Thanks, it worked with one minor addition. I’ll post my config just in case.
The common VPN protocols going outside the country are currently being blocked in Russia. Shadowsocks works though. Because I can’t maintain shadowsocks link for every site I need VPNed I decided upon the following setup. For the common use case there are 4 devices involved:
- R: remote (Dutch) server used as a VPN exit node when DPI must be circumvented, debian linux 11, 172.16.0.1, has public static ip
- H: a ‘hub’ server, has shadowsocks tunnel to R, also debian linux 11, 172.16.0.17, has public static ip
- M: on-site mikrotik, connected to H by ordinary wireguard, 172.16.0.25
- C: wifi client to M, laptop, tv, etc, 172.16.1.0/24
In-country wireguard traffic isn’t being blocked (at least by my ISPs), thus M and H can talk over plain wireguard. H and R can’t use wireguard directly, the connection is being disrupted. So I connect them with wireguard over shadowsocks which is somewhat inefficient, but works. All in angle brackets must be replaced with appropriate values for configs to work.
R wireguard config
/etc/wireguard/wg16.conf:
[Interface]
Address = 172.16.0.1/16
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
ListenPort = <R-wg-port>
PrivateKey = <R-priv-key>
#...
[Peer]
PublicKey = <H-pub-key>
AllowedIPs = 172.16.0.17/16
to enable in systemd:
sudo systemctl enable --now wg-quick@wg16
R shadowsocks config (server)
/etc/shadowsocks-libev/config.json:
{
"server":"0.0.0.0",
"mode":"tcp_and_udp",
"server_port":<R-ss-port>,
"password":"<ss-password>",
"timeout":300,
"method":"chacha20-ietf-poly1305"
}
to enable in systemd:
sudo systemctl enable --now shadowsocks-libev.service
H wireguard config
/etc/wireguard/wg16.conf:
[Interface]
PrivateKey = <H-priv-key>
Address = 172.16.0.17/16
ListenPort = <H-wg-port>
PostUp = iptables -A FORWARD -i wg16 -j ACCEPT; ip6tables -A FORWARD -i wg16 -j ACCEPT
PostDown = iptables -D FORWARD -i wg16 -j ACCEPT; ip6tables -D FORWARD -i wg16 -j ACCEPT
# This is needed to avoid encryping shadowsocks with wireguard,
# because wireguard needs to go over shadowsocks to reach R
# <H-LAN-gateway> - e.g. 192.168.0.1
PostUp = ip route add <R-public-ip>/32 via <H-LAN-gateway> dev eth0
PostDown = ip route del <R-public-ip>/32 via <H-LAN-gateway> dev eth0
# ... some other peers connect directly to H, not through M
[Peer]
# connection to R over shadowsock
PublicKey = <R-pub-key>
Endpoint = 127.0.0.1:<H2R-tunnel-port>
PersistentKeepalive = 15
AllowedIPs = 0.0.0.0/0
[Peer]
# connection from M
PublicKey = <M-pub-key>
AllowedIPs = 172.16.0.25/32, 172.16.1.1/24
to enable in systemd:
sudo systemctl enable --now wg-quick@wg16
H shadowsocks config (client)
/etc/shadowsocks-libev/hub.json:
{
"server": "<R-public-ip>",
"mode":"tcp_and_udp",
"server_port":<R-ss-port>,
"local_address": "127.0.0.1",
"local_port":<H2R-tunnel-port>,
"password":"<ss-password>",
"timeout":300,
"method":"chacha20-ietf-poly1305",
"tunnel_address": "127.0.0.1:<R-wg-port>"
}
to enable in systemd:
sudo systemctl enable --now shadowsocks-libev-tunnel@hub.service
M config
Start with the default config, then:
# add wireguard
/interface/wireguard/add name=wg listen-port=<M-wg-port> private-key="<M-priv-key>"
/interface/wireguard/peers/add allowed-address=0.0.0.0/0 endpoint-address=<H-public-ip> endpoint-port=<H-wg-port> interface=wg public-key="<H-pub-key>" comment=H
/ip address add address=172.16.0.25/16 interface=wg
# add bridge-wifi, move wlan1 to it
/interface/bridge/add name="bridge-wifi"
/ip/address/add address=172.16.1.1/24 interface=bridge-wifi
/interface/bridge/port/set [ find interface=wlan1 ] bridge=bridge-wifi
/ip/pool/add name=wifi-dhcp ranges=172.16.1.2-172.16.1.254
/ip/dhcp-server/add interface=bridge-wifi address-pool=wifi-dhcp name=wificonf
# routing
/routing/table/add name=rtvpn fib
/routing/rule/add src-address=172.16.1.1/24 action=lookup-only-in-table table=rtvpn
/ip/route/add dst-address=0.0.0.0/0 gateway=wg routing-table=rtvpn
# I had to add this to your instructions, somehow it works
/ip/dhcp-server/network/add address=172.16.1.0/24 gateway=172.16.1.1 dns-server=8.8.8.8