Hello!
I face a problem with wireguard set-up. I will try to give as many info as I can.
I have a hAp ac2 running RoS 7.15. It is connected to my ISP modem/router via ether1. The ISP modem is in PPPoE passthrough mode (bridge mode is locked). This subnet has the format 192.168.1x with 192.168.1.1 being the ISP modem/router and 192.168.1.2 being the MT. All other interfaces are off (LAN ports, WiFi etc) and the address 192.168.1.2 is on DMZ.
In the MT I have configured a pppoe-out profile on ether1 interface.
I have two local subnet: 192.168.5.x and 192.168.10.x
My firewall is pretty much the default one, with a few rules for traffic between the two subnets.
I also have a “clamp to pmtu” rule in mangle, as I had a few problems with pages not loading etc.
I now try to set up a wireguard tunnel just for accessing my LAN when I’m away. I’ve watched a few videos, read a guide or two and set it up. I configured wireguard to use 192.168.44.x subnet. I have added the firewall rule for wireguard port and I have moved it to the top. When I’m at my office, my PC can connect to wireguard and have full lan access. The same with my phone when it’s connected to my office wifi. So far so good.
The problem is when I try to connect while using mobile data. Sometimes it work sometimes not. I have tried to set my apn to IPv4 only. Worked for a few times – now it doesn’t.
When I try to connect to wireguard on mobile data I get a “Handshake did not complete” error.
I get the same error while using the PC but it works after sometime.
What should I do?
MT config:
# 2024-06-19 08:45:01 by RouterOS 7.15
# software id = WXAX-GL85
#
# model = RBD52G-5HacD2HnD
# serial number =
/interface bridge
add admin-mac=48:8F:5A:A8:26:AD auto-mac=no comment=defconf igmp-snooping=yes \
name=bridge port-cost-mode=short
add mtu=1500 name=iot_bridge port-cost-mode=short
/interface ethernet
set [ find default-name=ether1 ] name=ether1-wan
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1-wan name=pppoe-out1 \
use-peer-dns=yes user=
/interface wireguard
add listen-port=54321 mtu=1420 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk mode=dynamic-keys name=profile1 \
supplicant-identity=""
add authentication-types=wpa2-psk mode=dynamic-keys name=iot \
supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
disabled=no distance=indoors frequency=auto installation=indoor mode=\
ap-bridge security-profile=profile1 ssid=MikroTik wireless-protocol=\
802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
20/40/80mhz-XXXX disabled=no distance=indoors frequency=auto \
installation=indoor mode=ap-bridge security-profile=profile1 ssid=\
MikroTik wireless-protocol=802.11
add disabled=no keepalive-frames=disabled mac-address=4A:8F:5A:A8:26:B1 \
master-interface=wlan1 multicast-buffering=disabled name=iot \
security-profile=iot ssid=wireless_iot wds-cost-range=0 wds-default-cost=\
0 wps-mode=disabled
/ip pool
add name=dhcp_pool1 ranges=192.168.5.2-192.168.5.254
add name=dhcp_pool2 ranges=192.168.10.2-192.168.10.254
/ip dhcp-server
add address-pool=dhcp_pool1 interface=bridge name=dhcp1
add address-pool=dhcp_pool2 interface=iot_bridge name=dhcp2
/ip smb users
set [ find default=yes ] disabled=yes
/ppp profile
set *0 change-tcp-mss=no
/interface bridge port
add bridge=bridge comment=defconf interface=ether2 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=ether3 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=ether4 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=ether5 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=wlan1 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=wlan2 internal-path-cost=10 \
path-cost=10
add bridge=iot_bridge interface=iot internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes forward=no
/interface detect-internet
set detect-interface-list=all
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1-wan list=WAN
add interface=iot_bridge list=LAN
add interface=wireguard1 list=LAN
/interface ovpn-server server
set certificate=*2 default-profile=*1 enabled=yes require-client-certificate=\
yes
/interface wireguard peers
add allowed-address=192.168.44.3/32 interface=wireguard1 name=Office-PC \
public-key=" "
add allowed-address=192.168.44.2/32 interface=wireguard1 name=NORD3 \
public-key=" "
/ip address
add address=192.168.5.1/24 interface=bridge network=192.168.5.0
add address=192.168.10.1/24 interface=iot_bridge network=192.168.10.0
add address=192.168.44.1/24 interface=wireguard1 network=192.168.44.0
/ip cloud
set ddns-update-interval=10m update-time=no
/ip dhcp-client
add comment=defconf interface=ether1-wan
/ip dhcp-relay
add dhcp-server=192.168.5.1 interface=bridge name=relay1
/ip dhcp-server lease
a bunch of leases
/ip dhcp-server network
add address=192.168.5.0/24 dns-server=192.168.5.103,8.8.8.8 gateway=\
192.168.5.1
add address=192.168.10.0/24 gateway=192.168.10.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall address-list
add disabled=yes list=IoT_No_Internet
/ip firewall filter
add action=accept chain=input comment=Wireguard dst-port=54321 protocol=udp
add action=drop chain=input comment="Drop Unknown" src-address=192.168.5.7
add action=drop chain=forward comment="Drop Unknown" src-address=192.168.5.7
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=accept chain=forward dst-address=192.168.5.6 dst-port=5683 \
protocol=tcp src-address=192.168.10.227
add action=accept chain=forward dst-address=192.168.5.6 dst-port=2020 \
protocol=tcp src-address=192.168.10.241
add action=accept chain=forward dst-address=192.168.5.12 dst-port=1883,6053 \
protocol=tcp src-address=192.168.10.0/24
add action=drop chain=forward dst-address=192.168.5.0/24 log=yes log-prefix=\
iot_to_main src-address=192.168.10.0/24
add action=drop chain=forward comment="STOP IoT from Internet" \
src-address-list=IoT_No_Internet
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=change-mss chain=forward comment="Change MSS" new-mss=\
clamp-to-pmtu out-interface=pppoe-out1 passthrough=yes protocol=tcp \
tcp-flags=syn
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none
add action=dst-nat chain=dstnat dst-port=32400 protocol=tcp to-addresses=\
PLEX PORT Fwd
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api address=
set winbox address=
set api-ssl address=
/ip smb shares
set [ find default=yes ] directory=/flash/pub
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
33434-33534 protocol=udp
add action=accept chain=input comment=\
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=input comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
add action=accept chain=forward comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=forward comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
/ipv6 firewall mangle
add action=change-mss chain=forward comment="Change MSS" new-mss=\
clamp-to-pmtu out-interface=pppoe-out1 passthrough=yes protocol=tcp \
tcp-flags=syn
/routing igmp-proxy interface
add interface=bridge upstream=yes
/system clock
set time-zone-name=Europe/Athens
/system note
set show-at-login=no
/system ntp server
set use-local-clock=yes
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Client
