This looks very much like a firewall issue… Did you allow the ports used for wireguard?
My wireguard connections are operational already for days…
/interface bridge
add name=loopback port-cost-mode=short
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface vlan
add interface=sfp-sfpplus4 name=GPON vlan-id=10
/interface bonding
add mode=802.3ad name=bonding1 slaves=sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3 transmit-hash-policy=layer-2-and-3
/interface pppoe-client
add add-default-route=yes disabled=no interface=GPON name=pppoe-out1 user=1blalbaa
/interface ethernet switch
set 0 l3-hw-offloading=yes
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=openvpn-pool ranges=10.100.100.11-10.100.100.99
/port
set 0 name=serial0
/routing ospf instance
add disabled=no name=ospf-instance-1 originate-default=always redistribute=connected
/routing ospf area
add disabled=no instance=ospf-instance-1 name=ospf-area-1
/system logging action
set 3 remote=10.10.10.10 src-address=10.0.0.1
/zerotier
set zt1 comment="ZeroTier Central controller - https://my.zerotier.com/" name=zt1 port=9993
/zerotier interface
add allow-default=no allow-global=no allow-managed=yes disabled=no instance=zt1 name=zerotier1 network=272f5eae16897148
/ip neighbor discovery-settings
set discover-interface-list=all
/interface detect-internet
set detect-interface-list=all internet-interface-list=all lan-interface-list=all wan-interface-list=all
/interface list member
add interface=pppoe-out1 list=WAN
add interface=bonding1 list=LAN
add interface=ether12 list=LAN
add interface=zerotier1 list=LAN
add interface=wireguard1 list=LAN
/interface ovpn-server server
set auth=sha1 certificate=*2 cipher=aes128-gcm,aes192-gcm,aes256-gcm port=443 require-client-certificate=yes
/interface wireguard peers
add allowed-address=10.100.100.2/32 interface=wireguard1 public-key="+L9oHVFkifH9GLf+25zNEt+blablabla="
/ip address
add address=192.168.88.1/24 interface=ether13 network=192.168.88.0
add address=10.255.255.1/30 interface=bonding1 network=10.255.255.0
add address=10.255.255.21/30 interface=ether12 network=10.255.255.20
add address=10.0.0.1 interface=loopback network=10.0.0.1
add address=10.100.100.1/24 interface=wireguard1 network=10.100.100.0
/ip cloud
set ddns-enabled=yes
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4,1.1.1.1,1.0.0.1
/ip firewall address-list
add list=bogons
add address=0.0.0.0/8 list=bogons
add address=10.0.0.0/8 list=bogons
add address=100.64.0.0/10 list=bogons
add address=127.0.0.0/8 list=bogons
add address=127.0.53.53 list=bogons
add address=169.254.0.0/16 list=bogons
add address=172.16.0.0/12 list=bogons
add address=192.0.0.0/24 list=bogons
add address=192.0.2.0/24 list=bogons
add address=192.168.0.0/16 list=bogons
add address=198.18.0.0/15 list=bogons
add address=198.51.100.0/24 list=bogons
add address=203.0.113.0/24 list=bogons
add address=224.0.0.0/4 list=bogons
add address=240.0.0.0/4 list=bogons
add address=255.255.255.255 list=bogons
add address=10.10.10.0/24 list=LAN
add address=10.10.20.0/24 list=LAN
add address=10.10.80.0/24 list=LAN
add address=10.10.90.0/24 list=LAN
add address=10.20.10.0/24 list=LAN
add address=10.100.100.0/24 list=LAN
/ip firewall filter
add action=accept chain=input comment="allow WireGuard" dst-port=13231 protocol=udp
add action=accept chain=input comment="allow WireGuard traffic" src-address=10.100.100.0/24
add action=accept chain=forward in-interface=zerotier1
add action=accept chain=input in-interface=zerotier1
add action=accept chain=input connection-state=established,related,untracked
add action=accept chain=input protocol=udp src-address=127.0.0.1
add action=drop chain=input connection-state=invalid log-prefix="input invalid blocked"
add action=accept chain=input protocol=icmp
add action=accept chain=input in-interface-list=LAN protocol=ospf
add action=accept chain=input in-interface-list=LAN src-address=10.10.20.0/24
add action=accept chain=input in-interface-list=LAN
add action=drop chain=input log-prefix="input drop"
add action=fasttrack-connection chain=forward connection-state=established,related hw-offload=yes
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid log-prefix="forward invalid block"
add action=accept chain=forward in-interface-list=LAN out-interface-list=WAN
add action=drop chain=forward connection-nat-state=!dstnat connection-state=new in-interface-list=WAN log-prefix="not natted"
add action=jump chain=forward jump-target=icmp protocol=icmp
add action=drop chain=forward log-prefix="forward drop"
add action=accept chain=icmp icmp-options=0:0 protocol=icmp
add action=accept chain=icmp icmp-options=3:0 protocol=icmp
add action=accept chain=icmp icmp-options=3:1 protocol=icmp
add action=accept chain=icmp icmp-options=3:4 protocol=icmp
add action=accept chain=icmp icmp-options=8:0 protocol=icmp
add action=accept chain=icmp icmp-options=11:0 protocol=icmp
add action=accept chain=icmp icmp-options=12:0 protocol=icmp
add action=drop chain=icmp
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
/ip service
set telnet disabled=yes
set ftp disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/routing ospf interface-template
add area=ospf-area-1 disabled=no interfaces=bonding1 type=ptp
add area=ospf-area-1 disabled=no interfaces=ether12 type=ptp
/snmp
set enabled=yes
/system clock
set time-zone-name=Universal
/system logging
add action=remote topics=pppoe,!debug
add action=remote topics=info
add topics=wireguard,debug
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp server
set enabled=yes
/system ntp client servers
add address=pool.ntp.org
add address=time.google.com
add address=time.cloudflare.com
/system package update
set channel=testing
This is the current configuration, also tried to lower MTU all the way to 1300.
Uptime 1d23:34:09
Haven’t had any interruptions on WG.
Change it to, @kreb:
/ip firewall filter
add action=accept chain=input comment="allow WireGuard" dst-port=13231 protocol=udp in-interface=pppoe-out1
You are currently missing the in-interface (or use in-interface-list=WAN).
And get rid of all unnecessary rules please.
/ip firewall filter
add action=accept chain=input comment="allow WireGuard" dst-port=13231 in-interface=pppoe-out1 protocol=udp
add action=accept chain=input comment="allow WireGuard traffic" src-address=10.100.100.0/24
add action=accept chain=input connection-state=established,related,untracked
add action=accept chain=input protocol=icmp
add action=accept chain=input in-interface-list=LAN
add action=drop chain=input disabled=yes log-prefix="input drop"
add action=fasttrack-connection chain=forward connection-state=established,related hw-offload=yes
add action=accept chain=forward connection-state=established,related,untracked
add action=accept chain=forward in-interface-list=LAN out-interface-list=WAN
add action=drop chain=forward connection-nat-state=!dstnat connection-state=new disabled=yes in-interface-list=WAN log-prefix="not natted"
add action=drop chain=forward disabled=yes log-prefix="forward drop"
[NET] UDP bind has been updated
2023-12-09 15:19:34.977
[NET] Routine: receive incoming v6 - started
2023-12-09 15:19:34.977
[NET] Routine: receive incoming v4 - started
2023-12-09 15:19:34.990
[NET] peer(oBoa…GpVM) - Sending handshake initiation
2023-12-09 15:19:35.053
[NET] peer(oBoa…GpVM) - Received handshake response
2023-12-09 15:19:39.520
[APP] Status update notification timeout for tunnel 'secretgarden'. Tunnel status is now 'connected'.
2023-12-09 15:19:50.467
[NET] peer(oBoa…GpVM) - Retrying handshake because we stopped hearing back after 15 seconds
2023-12-09 15:19:50.468
[NET] peer(oBoa…GpVM) - Sending handshake initiation
2023-12-09 15:19:55.653
[NET] peer(oBoa…GpVM) - Handshake did not complete after 5 seconds, retrying (try 2)
2023-12-09 15:19:55.653
[NET] peer(oBoa…GpVM) - Sending handshake initiation
removed all unnecessary filters, and disabled all drops for testing.
Yes its AC, cap AC models are used. I didnt find any config information in the help section. I have tried to add caps wifi port manual to the bridge as any other bridged port but dont get any traffic.
seeing a strange issue with wireguard on one of my remote sites after upgrading to 7.13rc3 and trying to figure out if its a localized problem or issue with this build..
peer connection is established (regular handshakes) but when trying to establish any tcp connection (didnt try other protocols yet) over the tunnel, the tcp connection establishes normally/quickly, but then throughput stalls.
I’ve been trying for hours to telnet in via the tunnel, and the furthest I got was to the “Password:” prompt. Winbox gets stuck on “Logging in…” or "Downloading descriptors…: stage. I can open many telnet or winbox sessions and all of them will quickly reach this stage and not progress any further until they all eventually time out.
MTU settings are fine and I’m able to reach a host on the remote end using RustDesk (bypassing the wg tunnel, in other words), which suggests to me that the problem is with the WG tunnel.
At first I thought it was maybe something to with with the ISP/LTE connection, but then it occurred to me that everything was fine prior to the ROS upgrade (v7.12.1stable before this) and that the LTE connection was not reset from before/after the upgrade took place.
I have an EOIP tunnel over the wg tunnel and can’t get in via there either, so it seems the wg tunnel itself is stalling somehow.
Pinging over the tunnel works flawlessly (even with high packet sizes + do not fragment)
The remote device is a hAP ac2
Quite annoying, but I guess this is the price to pay when playing with development builds on remote sites. I just wanted to get that hAP ac2 onto the new system+wireless package scheme ASAP, which is why I took the chance. At least everything else works and remote devices have internet, wifi, etc and are able to access the router directly via the remote LAN and confirmed CPU & memory usage of the router is in fact normal.
Edit: Ok this is weird. So I just restarted the other endpoint (chr v7.12.1) and now I can connect flawlessly to the hap ac2 again. I guess something else was the problem?..
Do you see the counter of the accept rule increasing?
Could it be that the provider is blocking (perhaps because of CGNAT)?
Does any other port forward/open word work at all?
Looks like your ISP is blocking the protocol by DPI can you make connections to other WG servers?
The RC version is working fine, hopefully the official version will be available soon!
Would you please add a feather to ignore BAD DUID response code from IPv6 dhcp ?
Some China’s ISP uses ZTE v6000 , and will return a DUID code 0660, RouterOS report “bad server DUID", can’t get IPv6 address and prefix, but other software like OpenWRT works.
Just a heads up that upgrading to v7.13rc3 killed my PPPoE WAN connection - I’ve not had time to diagnose, but a rollback to rc2 has fixed the issue for me, so I’m confident that the rc3 upgrade was the cause. I am running an RB5009 with WAN connection via 1GbE copper SFP module - Manufacturer: FS model: SFP-GB-GE-T. I cannot see anything in the logs other than the PPPoE repeatedly trying and failing to connect, and cannot find any logging related to the SFP module. Looking at the release notes for rc3, I’m guessing that “*) sfp - improved link establishment for SFP copper modules;” has had unintended consequences! Here is my PPPoE config:
name="pppoe-out1"
max-mtu=auto
max-mru=auto
mrru=disabled
interface=sfp-sfpplus1
user="username"
password="password"
profile=default
keepalive-timeout=10
service-name=""
ac-name=""
add-default-route=yes
default-route-distance=1
dial-on-demand=no
use-peer-dns=no
allow=pap,chap,mschap1,mschap2
Cheers, Jason.
UPDATE - I’ve now managed to run the SFP diagnostics, and it looks like the “improved link establishment for SFP copper modules” in rc3 has broken the negotiation of inserted SFP module capabilities, at least for my FS module:
v7.13rc2
name: sfp-sfpplus1
status: link-ok
auto-negotiation: done
rate: 1Gbps
full-duplex: yes
tx-flow-control: no
rx-flow-control: no
supported: 10M-baseT-half,10M-baseT-full,
100M-baseT-half,100M-baseT-full,
1G-baseT-half,1G-baseT-full,1G-baseX,
2.5G-baseT,2.5G-baseX,5G-baseT,10G-baseT,
10G-baseSR-LR,10G-baseCR
sfp-supported: 10M-baseT-half,10M-baseT-full,
100M-baseT-half,100M-baseT-full,
1G-baseT-half,1G-baseT-full
advertising: 10M-baseT-half,10M-baseT-full,
100M-baseT-half,100M-baseT-full,
1G-baseT-half,1G-baseT-full
link-partner-advertising:
sfp-module-present: yes
sfp-rx-loss: no
sfp-tx-fault: no
sfp-type: SFP/SFP+/SFP28/SFP56
sfp-connector-type: RJ45
sfp-link-length-copper-active-om4: 100m
sfp-vendor-name: FS
sfp-vendor-part-number: SFP-GB-GE-T
sfp-vendor-serial: S2001339604
sfp-manufacturing-date: 20-01-10
eeprom-checksum: good
eeprom: 0000: 03 04 22 00 00 00 08 00 00 00 00 01 0d 00 00 00 .."..... ........
0010: 00 00 64 00 46 53 20 20 20 20 20 20 20 20 20 20 ..d.FS
0020: 20 20 20 20 00 00 00 00 53 46 50 2d 47 42 2d 47 .... SFP-GB-G
0030: 45 2d 54 20 20 20 20 20 20 20 20 20 00 00 00 f5 E-T ....
0040: 00 00 00 00 53 32 30 30 31 33 33 39 36 30 34 20 ....S200 1339604
0050: 20 20 20 20 32 30 30 31 31 30 20 20 00 00 00 53 2001 10 ...S
0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
v7.13rc3
name: sfp-sfpplus1
status: no-link
auto-negotiation: done
supported: 10M-baseT-half,10M-baseT-full,
100M-baseT-half,100M-baseT-full,
1G-baseT-half,1G-baseT-full,1G-baseX,
2.5G-baseT,2.5G-baseX,5G-baseT,10G-baseT,
10G-baseSR-LR,10G-baseCR
sfp-supported: 1G-baseX
advertising: 1G-baseX
link-partner-advertising:
sfp-module-present: yes
sfp-rx-loss: no
sfp-tx-fault: no
sfp-type: SFP/SFP+/SFP28/SFP56
sfp-connector-type: RJ45
sfp-link-length-copper-active-om4: 100m
sfp-vendor-name: FS
sfp-vendor-part-number: SFP-GB-GE-T
sfp-vendor-serial: S2001339604
sfp-manufacturing-date: 20-01-10
eeprom-checksum: good
eeprom: 0000: 03 04 22 00 00 00 08 00 00 00 00 01 0d 00 00 00 .."..... ........
0010: 00 00 64 00 46 53 20 20 20 20 20 20 20 20 20 20 ..d.FS
0020: 20 20 20 20 00 00 00 00 53 46 50 2d 47 42 2d 47 .... SFP-GB-G
0030: 45 2d 54 20 20 20 20 20 20 20 20 20 00 00 00 f5 E-T ....
0040: 00 00 00 00 53 32 30 30 31 33 33 39 36 30 34 20 ....S200 1339604
0050: 20 20 20 20 32 30 30 31 31 30 20 20 00 00 00 53 2001 10 ...S
0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
RB4011iGS+5HacQ2HnD-IN all v7.13rc3 - PPPoE WAN connection - is OK!
/interface pppoe-client add add-default-route=yes allow=chap comment=WAN disabled=no interface=sfp-sfpplus1 name=pppoe-out1 user=login
P.S.
I want wipe settings - Bridge Interface Path Costs
/interface/bridge
set port-cost-mode=long
Message in Terminal:
numbers: /interface/bridge/port
Script Error: action cancelled
every problem reported supout will be first ask by MT.
but not all problem can be captured in supout if we generated after rebooted.
and not all the supout can be generated when problem occurs.
question: sometime we see autosupout file in the router, anyone knows when exactly autosupout generated?
and can autosupout use for MT to find the problem when the routers hangs or before rebooted?
thx
We have received a single report about “non-working” WireGuard in v7.13 on support, and it does not seem that it has anything to do with the software, but either a networking or configuration problem. If there are any other setups where WireGuard worked just fine in v7.12, but does not work in v7.13, then please do not hesitate and send a supout file from your router to support@mikrotik.com.
Autosupout is the same supout file as manually generated, but is generated automatically when there is a software error. In short, there are such possibilities:
- Router rebooted due to an out-of-memory condition or Kernel Failure (not on Watchdog reboots since Watchdog is a reboot done on purpose, it is not an issue);
- Some internal program failed;
- WinBox loader on your computer crashed while you were connected to this router (the most popular cause of autosupout files);
- Hardware is doing tricks and making software to fail.
The “software issue” in supout file can be seen only by MT employees. For end-user it will look exactly the same as regular supout. Such files must be sent to us.
It works by using an AX AP. I’ve same behaviour by using an AC AP and new driver wifi-qcom-ac. You can make it work by configuring the bridge vlans AND by activating vlan filtering on the CAP.
I don’t know if it is a bug or not, but on docs (https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-Lostfeatures) you can read:
“VLAN configuration in the wireless settings (Per-interface VLANs can be configured in bridge settings)”
Bye
I have a wAP AC running 7.13rc2 and I have no issues but I do use bridge with VLAN filtering on and have made the dynamic interfaces static on the wAP AC so I could add them to the bridge and they do not disappear every time I reboot the device. Works like a charm. All this under new CapsMAN working together with cAP AX.
I hope the solve the VLAN thing on AC interfaces but for now it works at least.
Yes, doing that will work… But in a scenario such mine (or others) where you’ve a hundred of AC APs it’s hard to reconfigure manually all of them.
I’m waiting to see if this is a bug and it will be resolved, otherwise I cannot upgrade to new drivers for old AC series.
I think everyone here think like me.
Just a note: according my tests on AC APs using new drivers you can tag a single VLAN and it works, but you cannot add an additional SSID with a different VLAN ID (slave config in CAPSMAN). That will not work.
Bye
I’ve found a bug in Bridge → Ports; I’m unable to change the order.
Not with “/interface/bridge/port/move numbers=17 destination=1”, nor with the WebGui, nor with Winbox.