First of all. Thank you so much for the time you have taken to respond. I really appreciate the full rundown of my config file, and I fully intend to slowly implement the changes that you have suggested. I did get the WireGuard interface working right before your very helpful post, so I’ll put the changes I made (some of which I will slowly remove while checking for issues) before I answer questions regarding the config.
Note, the following code just includes the sections where I made changes for the sake of brevity.
/ip dhcp-server network
add address=192.168.32.3/32 comment="wg-LH " dns-server=208.67.220.220 \
gateway=192.168.32.3
add address=192.168.50.0/24 comment=VLAN-Work dns-server=\
208.67.220.220,192.168.88.1 gateway=192.168.50.1
...
/ip firewall mangle
add action=mark-routing chain=prerouting in-interface=VLAN_Work \
new-routing-mark=WG_LH_RT passthrough=no
add action=change-mss chain=postrouting new-mss=1380 out-interface=\
wg-LH-Mikro passthrough=no protocol=tcp tcp-flags=syn
...
/ip route
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
9.9.9.9 routing-table=main scope=30 suppress-hw-offload=no target-scope=\
11 vrf-interface=ether1
add disabled=no distance=1 dst-address=9.9.9.9/32 gateway=10.0.0.1 \
routing-table=main scope=10 suppress-hw-offload=no target-scope=10
add disabled=no distance=2 dst-address=1.1.1.1/32 gateway=10.0.0.1 \
routing-table=main scope=10 suppress-hw-offload=no target-scope=10
add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=\
1.1.1.1 routing-table=main scope=30 suppress-hw-offload=no target-scope=\
11 vrf-interface=ether1
add disabled=yes distance=1 dst-address=0.0.0.0/0 gateway=*1E routing-table=\
WG_MIA_RT scope=30 suppress-hw-offload=no target-scope=10
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=wg-LH-Mikro \
routing-table=WG_LH_RT scope=30 suppress-hw-offload=no target-scope=10
add disabled=no dst-address=192.168.50.0/24 gateway=wg-LH-Mikro \
routing-table=WG_LH_RT suppress-hw-offload=no
...
/routing rule
add action=lookup-only-in-table disabled=yes dst-address="" src-address=\
192.168.50.0/24 table=WG_MIA_RT
add action=lookup-only-in-table disabled=no dst-address="" routing-mark=\
WG_LH_RT src-address=192.168.50.0/24 table=WG_LH_RT
add action=lookup-only-in-table disabled=no dst-address=0.0.0.0/0 interface=\
VLAN_Work routing-mark=WG_LH_RT src-address=192.168.50.0/24 table=\
WG_LH_RT
add action=lookup disabled=no dst-address="" src-address=192.168.177.2/32 \
table=WG_MIA_RT
add action=lookup-only-in-table disabled=no dst-address="" routing-mark=\
WG_LH_RT src-address=192.168.32.3/32 table=WG_LH_RT
add action=lookup-only-in-table disabled=no dst-address=192.168.50.0/24 \
interface=wg-LH-Mikro routing-mark=WG_LH_RT src-address=0.0.0.0/0 table=\
WG_LH_RT
Now to answer your questions, the best I can, which… just look at my user name.
-
In general use only one bridge.
I think it’s better if I address this in an answer to point 3. -
Why do you have two WAN interface lists??
When I was first attempting to get my lte backup going, I created this. Thanks for the reminder that it was just a vestigial piece of config. -
Why the use of macvlans…
I could not for the life of me get mdns working correctly. I finally ended up following a this guide, which I think also accounts for the extra bridge you mentioned in point 1: http://forum.mikrotik.com/t/mdns-between-vlans-with-just-bridge-filters-look-mum-no-containers/173295/1 -
To confirm the wireguard table to route traffic to the server router is WG_LH_RT ??
Correct.
\ -
Not familiar with bridge filters, bridge nat, nor macvlans so cannot comment on them
I still think part of the guide I used to get my tvs and printer talking across the vlans> -
None of your bridge ports are correct, when using vlans they should either be trunk ports ( only vlan tagged frame types), access ports ( priority and untagged frames) and they identify etherports or WIFI ports, NOT VLANS. Not sure about macvlans but I doubt they qualify as etherports or wlans either.
Sounds like I need to get back into the config to get it working correctly. Maybe once they are correctly configured, I can ditch the macvlans. -
If ether2,3,4 are trunk ports just put…
Will do. Thanks for the feedback. They are, in fact, all trunk ports. Really, only port 2 is in use. It feeds into a managed switch that feeds 3 APs that add vlan tags based on AP name. I wanted the others available just in case. -
AVOID This mistake, once using vlans the bridge should not be involved in any DHCP or any extra settings for vlan1. PLUS you already have tagged vlans on ether2 trunk port.
PLUS no such thing as untagging bridge.
I was kinda worried about losing access to the switch and APs. I’ll try this change in safe mode to see if I can get it set correctly. All the APs and the switch are on the 192.168.88.# IP addresses, which mirrors the bridge, so I’ll need to figure this out when my much better half is away. -
Bridge is no longer needed as a LAN interface list member, all vlans should be identified and probably macvlans as well.
See above. I will tackle this, but need to clear out the house first. -
On wireguard peer for other router youa re using dns 208.67.220.220 ( is that available on the other router) otherwise your router may try to use local router or local wan for dns.
That was the DNS listed in my wireguard config file. I think it is the DNS the provider has hardcoded in their router. -
ADDRESS IS WRONG for wireguard peer:
Interesting. I tried to follow the interface created for my laptop. I’ll change that to see if it provides a more reliable connection. -
This router is NOT hosting any wireguard and thus there should be NO input chain rules for handshakes… and no output chain rules are ever required.
Thanks I will remove those. I was just throwing crap at the wall to see what would stick. I find the mikrotik documents fly way over my head, and people who make guides really just gloss over important things. -
You have two forward chain rules for subnet .50 on router
a. to allow users on .50 subnet to reach wireguard tunnel
b. to allow remote users to reach subnet .50 via the wireguard tunnel.
c. are there any remote subnets coming to this router?..
I just wanted scenario a. -
Firewall rules are not really in logical order, and its wise to keep chains together for easy reading and to spot errors.
I really don’t know much about firewall rules. I will clean up the pieces that have seen absolutely no traffic. Are there any good guides out there for dummies like myself? -
If not using ipv6, then disable ipv6 and get rid of all associated firewall rules and address lists.
I think the failover lte connection may use ipv6, but I’m not sure. Those are definitely default. I’d be happy to remove them. -
MOdify routing rules to following, and order is important.
From:…
I’ll implement this. Thanks. -
In terms of ROUTES, they need much work as well.
->It would appear that you have two WANs?..
I think I was trying to be too tricky for my own good on this one. If I remember correctly, my intent was to check both 9.9.9.9 and 1.1.1.1 before failing over to lte. I wanted to make sure the internet was really down and not just the dns. I was trying to use recursive routing, yes.
*1E indicates you have a problem with this interface.
That’s a vestige from my attempt at getting Mullvad to work. I removed the Mullvad interface, but I forgot to remove the route that I added watching a guide.
Thanks again for all the feedback. It took me forever to answer you, so I imagine it took longer to look through my awful config file for clues. I’m truly very grateful.
So now for what feels like the punchline of a really bad joke… My intent was to setup this WireGuard connection to look like I was in Florida. For some reason, whatsmyip shows me in Colorado Springs after getting this working. I am in neither state, so I guess it’s back to Mullvad after fixing some of the more glaring issues that you’ve pointed out.