Hello Everyone,
I need assistance on the below issue.
==================================
I have created OSPF on wireguard but its flapping
when i do continuous ping for the P2P on wireguard am getting time outs, when i disable OSPF, pings are stable.
What could be the problem?
Below are my configs for the hub site.
admin@R2] > export
2026-06-14 11:28:52 by RouterOS 7.12.1
software id = BD3D-PICM
model = CCR1036-8G-2S+
serial number = D83B0CCA9097
/interface bridge
add admin-mac=48:8F:5A:F4:98:9D auto-mac=no comment=defconf name=bridgeLocal
add name=loopback0
/interface wireguard
add listen-port=13231 mtu=1380 name=wg0
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=192.168.88.2-192.168.88.254
/port
set 0 name=serial0
set 1 name=serial1
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing id
add disabled=no id=1.1.1.1 name=RID1 select-dynamic-id=""
add id=2.2.2.2 name=RID
/routing ospf instance
add disabled=no name=ospf-1 originate-default=never out-filter-select="" redistribute=connected router-id=2.2.2.2
/routing ospf area
add disabled=no instance=ospf-1 name=backbone
/interface bridge port
add bridge=bridgeLocal comment=defconf ingress-filtering=no interface=ether2
add bridge=bridgeLocal comment=defconf ingress-filtering=no interface=ether3
add bridge=bridgeLocal comment=defconf ingress-filtering=no interface=ether4
add bridge=bridgeLocal comment=defconf ingress-filtering=no interface=ether5
add bridge=bridgeLocal comment=defconf ingress-filtering=no interface=ether6
add bridge=bridgeLocal comment=defconf ingress-filtering=no interface=ether7
add bridge=bridgeLocal comment=defconf ingress-filtering=no interface=ether8
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set max-neighbor-entries=8192
/interface ovpn-server server
set auth=sha1,md5
/interface wireguard peers
add allowed-address=10.50.50.0/30,192.168.77.0/24,224.0.0.5/32,224.0.0.6/32 endpoint-port=13231 interface=wg0 persistent-keepalive=25s public-key="6DeH5Y0Cv3EdsydDKUbLrTz176B8FkWRe5p4Y/GTaz8="
/ip address
add address=192.168.88.1/24 interface=bridgeLocal network=192.168.88.0
add address=10.255.255.2 interface=loopback0 network=10.255.255.2
add address=172.25.142.174/30 interface=sfp-sfpplus1 network=172.25.142.172
add address=41.216.66.178/30 interface=sfp-sfpplus2 network=41.216.66.176
add address=10.50.50.1/30 interface=wg0 network=10.50.50.0
/ip dhcp-server
add address-pool=*2 interface=bridgeLocal name=dhcp1
/ip dhcp-server network
add address=192.168.88.0/24 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8
/ip firewall filter
add action=accept chain=forward comment="Allow OSPF" protocol=ospf
add action=accept chain=input dst-port=51820 protocol=udp
add action=accept chain=input in-interface=wg0
add action=accept chain=input dst-port=13231 protocol=udp
add action=accept chain=input in-interface=wg0
add action=accept chain=input dst-port=51820 protocol=udp
add action=accept chain=input in-interface=wg0 protocol=icmp
add action=accept chain=forward connection-state=established,related
add action=accept chain=forward out-interface=sfp-sfpplus2 src-address=192.168.88.0/24
add action=drop chain=forward connection-state=invalid
add action=drop chain=forward
add action=accept chain=input comment="Allow WireGuard" in-interface=wg0
/ip firewall nat
add action=masquerade chain=srcnat out-interface=sfp-sfpplus2
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=41.216.66.177 pref-src="" routing-table=main scope=30 suppress-hw-offload=no target-scope=10
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/lcd
set time-interval=hour
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/routing filter rule
add chain=ospf-out rule="if (dst == 0.0.0.0/0) { reject }"
add chain=ospf-out rule=accept
/routing ospf interface-template
add area=backbone disabled=no interfaces=sfp-sfpplus1 type=ptp
add area=backbone disabled=no interfaces=bridgeLocal passive
add area=backbone cost=10 disabled=no interfaces=wg0 type=ptp
/routing rule
add action=lookup comment="Protect WG" src-address=10.50.50.0/30 table=main
add action=lookup comment="Protect WG endpoint" dst-address=41.216.66.178/32 table=main
add action=lookup-only-in-table interface=sfp-sfpplus2 table=*400
add action=lookup table=main
/system clock
set time-zone-name=Africa/Lusaka
/system identity
set name=R2
/system note
set show-at-login=no
/system package update
set channel=development
==================================