SurfShark Wireguard VPN Issues

RouterOS General
33

If you want to use the CHR as the gateway to the internet then:

  • On the CHR:

    • In the peer setting associated with your MikroTik router, set allowed-address=192.168.2.2/32, don't set persistent-keepalive.

    • In the peer setting associated with your Laptop, set allowed-address=192.168.2.3/32, don't set persistent-keepalive. Normally you have to avoid giving overlapping address ranges between different peers of one WireGuard interface. Both peers having allowed-address=0.0.0.0/0 won't work.

    • You should apply proper firewall rules to protect your CHR. You can use the 7.21 defconf rules from this post of @rextended Buying - RB1100AHx4 Dude Edition - Questions about Firewall - #4 by rextended. Currently you have allow-remote-requests=yes for DNS on the CHR, so without proper firewall configuration your CHR will be abused to perform DNS amplification attacks for example.

    • Once you have the firewall in place, enable WAN connection on ether1 (you currently have DHCP client disabled and no static IP address & gateway configuration).

  • On your RB5009:

    • This NAT rule is wrong:

      /ip firewall nat
add action=masquerade chain=srcnat in-interface=WG_VPS

      It should be out-interface=WG_VPS instead. But better is to remove the rule and add WG_VPS to the interface list WAN. Currently you have that interface in the list LAN! Having the interface in the WAN list will automatically apply the masquerade for you (by using the defconf: masquerade rule).

      You should treat WG_VPS like you treated ProtonVPN-IL50 and ProtonVPN-IL530 with regard to address list membership.

    • Also apply the two change-mss mangle rule to out-interface=WG_VPS.

1 Like