Routing VLAN through Wireguard

RouterOS General
21

uh.. it was too late yesterday - The ugly “no internet” and the /32 error shouldn’t happen :open_mouth: - thanks for finding it!

But the missing rules at (5) are already there:
/routing rule
add action=lookup-only-in-table comment=“allow local traffic when required”
min-prefix=0 table=main
add action=lookup-only-in-table disabled=no src-address=192.168.90.0/24
table=to-Fritz

I changed it like you said. But I don’t see any traffic over vlan30 - just a short spike at ether3 when broadcasting for an IP address.
So in the end, the client at ether3 doesn’t get a 192.168.90-IP

Here’s my config (I made a Diff with a Diff-Tool to make sure that I changed everything you said):

# 2024-07-09 10:35:20 by RouterOS 7.15.2
# software id = MRVG-J4JI
#
# model = C52iG-5HaxD2HaxD
# serial number = ***
/interface bridge
add admin-mac=48:A9:8A:DA:A7:5E auto-mac=no comment=defconf name=bridge
/interface wireguard
add listen-port=182** mtu=1420 name=wireguard1
/interface vlan
add interface=ether1 name=ether1.1 vlan-id=2
add interface=ether3 name=vlan30 vlan-id=30
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1.1 name=pppoe-out1 \
    use-peer-dns=yes user=4036121000
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi datapath
add bridge=bridge comment=defconf disabled=no name=capdp
/interface wifi
set [ find default-name=wifi1 ] channel.band=5ghz-ax .reselect-interval=\
    1h..1h20m .skip-dfs-channels=10min-cac .width=20/40/80mhz \
    configuration.country=Austria .mode=ap .ssid=P-Wave datapath=capdp \
    disabled=no security.authentication-types=wpa2-psk,wpa3-psk \
    .connect-priority=0 .ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel.band=2ghz-ax .reselect-interval=\
    1h..1h10m .skip-dfs-channels=10min-cac .width=20/40mhz \
    configuration.country=Austria .mode=ap .ssid=P-Wave datapath=capdp \
    disabled=no security.authentication-types=wpa2-psk,wpa3-psk \
    .connect-priority=0 .ft=yes .ft-over-ds=yes
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp_vlan30 ranges=192.168.90.2-192.168.90.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
add address-pool=dhcp_vlan30 interface=vlan30 name=dhcp_vlan30
/routing table
add disabled=no fib name=to-Fritz
/disk settings
set auto-media-interface=bridge
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
/interface wifi cap
set discovery-interfaces=bridge enabled=yes slaves-datapath=capdp
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=yf8bw8kpxtav0ktp.myfritz.net \
    endpoint-port=558** interface=wireguard1 name=peer1 persistent-keepalive=\
    25s preshared-key="***" \
    public-key="***"
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=192.168.90.1/24 interface=vlan30 network=192.168.90.0
add address=192.168.80.4/24 interface=wireguard1 network=192.168.80.0
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
add address=192.168.90.0/24 dns-server=192.168.80.1 gateway=192.168.90.1
/ip dns
set allow-remote-requests=yes
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=accept chain=forward comment="internet traffic" in-interface-list=\
    LAN out-interface-list=WAN
add action=accept chain=forward comment="allow V30 to tunnel" out-interface=\
    wireguard1 src-address=192.168.90.0/24
add action=accept chain=forward comment="port forwarding" \
    connection-nat-state=dstnat
add action=drop chain=forward comment="drop all else"
/ip firewall mangle
add action=change-mss chain=forward new-mss=1420 out-interface=pppoe-out1 \
    passthrough=yes protocol=tcp tcp-flags=syn
add action=change-mss chain=forward comment=\
    "Clamp MSS to PMTU for Outgoing packets" new-mss=clamp-to-pmtu \
    out-interface=wireguard1 passthrough=yes protocol=tcp tcp-flags=syn
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN src-address=192.168.88.0/24
add action=masquerade chain=srcnat out-interface-list=WAN
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=wireguard1 \
    routing-table=to-Fritz suppress-hw-offload=no
/ip service
set ftp disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/routing rule
add action=lookup-only-in-table comment="allow local traffic when required" \
    min-prefix=0 table=main
add action=lookup-only-in-table disabled=no src-address=192.168.90.0/24 \
    table=to-Fritz
/system clock
set time-zone-name=Europe/Vienna
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN
22

Well thats very basic which after some sleep, dont need the vlan and since devices cant read vlans its probably an error on my part to use it without a bridge.
So this should work, simply use ethernet3 directly! … And you really only have to make three changes to get there!!!

Remove vlan30 definition so only one vlan is defined in the config!
/interface vlan
add interface=ether1 name=ether1.1 vlan-id=2

/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
add address-pool=dhcp_vlan30 interface=ether3 name=dhcp_vlan30

/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=
192.168.88.0
add address=192.168.90.1/24 interface=ether3 network=192.168.90.0
add address=192.168.80.4/24 interface=wireguard1 network=192.168.80.0


One thing that was still wrong was sourcenat masquerade rule… you dont need two rules simply… keep one in green.
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade”
ipsec-policy=out,none out-interface-list=WAN src-address=192.168.88.0/24
add action=masquerade chain=srcnat out-interface-list=WAN
+++++++++++++++++++++++++++++++++++++++++++++++++++++

Only change going to make is assume fritz is like a third party VPN so we are going to sourcenat traffic going into tunnel
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
add interface=wireguard1 list=WAN

23

hmm.. the dhcp_ether3 (formerly dhcp_vlan30) dhcp-server says its invalid configured after mapping the interface from vlan30 to ether3

# 2024-07-09 11:54:22 by RouterOS 7.15.2
# software id = MRVG-J4JI
#
# model = C52iG-5HaxD2HaxD
# serial number = ***
/interface bridge
add admin-mac=48:A9:8A:DA:A7:5E auto-mac=no comment=defconf name=bridge
/interface wireguard
add listen-port=182XX mtu=1420 name=wireguard1
/interface vlan
add interface=ether1 name=ether1.1 vlan-id=2
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1.1 name=pppoe-out1 \
    use-peer-dns=yes user=4036121000
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi datapath
add bridge=bridge comment=defconf disabled=no name=capdp
/interface wifi
set [ find default-name=wifi1 ] channel.band=5ghz-ax .reselect-interval=\
    1h..1h20m .skip-dfs-channels=10min-cac .width=20/40/80mhz \
    configuration.country=Austria .mode=ap .ssid=P-Wave datapath=capdp \
    disabled=no security.authentication-types=wpa2-psk,wpa3-psk \
    .connect-priority=0 .ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel.band=2ghz-ax .reselect-interval=\
    1h..1h10m .skip-dfs-channels=10min-cac .width=20/40mhz \
    configuration.country=Austria .mode=ap .ssid=P-Wave datapath=capdp \
    disabled=no security.authentication-types=wpa2-psk,wpa3-psk \
    .connect-priority=0 .ft=yes .ft-over-ds=yes
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp_ether3 ranges=192.168.90.2-192.168.90.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
add address-pool=dhcp_ether3 interface=ether3 name=dhcp_ether3
/routing table
add disabled=no fib name=to-Fritz
/disk settings
set auto-media-interface=bridge
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
add interface=wireguard1 list=WAN
/interface wifi cap
set discovery-interfaces=bridge enabled=yes slaves-datapath=capdp
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=***.myfritz.net \
    endpoint-port=558XX interface=wireguard1 name=peer1 persistent-keepalive=\
    25s preshared-key="***" \
    public-key="***"
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=192.168.90.1/24 interface=ether3 network=192.168.90.0
add address=192.168.80.4/24 interface=wireguard1 network=192.168.80.0
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
add address=192.168.90.0/24 dns-server=192.168.80.1 gateway=192.168.90.1
/ip dns
set allow-remote-requests=yes
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=accept chain=forward comment="internet traffic" in-interface-list=\
    LAN out-interface-list=WAN
add action=accept chain=forward comment="allow V30 to tunnel" out-interface=\
    wireguard1 src-address=192.168.90.0/24
add action=accept chain=forward comment="port forwarding" \
    connection-nat-state=dstnat
add action=drop chain=forward comment="drop all else"
/ip firewall mangle
add action=change-mss chain=forward new-mss=1420 out-interface=pppoe-out1 \
    passthrough=yes protocol=tcp tcp-flags=syn
add action=change-mss chain=forward comment=\
    "Clamp MSS to PMTU for Outgoing packets" new-mss=clamp-to-pmtu \
    out-interface=wireguard1 passthrough=yes protocol=tcp tcp-flags=syn
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=wireguard1 \
    routing-table=to-Fritz suppress-hw-offload=no
/ip service
set ftp disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/routing rule
add action=lookup-only-in-table comment="allow local traffic when required" \
    min-prefix=0 table=main
add action=lookup-only-in-table disabled=no src-address=192.168.90.0/24 \
    table=to-Fritz
/system clock
set time-zone-name=Europe/Vienna
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN
24

ah my bad .. when starting the ehter3 device, it becomes valid :open_mouth: .. just a moment..

25

OK, ether3 device got - that looks good!! :slight_smile:
-) IP: 192.168.90.254
-) GW: 192.168.80.1
-) DNS: 192.168.80.1

But no internet Connection.

BUT - on the Fritz-Side, I got a lot of IKE-Error 0x2027 when receiving packets from the MT-Side.
IKE-Error 0x2027 means “timeout”

Did we miss a incoming FW rule for wireguard from WAN?

26

Should not be the case.
Only the Server Peer for handshake needs a wireguard input chain rule as its receiving the request…
On the MT device, we have a forward chain rule allowing subnet 90 to enter the wg tunnel.
Should work.
Post the config for review… maybe something else will come to mind.

27

MT-Config:

# 2024-07-09 12:17:39 by RouterOS 7.15.2
# software id = MRVG-J4JI
#
# model = C52iG-5HaxD2HaxD
# serial number = ***
/interface bridge
add admin-mac=48:A9:8A:DA:A7:5E auto-mac=no comment=defconf name=bridge
/interface wireguard
add listen-port=182XX mtu=1420 name=wireguard1
/interface vlan
add interface=ether1 name=ether1.1 vlan-id=2
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1.1 name=pppoe-out1 \
    use-peer-dns=yes user=4036121000
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi datapath
add bridge=bridge comment=defconf disabled=no name=capdp
/interface wifi
set [ find default-name=wifi1 ] channel.band=5ghz-ax .reselect-interval=\
    1h..1h20m .skip-dfs-channels=10min-cac .width=20/40/80mhz \
    configuration.country=Austria .mode=ap .ssid=P-Wave datapath=capdp \
    disabled=no security.authentication-types=wpa2-psk,wpa3-psk \
    .connect-priority=0 .ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel.band=2ghz-ax .reselect-interval=\
    1h..1h10m .skip-dfs-channels=10min-cac .width=20/40mhz \
    configuration.country=Austria .mode=ap .ssid=P-Wave datapath=capdp \
    disabled=no security.authentication-types=wpa2-psk,wpa3-psk \
    .connect-priority=0 .ft=yes .ft-over-ds=yes
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp_ether3 ranges=192.168.90.2-192.168.90.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
add address-pool=dhcp_ether3 interface=ether3 name=dhcp_ether3
/routing table
add disabled=no fib name=to-Fritz
/disk settings
set auto-media-interface=bridge
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
add interface=wireguard1 list=WAN
/interface wifi cap
set discovery-interfaces=bridge enabled=yes slaves-datapath=capdp
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=***.myfritz.net \
    endpoint-port=558XX interface=wireguard1 name=peer1 persistent-keepalive=\
    25s preshared-key="***" \
    public-key="***"
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=192.168.90.1/24 interface=ether3 network=192.168.90.0
add address=192.168.80.4/24 interface=wireguard1 network=192.168.80.0
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
add address=192.168.90.0/24 dns-server=192.168.80.1 gateway=192.168.90.1
/ip dns
set allow-remote-requests=yes
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=accept chain=forward comment="internet traffic" in-interface-list=\
    LAN out-interface-list=WAN
add action=accept chain=forward comment="allow V30 to tunnel" out-interface=\
    wireguard1 src-address=192.168.90.0/24
add action=accept chain=forward comment="port forwarding" \
    connection-nat-state=dstnat
add action=drop chain=forward comment="drop all else"
/ip firewall mangle
add action=change-mss chain=forward new-mss=1420 out-interface=pppoe-out1 \
    passthrough=yes protocol=tcp tcp-flags=syn
add action=change-mss chain=forward comment=\
    "Clamp MSS to PMTU for Outgoing packets" new-mss=clamp-to-pmtu \
    out-interface=wireguard1 passthrough=yes protocol=tcp tcp-flags=syn
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=wireguard1 \
    routing-table=to-Fritz suppress-hw-offload=no
/ip service
set ftp disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/routing rule
add action=lookup-only-in-table comment="allow local traffic when required" \
    min-prefix=0 table=main
add action=lookup-only-in-table disabled=no src-address=192.168.90.0/24 \
    table=to-Fritz
/system clock
set time-zone-name=Europe/Vienna
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN

And here’s the Fritz-Config for Wireguard:

{
                enabled = yes;
                editable = yes;
                use_ikev2 = no;
                conn_type = conntype_wg;
                name = "wg-Tokiostrasse";
                boxuser_id = 0;
                always_renew = no;
                reject_not_encrypted = no;
                dont_filter_netbios = no;
                localip = ::;
                remoteip = ::;
                local_virtualip = 0.0.0.0;
                remote_virtualip = 0.0.0.0;
                keepalive_ip = 0.0.0.0;
                mode = phase1_mode_aggressive;
                phase1ss = "all/all/all";
                keytype = connkeytype_pre_shared;
                key = "";
                cert_do_server_auth = no;
                use_nat_t = yes;
                use_xauth = no;
                use_cfgmode = no;
                phase2ss = "esp-all-all/ah-none/comp-all/no-pfs";
                app_id = 0;
                wg_public_key = "***";
                wg_preshared_key = "$$$$***";
                wg_allowed_ips = "192.168.80.0/24";
                wg_persistent_keepalive = 25;
                wg_dnsserver = "192.168.80.4";
                wg_dyndns = "***.myfritz.net";
                wg_slave_network = 0.0.0.0;
                wg_slave_mask = 0.0.0.0;
                wg_hide_network = no;
                wg_fulltunnel = no;
                wg_configured = yes;
        }
28

Try putting this in your fritz device.
wg_dnsserver = “192.168.80.1”; vice 4…

The MT device is setup properly, its the fritz box that is not following wireguard rules or common setup.

29

nope - still IKE-Error 0x2027 (timeout)
I had to re-add wireguard since the Fritz doesn’t let me change it manually (and I don’t want restore the whole backup with the adaption again):

Fritz-Conf:

{
                enabled = yes;
                editable = yes;
                use_ikev2 = no;
                conn_type = conntype_wg;
                name = "wg-Tokiostrasse";
                boxuser_id = 0;
                always_renew = no;
                reject_not_encrypted = no;
                dont_filter_netbios = no;
                localip = ::;
                remoteip = ::;
                local_virtualip = 0.0.0.0;
                remote_virtualip = 0.0.0.0;
                keepalive_ip = 0.0.0.0;
                mode = phase1_mode_aggressive;
                phase1ss = "all/all/all";
                keytype = connkeytype_pre_shared;
                key = "";
                cert_do_server_auth = no;
                use_nat_t = yes;
                use_xauth = no;
                use_cfgmode = no;
                phase2ss = "esp-all-all/ah-none/comp-all/no-pfs";
                app_id = 0;
                wg_public_key = "***";
                wg_preshared_key = "$$$$***";
                wg_allowed_ips = "192.168.80.0/24";
                wg_persistent_keepalive = 25;
                wg_dnsserver = "192.168.80.1";
                wg_dyndns = "***.myfritz.net";
                wg_slave_network = 0.0.0.0;
                wg_slave_mask = 0.0.0.0;
                wg_hide_network = no;
                wg_fulltunnel = no;
                wg_configured = yes;
        }

As said - I can drop the whole wireguard setup and we try it with IPSec again? The Fritz is from my father, so it’s unfortunately not possible to replace it with a MT ( yet :wink:)) )

30

Sure, just add the MT device to the FRITZ and have the fritz LAN be the WAN for the new MT device. :slight_smile:
Then we can wireugard from mt to mt, I know that works LOL.
The only requirement on fritz is to be able to port forward WG listenting port to the new MT.

31

it’s possible - but buying a MT just for a proper wireguard implementation doesn’t sound good to me ^^

32

You are right, First I would burn the fritz box! Then i would need a real router.

33

Unfortunately, I have also been struggling with the Fritzbox and Mikrotik for several weeks now

The following link describes the special WG config of the Fritzbox, as no dedicated internal IP network is used. A special subnet mask must be used in the wizard:
https://administrator.de/forum/s2s-wireguard-avm-zu-mikrotik-4495761391.html#comment-6874546842
(Unfortunately in German only)

@nupplaPhil: I hope this helps and you get it working

I look forward to seeing your working config files afterwards :wink:

34

Hi there,

After a recent update at FritzBox, wireguard seems now to work (both sides are at state “running” and no errors so far).
I also switched back using VLAN instead of a specific ether port, because I do want to dynamically enable/disable the VPN for specific ports :slight_smile:

Now the traffic requests seems to get routed correctly, but there is no response from the other side - at least my client doesn’t get any responses.
Do you see any issues? EVERY traffic should get routed through the VPN (not only 192.168.0.0/24)

The logs:

		998	2024-09-22 02:01:31	memory	firewall, info	V30T forward: in:vlan300 out:wireguard1, connection-state:new,snat src-mac ec:74:8c:6c:e7:c6, proto TCP (SYN), 192.168.90.252:60140->95.101.75.144:443, NAT (192.168.90.252:60140->188.22.45.15:60140)->95.101.75.144:443, len 60	
		999	2024-09-22 02:01:31	memory	firewall, info	V30T forward: in:vlan300 out:wireguard1, connection-state:new,snat src-mac ec:74:8c:6c:e7:c6, proto TCP (SYN), 192.168.90.252:59168->92.123.37.200:443, NAT (192.168.90.252:59168->188.22.45.15:59168)->92.123.37.200:443, len 60	
		996	2024-09-22 02:01:27	memory	firewall, info	V30T forward: in:vlan300 out:wireguard1, connection-state:new,snat src-mac ec:74:8c:6c:e7:c6, proto TCP (SYN), 192.168.90.252:60140->95.101.75.144:443, NAT (192.168.90.252:60140->188.22.45.15:60140)->95.101.75.144:443, len 60	
		997	2024-09-22 02:01:27	memory	firewall, info	V30T forward: in:vlan300 out:wireguard1, connection-state:new,snat src-mac ec:74:8c:6c:e7:c6, proto TCP (SYN), 192.168.90.252:59168->92.123.37.200:443, NAT (192.168.90.252:59168->188.22.45.15:59168)->92.123.37.200:443, len 60	
		995	2024-09-22 02:01:25	memory	firewall, info	V30T forward: in:vlan300 out:wireguard1, connection-state:new,snat src-mac ec:74:8c:6c:e7:c6, proto TCP (SYN), 192.168.90.252:59168->92.123.37.200:443, NAT (192.168.90.252:59168->188.22.45.15:59168)->92.123.37.200:443, len 60	
		994	2024-09-22 02:01:24	memory	firewall, info	V30T forward: in:vlan300 out:wireguard1, connection-state:new,snat src-mac ec:74:8c:6c:e7:c6, proto TCP (SYN), 192.168.90.252:60140->95.101.75.144:443, NAT (192.168.90.252:60140->188.22.45.15:60140)->95.101.75.144:443, len 60	
		993	2024-09-22 02:01:23	memory	firewall, info	V30T forward: in:vlan300 out:wireguard1, connection-state:new,snat src-mac ec:74:8c:6c:e7:c6, proto TCP (SYN), 192.168.90.252:59168->92.123.37.200:443, NAT (192.168.90.252:59168->188.22.45.15:59168)->92.123.37.200:443, len 60	
		991	2024-09-22 02:01:22	memory	firewall, info	V30T forward: in:vlan300 out:wireguard1, connection-state:new,snat src-mac ec:74:8c:6c:e7:c6, proto TCP (SYN), 192.168.90.252:59168->92.123.37.200:443, NAT (192.168.90.252:59168->188.22.45.15:59168)->92.123.37.200:443, len 60	
		992	2024-09-22 02:01:22	memory	firewall, info	V30T forward: in:vlan300 out:wireguard1, connection-state:new,snat src-mac ec:74:8c:6c:e7:c6, proto TCP (SYN), 192.168.90.252:60140->95.101.75.144:443, NAT (192.168.90.252:60140->188.22.45.15:60140)->95.101.75.144:443, len 60

This is my current setup

# 2024-09-22 01:57:05 by RouterOS 7.15.2
# software id = MRVG-J4JI
#
# model = C52iG-5HaxD2HaxD
# serial number = *****
/interface bridge
add admin-mac=48:A9:8A:DA:A7:5E auto-mac=no comment=defconf name=bridge \
    vlan-filtering=yes
/interface wireguard
add listen-port=405** mtu=1420 name=wireguard1
/interface vlan
add interface=ether1 name=ether1.1 vlan-id=2
add comment=wg-VLAN interface=bridge name=vlan300 vlan-id=300
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1.1 name=pppoe-out1 \
    use-peer-dns=yes user=**
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi datapath
add bridge=bridge comment=defconf disabled=no name=capdp
/interface wifi
set [ find default-name=wifi1 ] channel.band=5ghz-ax .reselect-interval=\
    1h..1h20m .skip-dfs-channels=10min-cac .width=20/40/80mhz \
    configuration.country=Austria .mode=ap .ssid=P-Wave datapath=capdp \
    disabled=no security.authentication-types=wpa2-psk,wpa3-psk \
    .connect-priority=0 .ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel.band=2ghz-ax .reselect-interval=\
    1h..1h10m .skip-dfs-channels=10min-cac .width=20/40mhz \
    configuration.country=Austria .mode=ap .ssid=P-Wave datapath=capdp \
    disabled=no security.authentication-types=wpa2-psk,wpa3-psk \
    .connect-priority=0 .ft=yes .ft-over-ds=yes
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp_vlan300 ranges=192.168.90.2-192.168.90.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
add address-pool=dhcp_vlan300 interface=vlan300 name=dhcp_vlan3
/routing table
add disabled=no fib name=to-Fritz
/disk settings
set auto-media-interface=bridge
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
add bridge=bridge comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether3 pvid=300
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge tagged=bridge vlan-ids=300
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
add interface=wireguard1 list=WAN
add interface=vlan300 list=LAN
/interface wifi cap
set discovery-interfaces=bridge enabled=yes slaves-datapath=capdp
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=\
    ***.myfritz.net endpoint-port=57925 interface=wireguard1 \
    name=peer5 persistent-keepalive=25s preshared-key=\
    "***" public-key=\
    "****"
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=192.168.90.1/24 interface=vlan300 network=192.168.90.0
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
add address=192.168.90.0/24 gateway=192.168.90.1
/ip dns
set allow-remote-requests=yes
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=accept chain=forward comment="allow V30 to tunnel" log=yes \
    log-prefix=V30T out-interface=wireguard1 src-address=192.168.90.0/24
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN log=yes log-prefix=NLAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid log=yes log-prefix=INV
add action=accept chain=forward comment="internet traffic" in-interface-list=\
    LAN out-interface-list=WAN
add action=accept chain=forward comment="port forwarding" \
    connection-nat-state=dstnat
add action=drop chain=forward comment="drop all else" log=yes log-prefix=ELSE
/ip firewall mangle
add action=change-mss chain=forward new-mss=1420 out-interface=pppoe-out1 \
    passthrough=yes protocol=tcp tcp-flags=syn
add action=change-mss chain=forward comment=\
    "Clamp MSS to PMTU for Outgoing packets" new-mss=clamp-to-pmtu \
    out-interface=wireguard1 passthrough=yes protocol=tcp tcp-flags=syn
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/ip ipsec profile
set [ find default=yes ] dh-group=modp1024 enc-algorithm=\
    aes-256,aes-192,aes-128
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=wireguard1 routing-table=\
    to-Fritz suppress-hw-offload=no
/ip service
set ftp disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/routing rule
add action=lookup-only-in-table disabled=no src-address=192.168.90.0/24 \
    table=to-Fritz
add action=lookup-only-in-table comment="allow local traffic when required" \
    min-prefix=0 table=main
/system clock
set time-zone-name=Europe/Vienna
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN
35

YES! It’s working!

I had to disable masquerading for 192.168.90.0/24, because FB expects this subnet for it’s wireguard interface.

After disabling it, everything works as expected:
-) Ports with VLAN 1 gets a 192.168.88.0/24 IP and are NATed through the MT ISP to the internet
-) Ports with VLAN 300 gets a 192.168.90.0/24 IP and are routed through the wireguard1 interface to the FB and NATed through the FB ISP to the internet

Here’s my config:

# 2024-09-22 18:39:24 by RouterOS 7.15.2
# software id = MRVG-J4JI
#
# model = C52iG-5HaxD2HaxD
# serial number = *****
/interface bridge
add admin-mac=48:A9:8A:DA:A7:5E auto-mac=no comment=defconf name=bridge \
    vlan-filtering=yes
/interface wireguard
add listen-port=405** mtu=1420 name=wireguard1
/interface vlan
add interface=ether1 name=ether1.1 vlan-id=2
add comment=wg-VLAN interface=bridge name=vlan300 vlan-id=300
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1.1 name=pppoe-out1 \
    use-peer-dns=yes user=4036121000
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi datapath
add bridge=bridge comment=defconf disabled=no name=capdp
/interface wifi
set [ find default-name=wifi1 ] channel.band=5ghz-ax .reselect-interval=\
    1h..1h20m .skip-dfs-channels=10min-cac .width=20/40/80mhz \
    configuration.country=Austria .mode=ap .ssid=P-Wave datapath=capdp \
    disabled=no security.authentication-types=wpa2-psk,wpa3-psk \
    .connect-priority=0 .ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel.band=2ghz-ax .reselect-interval=\
    1h..1h10m .skip-dfs-channels=10min-cac .width=20/40mhz \
    configuration.country=Austria .mode=ap .ssid=P-Wave datapath=capdp \
    disabled=no security.authentication-types=wpa2-psk,wpa3-psk \
    .connect-priority=0 .ft=yes .ft-over-ds=yes
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp_vlan300 ranges=192.168.90.2-192.168.90.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
add address-pool=dhcp_vlan300 interface=vlan300 name=dhcp_vlan3
/routing table
add disabled=no fib name=to-Fritz
/disk settings
set auto-media-interface=bridge
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
add bridge=bridge comment=defconf interface=ether3 pvid=300
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge tagged=bridge vlan-ids=300
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
add interface=wireguard1 list=WAN
add interface=vlan300 list=LAN
/interface wifi cap
set discovery-interfaces=bridge enabled=yes slaves-datapath=capdp
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=*****.myfritz.net \
    endpoint-port=579** interface=wireguard1 name=peer5 persistent-keepalive=\
    25s preshared-key="*****" \
    public-key="***************"
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=192.168.90.1/24 interface=vlan300 network=192.168.90.0
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
add address=192.168.90.0/24 gateway=192.168.90.1
/ip dns
set allow-remote-requests=yes
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid log=yes log-prefix=IINV
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=accept chain=forward comment="allow V30 to tunnel" log-prefix=V30T \
    out-interface=wireguard1 src-address=192.168.90.0/24
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN log=yes log-prefix=NLAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid log=yes log-prefix=FINV
add action=accept chain=forward comment="internet traffic" in-interface-list=\
    LAN out-interface-list=WAN
add action=accept chain=forward comment="port forwarding" \
    connection-nat-state=dstnat
add action=drop chain=forward comment="drop all else" log=yes log-prefix=ELSE
/ip firewall mangle
add action=change-mss chain=forward new-mss=1420 out-interface=pppoe-out1 \
    passthrough=yes protocol=tcp tcp-flags=syn
add action=change-mss chain=forward comment=\
    "Clamp MSS to PMTU for Outgoing packets" new-mss=clamp-to-pmtu \
    out-interface=wireguard1 passthrough=yes protocol=tcp tcp-flags=syn
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN src-address=\
    192.168.88.0/24
/ip ipsec profile
set [ find default=yes ] dh-group=modp1024 enc-algorithm=\
    aes-256,aes-192,aes-128
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=wireguard1 routing-table=\
    to-Fritz suppress-hw-offload=no
/ip service
set ftp disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/routing rule
add action=lookup-only-in-table disabled=no src-address=192.168.90.0/24 \
    table=to-Fritz
add action=lookup-only-in-table comment="allow local traffic when required" \
    min-prefix=0 table=main
/system clock
set time-zone-name=Europe/Vienna
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN