 address are not required on the peers or router, although it will be generated in the sample/exported/shared config.

But on IPv6… keep in mind if you have IPv6 enabled/worked to internet, and say the WAN’s IPv4 is CGNAT (i.e. like starlink). IPv6 WAN may allow direct connection, while using a CGNAT IPv4 may need to use Mikrotik BTH proxy servers. Almost certainly a direct connection is going to be faster. And just just because the OUTER WG tunnel is using IPv6, the inner tunnel can still be only IPv4 (i.e. 192.168.216.0/24). That is to say, the WG tunnel will carry IPv4 network, over a IPv6 WAN. And on a lot of smartphones, this will happen automatically since LTE/5G carrier often have IPv6 deployed.

But whatever you do with the IP address in peer configs (i.e. remove the fc00:0:0:216::x addresses) will NOT affect the outer tunnel’s selection of IPv4 or IPv6 - as that is done by DNS when the A or AAAA is resolve from snXXX.vpn.mynetname.net & the WG client app is what controls whether IPv4 or IPv6 is used for the WG tunnel connection.

2. The dynamic firewall rules are flaky.
   […]

It be nice if the docs just wrote what is modified dynamically in configuration… Now I do NOT know the logic of when the dynamic config is “re-evaluated” - and potentially re-applied - so if you move around firewall rules IDK what happens…

3. Assuming the allow LAN rule, which I havent actually seen yet, only block rule…
   is basically non-existant as it relies on the default condition of forward chain which only blocks non dst-nattted traffic from WAN.
   Thus if one constructs vlans for example one must add a forward chain rule to ensure BTH traffic reaches a specific subnet??

I dont see any allow bth to interface-list=LAN rule thats for sure…

OIn most default configs there is a non-dynamic:

/ip/firewall/filter add action=drop chain=input comment=“defconf: drop all not coming from LAN” in-interface-list=!LAN

… so here should be two rules added dynamically by BTH:

/ip/firewall/filter/print

Flags: X - disabled, I - invalid; D - dynamic
0 D ;;; back-to-home-vpn
chain=forward action=drop
src-address-list=back-to-home-lan-restricted-peers
out-interface-list=LAN

1 D ;;; back-to-home-vpn
chain=input action=accept protocol=udp dst-port=25297

And so it’s first rule that will drop anyone in the /ip/firewall/address-list that want to reach any interface in the LAN /interface/list. And when you UN-check the “Allow LAN” box you’re actually modifying /ip/firewall/address-list, not the filter rules directly.