Thanks msmatter, thats more of the inkling I had of what it means!
But dont understand how you are
a. detecting VPN is not working
b. removing the routing in place?? (stopping the flow)
For example with the routing rule above, for internet traffic, if the WG tunnel is down, then the traffic will simply get dropped. Whats the concern?
I see the need for failover, but I see none for kill switch. What scenario do you see that unencrypted traffic might leak out??
a) RouterOS does that by removing the Dynamic route. No manually work needed to be done.
b) yes the door slammed is close and while looking for an other exit the traffic fall into the blackhole. From where it never returns.
I can’t have traffic running around going for the Golden Gateway in the router and it is then better to put it out of its misery before things go wrong.
Okay so you have something like this which assumes the Route is Dynamically created ???
dst-address=0.0.0.0/0 gwy=WANIP table=main
dst-address=0.0.0.0/0 gwy=wg-Interface-name table=useWG distance=default
dst-address=0.0.0.0/0 add blackhole gwy=wg-Interface-name table=useWG distance=250
/routing table add name=useWG fib
/routing rule add src-address=subnet-of-choice action=lookup-in-table-only table=useWG
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
One question I have is how would you create the same blackhole effect if the primary WG route was manually put in and not created dynamically.
In other words that route would continue to exist???
Second question what is the use of preferred source mean to you??
Hello y update my config
remove :
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: allow wireguard”
out-interface=wg0
remplace to :
/interface list member
add interface=wg0 list=WAN
Both of those rules makes no sense to me. What are you trying to achieve??
(1) Are you attempting to allow subnet users from a remote device go out your local WANIP for internet?
If so, the correct way to do this, is by forward chain rules.
examples
a. add chain=forward action=accept in-interface=WG-name out-interface-list=WAN { basic }
b. add chain=forward action=accept in-interface=WG-name src-address=IPHONE-IP out-interface-list=WAN { multiple peers and only one of the peers the iphone) is getting internet }
c. There is already an existing rule
add chain=forward action=accept in-interface-list=LAN out-interface-list=WAN
So add the wireguard interface as a LAN list member
add interface=WG-name list=LAN
Many many options but none of them involve the local WANIP directly.
In fact, the Wireguard interface is an interface that is roughly at the LAN level in terms of location/hierarchy. It is not intended to be part of the WAN interface and it would have to be a special case to make it so.
(2) Maybe you have an ISP router in front of the MT device and it is not aware of the WG tunnel and a static route on the ISP router is not possible.
In this case one creates a SOURCE NAT Rule so the traffic exiting the local tunnel heading for the internet is NATTED with the MT routers IP address, prior to reaching the ISP router.
(3) The missing link… you fill in what he purpose is ???
The contains the NordLynx which means that your have use NAT or make your internal network in the 10.5.0.3/24 range and up.
NordLynx is the WireGuard implementation by NordVPN who is a VPN provider.
WHy? Can third party VPN servers not handle incoming traffic?
For example how would they handle
user a coming in for internet traffic and user b and user c. Wouldnt the Nord server just return traffic through the tunnel… What assumptions need to be made?
The only thing one should need to do on the MT device is put traffic into the tunnel… (Force ip route for internet traffic so it doesnt go out local WANIP)
a) incoming traffic is new traffic
b) is returning traffic traffic initiated from your side
My money is on b. However, you can rent a external IP with NordVPN so you can also accept a.
https://support.nordvpn.com/General-info/Features/1061840622/Dedicated-IP-addresses.htm
To be sure that traffic does not go out the wrong exit I use that killswitch. I am not intrested that that traffic is going any where and so the hunting season is opened as soon the VPN goes down.
As far as firewall is concerned, WG interface is like any other type, and it’s definitely independent interface. VPN provider probably won’t be trying to connect to anything in your network, but in theory they could.
Hello this joint final cfg (no killswitch) base tutorial (by erkexzcx) NordVPN (IPSEC/IKEv2) (For ROS6)
/ip firewall address-list add address=192.168.88.1 list=allow_vpn
/interface wireguard add listen-port=38914 mtu=1420 name=wg0 private-key="private_key"
/interface list add name=WG
/routing table add disabled=no fib name=useWG0
/interface list member add interface=wg0 list=WG
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=ca944.nordvpn.com \
endpoint-port=51820 interface=wg0 persistent-keepalive=25s public-key=\
"x64VhRToeBFhVlaJGA+R1CE1K3MsT7KVELquTyeQ3j0="
/ip address
add address=10.5.0.2/24 interface=wg0 network=10.5.0.0
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=wg0 pref-src=0.0.0.0 \
routing-table=useWG0 scope=30 suppress-hw-offload=no target-scope=10
/ip firewall filter
add action=accept chain=forward comment="defconf: accept in wireguard" \
connection-mark=useWG0 in-interface-list=WG out-interface-list=LAN \
place-before=[find where action=fasttrack-connection]
add action=accept chain=forward comment="defconf: accept out wireguard" \
connection-mark=useWG0 in-interface-list=LAN out-interface-list=WG \
place-before=[find where action=fasttrack-connection]
/ip firewall mangle
add action=mark-connection chain=prerouting comment=\
"defconf: wg0 mark (connection & routing) and mss change " \
new-connection-mark=useWG0 passthrough=yes src-address-list=allow_vpn
add action=mark-routing chain=prerouting connection-mark=useWG0 \
new-routing-mark=useWG0 passthrough=no src-address-list=allow_vpn
add action=change-mss chain=forward new-mss=clamp-to-pmtu out-interface-list=\
WG passthrough=yes protocol=tcp src-address-list=allow_vpn tcp-flags=syn
/ip firewall nat
add action=src-nat chain=srcnat comment="defconf: lan -> wg0 10.5.0.2" \
connection-mark=useWG0 out-interface-list=WG src-address=192.168.88.0/24 \
to-addresses=10.5.0.2 place-before=0
if use ip firewall raw defconf: drop the rest to mikrotik wiki:
/ip firewall raw
add action=accept chain=prerouting comment=\
"defconf: accept everything else from WG" in-interface-list=WG \
place-before=[find where comment="defconf: drop the rest"]
Why are you using mangled traffic in forward chain firewall rules and source nat rules??? Not necessary as one can use firewall address lists in firewall rules???
sorry anav I do not yet master very well the mikrotik if you have constructive suggestions I am interested
Sorry my question was bad, its been modified… further to the modified question what are you attempting to accomplish via the source nat??
so apparently I mistake it badly if you had an explanatory tutorial on the different steps I will thank you for it
Reaching public addresses. I am also interested how that goes without a NAT.
Hi Goodsat I just want to confirm that you are using a mikrotik device, that is behind an ISP router that you do not have control over.
Second that you are using a third party VPN for internet but only for a few devices, that should be directed out the third party wireguard tunnel for internet access.
Is this accurate or what am I missing??
Hello 404Network my RB4011 is connected as a nat router in sfp+10 gb on an operator box which is in bridge and yes I use a third party VPN for the Internet, but only for a few devices, which must be directed to the protection tunnel third-party wired for Internet access.
Yes unfortunately english language is getting in the way of understanding.
It seems you have your own router the RB4100 which is connected to something?? by way of cable attached to the sfp port of the RB4100.
What is an operators box??
What do you mean it is on a bridge??
anav:
What is an operators box??
What do you mean it is on a bridge??
these are very strange questions (“tabarnak” 
)
operators box = equipment from an internet provider (for me FIBER ONT FTTH EPON)
and bridge https://en.wikipedia.org/wiki/Network_bridge
So what device is after the ONT? or the ONT actually an Modem Router?
This bridge is on what device?