I have reset my router to defaults (192.168.88.1/24 LAN) and added wireguard interface wg (10.10.0.3/24). Why ping from my LAN doesn’t get routed to 10.10.0.1 (my wg peer)? Ping to 10.10.0.3 (local wg ip) works fine. I’ve read https://help.mikrotik.com/docs/display/ROS/IP+Routing and it says I just need routes, and I have one such route for wg: DAc 10.10.0.0/24 wg 0, but the pings for 10.10.0.0/24 don’t get routed through the wg interface.
I am deeply confused on what info is relevant to the question, so tell me and I’ll post it. My MT model is:
# nov/12/2023 21:13:29 by RouterOS 7.2.3
# software id = JNSB-K4XH
# model = 951G-2HnD
It’s the default home router/AP setup, there’s ISP gateway and LAN devices. I only added wg interface:
MT - ether1 is WAN, ISP-DHCP-server-assigned-IP <---NAT masquarade---> ISP gateway
- bridge (ether2-5, wlan1) 192.168.88.1/24 <---> local devices, PCs, phones
- wg 10.10.0.3/24 <---> connected to some peer in the internet, peer vpn IP is 10.10.0.1
Yes but being vague like you are is not helpful.
Is the wireguard at the other send a SERVER of some sort, most likely with an IP of .1
What are the allowed IPs at the other, firewall rules etc…
Is it a MT in VPS like CHR>
Is it an MT at someones home
Is it a third party VPN provider and if so, did they give you a DNS as well?
etc…
Observations on Config:
(1) The allowed IPs, tells me that this is most likely a client device and the peer is a WG server.
What is missing, is that you need to set a keep alive lets say 35s.
(2) If your not using IPV6 nor plan to in the near term, Disable IPV6
and change firewall rules to two rules add chain=input action=drop
add chain=forward action=drop
(3) tool mac-server is not a secure access method so change to NONE
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
The other option to do this is via the interface list and accomplishes the same thing.
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN add interface=wg list=WAN
(5) That tidies up most of the config but now we need to know the requirements of traffic flow of users/devices.
Currently I dont see any routes, so assuming you have a default route selected in our IP DHCP Client.
Now you should have a route based on the IP address for the wg subnet. dst-address=10.10.0.0/24 gateway=wg routing-table=main
This route should allow pinging of server, after you have added the sourcenat rule above. I bet the issue was that the other ends allowed IPs didnt recognize a 192.168.88.X address!!!
The sourcenat will change all your local IP addresses to 10.10.0.3 which the other end will accept.