I have been trying to configure my RPI4 Wireguard VPN server and Mikrotik router for a few days.
Now I look and feel like the Grinch! Can Anyone please help, SantaTik? Are you out there?
Design
WIREGAURD CLIENT ----- INTERNET ----- MICROTIK RB4011iGS+RM ----- RPI4 WIREGUARD SERVER
IP 192.168.10.10------ WAN IP ------- 192.168.1.1/24 LAN ----- 192.168.1.120, VPN 192.168.10.1 LAN
[mcon@mcon-XPS-15-9550 ~]$ wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 192.168.10.10/24 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a tun.wg0 -m 0 -x
[#] ip -4 route add 192.168.1.0/24 dev wg0
[mcon@mcon-XPS-15-9550 ~]$ ip addr show wg0
4: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
link/none
inet 192.168.10.10/24 scope global wg0
valid_lft forever preferred_lft forever
[mcon@mcon-XPS-15-9550 ~]$ ifconfig wg0
wg0: flags=209<UP,POINTOPOINT,RUNNING,NOARP> mtu 1420
inet 192.168.10.10 netmask 255.255.255.0 destination 192.168.10.10
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 1000 (UNSPEC)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 52 bytes 7696 (7.6 KB)
TX errors 11 dropped 0 overruns 0 carrier 0 collisions 0
My Current MikroTik Setup
My Wireguard Client Connections works but I don’t know how to allow traffic from the RPI4 VPN (192.168.1.120) client connections to the LAN(192.168.1.1/24)
According to screenshot, you have address 192.168.10.1/24 on router, and it may not be what you want. Or what is your exact plan with subnets? Should 192.168.10.0/24 be only for VPN clients, or should some devices in LAN also have addresses from this subnet?
@anav: I can tell you don’t know my native language, otherwise you couldn’t guess that wrong.
(although it’s just coincidence, the nickname is not based on the animal)
This one should be easy, I’ll just blame it on user error. Not only is 192.168.10.1/24 on router, it’s on WAN interface on top of that. So if VPN clients connected to RPi server get addresses from same subnet, some part of this config is not right.
I could change the VPN router clients IP to 192.168.1.1/24 but Im afraid that there will be a conflict with the current Mikrotik DHCP Leases on 192.168.1.1/24
Q. What is you exact plan with the subnets?
A. My main goal is to have ONLY myself and my wife connect to the VPN and access the Internet and LAN machines
Q. Should 192.168.10.0/24 be only for VPN clients, or should some devices in LAN also have addresses from this subnet?
A. Only VPN Clients can 192.168.10.0/24. All regular LAN clients have the 192.168.1.0/24 subnet
Fifth line in your screenshot is dynamic route to 192.168.10.0/24 on ether1, which based on default route (I’m not sure why you have two, but it doesn’t matter now) is your WAN port, i.e. connected to internet. The route has preferred source 192.168.10.1, which means that for some reason you added 192.168.10.1/24 as address on ether1. Unless there’s a reason to have it there, which I don’t know about, it looks like mistake and it shouldn’t be there or anywhere else on this router. In any case, it conflicts with same subnet for VPN clients on RPi.
Ensure port forwarding is set in /etc/sysctl.conf on VPN Server
net.ipv4.ip_forward=1
LAPTOP or TABLET VPN CLIENT
[Interface]
Address = 192.168.10.2
PrivateKey = xxx
ListenPort = 993
[Peer]
PublicKey = xxx
Endpoint = pimedia.ca:993
AllowedIPs = 192.168.10.0/24, 192.168.1.0/24
# This is for if you're behind a NAT and
# want the connection to be kept alive.
PersistentKeepalive = 25
Merry Christmas Sob! Without your help I would been running in circles till the New Year
