Hello,
I can’t resolve trouble with Android connection to Mikrotik Wireguard. On the Android in wireguard interface counter of Tx packets is increasing, but Rx packets is 0. On the Mikrotik on the firewall counter input packets in chain is increasing, but on the Wireguard interface counter Rx/Tx packets is 0. There is no information in the log about this. RouterOS is 7.14.3.
What am I doing wrong?
Let’s start with the fact that you haven’t posted a single relevant detail about your configuration. Post the output of “/interface/wireguard/export” and the Android-side config at minimum, stripped of all keys.
(You could technically leave the public keys in, but since that won’t help us beyond double-checking that they match on both sides, something you can do on your own, I’d remove them and simply report that they match, if in fact my presumption that they do is true.)
Lacking that, we’re left with pure speculation.
Incorrect public key at one or both ends seems to be more common than it should be.
Time/Date at both ends need to be near each other.
You can put in a firewall rule with log enabled on the outbound port as source port, (and interface), to see if anything is leaving for the
remote device.
Very strange EXPORT BUTTON behavior in Wireguard (WINBOX GUI)
This is export from Mikrotik It does not seem to be client’s configuration:
Peer’s IP is 10.10.20.10/32
We access WG server at 10.10.100.1, port 13231
[Interface]
ListenPort = 13231
PrivateKey = <WIREGUARD SERVER\'S PRIVATE KEY 8() WRONG FOR IMPORT TO ANY CLIENT>
[Peer]
PublicKey = <PUBLIC KEY OF THE PEER. WRONG FOR IMPORT INTO ANY CLIENT>
AllowedIPs = 10.10.20.10/32
Endpoint = 10.10.100.1:13231
PersistentKeepalive = 30
PresharedKey = <PRESHARED KEY IS OK.>
Correct config to import to the client looks like this:
This is correct config file
[Interface]
PrivateKey = <CLIENT\'S PRIVATE KEY>
Address = 10.10.20.10/32
[Peer]
PublicKey = <SERVER PUBLIC KEY>
PresharedKey = <AS IS. IT IS OK>
AllowedIPs = 10.10.20.0/24
Endpoint = 10.10.100.1:13231
PersistentKeepalive = 30
PLEASE NOTE: This all was done through WINBOX.
So Mikrotik’s Wireguard EXPORT button does a bad job. It does not allow exporting peers’ config files. Only server config (hopefully)
To create clients’ config you need manually copy server’s public key from WG config window and client’s private key from peer’s config window. Of course, in case, you generated all the keys as “auto” option in WINBOX GUI
If your router has a public IP ( or can port forward from ISP router to your router ) do not use BTH or any automated tricks.
It seems to cause issues and you dont learn a damn thing about how to setup wireguard properly especially since its not that hard.
post your router config please
/export file=anynameyouwish ( minus router serial number, public WANIP info, keys etc.)