Regarding: Routing issue with OPNsense and MikroTik using WireGuard tunnel

RouterOS General
1

Hi,
I basically have a simple routing case, but somehow it’s not working as I intended. Here’s the given diagram:

      opnsense                            mikrotik
      ┌───────────────────┐               ┌───────────────────┐    ┌──────────────┐
      │                   │               │                   │    │              │
      │                   │               │                   │    │  Device      │
      │                   │               │                   │    │  10.40.2.250 │
      │                   │  wireguard    │                   │    │              │
      │       172.20.0.1──┼───────────────┼─172.20.0.2        │    └─────┬────────┘
      │                   │               │                   │          │
      │                   │               │         10.40.2.1─┼──────────┘
      │                   │               │                   │        LAN
      └───────────────────┘               └───────────────────┘
        Route:
         10.40.2.0/24 via 172.20.0.2

I can easily ping between the OPNsense and the MikroTik using the WireGuard tunnel in both directions. However, when I try to reach the device behind the MikroTik from the OPNsense, it complains that it can’t reach the destination.

...

ping: sendto: Capabilities insufficient
92 bytes from 127.0.0.1: Destination Host Unreachable
Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
 4  5  00 0054 f60d   0 0000  40  01 cb64 172.20.0.1  10.40.2.250 

ping: sendto: Capabilities insufficient
92 bytes from 127.0.0.1: Destination Host Unreachable
Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
 4  5  00 0054 6f36   0 0000  40  01 523c 172.20.0.1  10.40.2.250 

ping: sendto: Capabilities insufficient
92 bytes from 127.0.0.1: Destination Host Unreachable
Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
 4  5  00 0054 1ca6   0 0000  40  01 a4cc 172.20.0.1  10.40.2.250 

...

I’m using a hEX PoE with RouterOS 7.10, and basically, the default setup is loaded without any real modifications. I strongly believe that I still need to inform the MikroTik somehow that it should route the traffic from the WireGuard tunnel to the LAN router (avoiding NAT). When I send the ping within the WireGuard tunnel between the interfaces, I can see the traffic perfectly on both sides. But when I send the traffic to the remote device, although I can see that OPNsense is sending the traffic through the WireGuard interface, I can’t see anything coming in on the MikroTik using “Packet Sniffer Packets”.

I would appreciate any assistance! Regards, Volker.

2

/export file=anynameyouwish (minus router serial number and any public WANIP information, keys etc. )

3

Thank you very much for your attention, as always the problem lies with me and not with the hardware/software :wink: After explaining the whole problem to a colleague (rubber duck), I quickly found the solution. I forgot to enter the remote network in the WireGuard configuration in OPNsense, so WireGuard was simply dropping the packets for the remote network :wink:

Thanks again!

4

You are not alone my friend, I often am explaining to a genius my config woes and when explaining the problem realize my errors. Nothing like a rubber ducky or a silent friend LOL.