I am a little at loss here. I managed to get my new Mikrotik router to connect to a wireguard server on the internet (interface=wireguard1) and now I want to route all traffice from VLAN 99 (which is 192.168.99.0/24) exclusively through this tunnel. While this works (somehow), I am getting really poor network speeds (with both the router and the wireguard server with little CPU load) and some websites on the internet will not open when accessing them from within the 192.168.99.0/24 network. Potentially, this is a misconfiguration and/or routing problem, since that is very new to me.
Also, when I create DHCP server for the 192.168.99.0/24 network, all computers connected to it (wifi1, wifi2, eth4) do not get IP addresses asigned, however, manual IP configuration works.
I have attached my current configuration - if someone can point out my mistake(s) I would greatly appreciate it!
I would hope you are not actually connected to the internet with such UNSAFE settings.
You have opened port 80 and your winbox port to the world which is a security NO NO.
Pull the plug and change your config before proceeding.
Assuming you mean to a third party provider of VPN services.
Would have to see what the third party provider gave you for setup ( minus of course the actual external IP of their site, and actual keys, use fake numbers etc.. ) including any DNS.
Also you are half using vlans. Should not mix apples and oranges so once you go vlans go all vlans and bridge does no dhcp etc…
Mostly changes:
missing pool for vlan99 and other things.
-REMOVE this static dns setting old default that needs to go… /ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
-missing persistent keep alive on allowed Ip settings.
-firewall rules make no sense and WHY are you allowing the whole WWW access to your router by making winbox port open???
by including wireguard in WAN interface list we dont need an extra Sourcenat rule, just the default rule.
note1: Assuming you have default route enabled on IP DHCP CLIENT settings and if not will require to enter one manually.
note2: If you never want vlan99 users to use local WAN, in case the wireguard tunnel is not working then change action to: action=lookup-only-in-table
/tool mac-server
set allowed-interface-list=NONE
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Final piece of the puzzle, ( perhaps more when we learn the third party advised settings ) is something that may help browsing consistency… /ip firewall mangle
add action=change-mss chain=forward comment=“Clamp MSS to PMTU for Outgoing packets” new-mss=clamp-to-pmtu out-interface=wireguard1 passthrough=yes protocol=tcp tcp-flags=syn
I have integrated your suggestions into the configuration, however, when I try to add the second DHCP server, it fails with a note, that there is already a dhcp server active for this interface.
Something I should have mentioned: the router is currently a dhcp client on my other internal network, so the ports are open for me to get in once I shoot myself in the foot, but these rules will be removed once the router is connected to the internet (which will also be as a dhcp client on metroethernet).
Unfortunately, I am still having trouble with perfromance (100 Mbit on a 1Gbit line when doing fast.com) and some pages (e.g. ookla speedtest) always give back a err_conn_reset.