virtual gateway howto

RouterOS General
1

Hi all,

Probably a noob question but I’m not very pro in networking… so hope for your help! :slight_smile:

It’s not specifically tied to Router OS, but it’s much faster to test using it (it’s like LEGO).
So, there are two routers with their relevant networks (let’s say A and B), to some cloud machine (let’s say C) as a site-to-site VPN (WireGuard is used, but that’s not really relevant here). Routers have standard 192.168.88.0/24 networks and VPN interfaces are 172.16.1.0/24. There’s no custom routing and everyone can access everyone (WireGuard’s AllowedIPs has both networks listed). Both A and B have are connected to the Internet via different ISPs.

What I want: to create such (virtual) gateway address on C, which I could use as a default gateway for both A and B. So A’s and B’s Internet connection will go via this host. Then, on C, there’s different ISP and basically there’s MASQUERADE for everything leaving C. Essentially, when you connect A to the Internet, it can only access C and B resources (via WireGuard), but not the Internet UNLESS this default gateway (let’s say 172.16.1.64) is specified.

What I’ve tried: VLAN, VETH, custom routing table on C, pure iptables with little to no success. At some point I either use connectivity to C or Internet, and my traceroute starts looking very mysterious. I guess the biggest question is routing, since I don’t want it to be pure iptables src-nat like (very CPU expensive).

A and B are RouterOS devices and their configuration is minimal, C is going to be a Linux VPS, right now is RouterOS device also (to test the concept).

Any ideas are appreciated!

Best

2

Should be easy once a clearer description is provided, Im assuming that the two lans on two different routers are not the same subnet and different wireguard addresses etc…
( and not duplication Routers have standard 192.168.88.0/24 networks and VPN interfaces are 172.16.1.0/24. )

Please provide a network diagram showing all routers and all internet connections etc…
Then the config of the two mikrotik routers is required…

Be very specific in your requirements
Users on LAN1 from Router A should be able to do X, Y, Z and so forth and break down what x,y,z in sufficient detail.
Users on LAN2 from Router B should be able to do A, B, C etc.

Admin from router A should be able to…
Admin from router B should be able to…

What is this C variant, are we talkng a cloud VPS server with internet connection or a third MT router etc… or simply another ISP connection on one of the routers

Way too much missing information thus far.

3

As @anav already wrote, it is hard to understand what your real requirement is, especially not knowing your level of networking expertise. I can imagine two scenarios:

  • you want routers A and B themselves to use the Wireguard tunnels to reach the internet for all traffic except the Wireguard transport packets
  • you want devices connected to router A or B to only get to internet if you configure them with a specific gateway in their own subnet (the LAN subnet on the Router A or Router B)?

But maybe you want something completely else?

4

https://forum.mikrotik.com/viewtopic.php?p=908118