Port Forwarding to Raspberry Pi Wireguard VPN

RouterOS Beginner Basics
1

I have been successfully using a Raspberry Pi as a VPN, configured with Wireguard. The Pi was connected (wired) to a LAN port on a Cisco/Linksys EA3500 Wifi router. This routers WAN was connected to the sole ethernet port of the ISP-provided Hitron cable modem. I had to set up the port forwarding on the Cisco/Linksys router for the Wireguard service. The system worked well, albeit a little slow. For reasons of speed, I chose to replace the Cisco/Linksys wifi router with a Mikrotik hEX RB750Gr3 router. I was unprepared for the flexibility and programming options the Mikrotik offered. For example, the port forwarding in the Cisco/Linksys wifi router was simple: select the IP address of the Pi and set the desired port to forward. The Mikrotik router apparently needs to be set up with Firewall NAT and Filter rules. As a complete noob, I have been searching through this forum and found a couple of topics that seem related:

  1. Help port forwarding with Raspberry Pi OpenVPN PiVPN - #5 by successfulnothing
  2. Pivpn wireguard portforwarding problem

The current Filter rules for my Mikrotik are:

[code]

/ip firewall filter

action=accept chain=input comment="defconf: accept ICMP" protocol=icmp

action=drop chain=input comment="defconf: drop all from WAN" in-interface=ether1

action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related

action=accept chain=forward comment="defconf: accept established,related" connection-state=established,related

action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid

action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface=ether1

[//code]

Current NAT rules are:

[code]

/ip firewall nat

action=dst-nat chain=dstnat dst-address= dst-port=51820 protocol=udp to-addresses= to-ports=51820

[//code]

I still cannot contact the VPN outside of the LAN (nor inside, either). Have I misconfigured something? Are there filter/NAT rules that need to be added, changed, or removed? I would certainly appreciate an experience eye. Thank you in advance!

2 
chain=dstnat action=dst-nat to-addresses=$RPI_IP to-ports=51820 protocol=udp in-interface-list=WAN dst-port=51820

eventually replace in-interface-list= with in-interface=

3

Have you considered running the wireguard on the hex instead?
oops my bad you didnt buy the ARM version, hex refresh for the same price.

4

I am running successful WireGard on my RB750Gr3, and also was running on my old RB750GL, before I swap.

These devices is MIPS. Maybe you think of the BTH thats only what I think is supported with ARM and up.

Here my guide how I set it up:

5

I have considered using Wireguard with the Mikrotik router. Since the Wireguard service had already been successfully deployed on the RPi my first choice was to continue using the Pi. I will look into how to configure the Mikrotik Wireguard service. Thanks.

6

Thank you. I will try this.

7

Ahh correct I was thinking about BTH, much thanks!

8

I don't know why it's only ARM and Tile, do you know or somebody else in this great forum ?
Is it because of that's running some P2P service, that can't be compiled to ARM and Tile ?
I think it's Wireguard as VPN service with a P2P wrapper.
I haven't seen any config of BTH, so don't know.

9

It obviously doesn't contain special sauce that can't be compiled on other platforms.

I think (suspect, infer, intuit, guess) that it has more to do with Mikrotik providing free relays, and therefore not making it available for older and non-router platforms. Arm/Tile pretty much achieves that.