Hey. I’m setting up a small network for my parents’ new house. The hardware is all Mikrotik - a switch, a router, and several access points. I’ve configured VLAN switching on a single bridge on the router so I can split my network into multiple VLANs. One of those VLANs (99) is used for management …

Well the VPS aka a CHR in a cloud is about $6 a month to rent plus the CHR license and use Wireguard VPN, and is a great way to do what you want to do without third party servers. Preferred option 4 You could do it right now with VPN WIREGUARD BTH depending upon what router you bought your parent…

Hi Anav, thanks for your reply. I like the simplicity of BTH. After configuring it, I can see a new interface called “back-to-home-vpn”. I tried adding it to the bridge as an access port but it seems that it’s not possible. I suppose that’s because WireGuard is L3 and bridges are a L2 concept. How…

Well the way it works is you enable BTH on the router. Take the first created user and install that on your smart phone, any other users have to be created on the smartphone as well. You will need to go to the router at your parents place allows the subnet of wireguard access on the input chain a…

There is no need to pay such expensive VPS and licenses. I have a VPS for 2€ per month (unlimited traffic, 100 Mbps connectivity and public IPv4 address + IPv6 prefix) and Debian on it. Currently the VPS act as L2TP server and MikroTik routers have L2TP clients… but I only use it for remote site man…

Well the way it works is you enable BTH on the router. Take the first created user and install that on your smart phone, any other users have to be created on the smartphone as well. You will need to go to the router at your parents place allows the subnet of wireguard access on the input chain …

Then add access to the management vlan. add action=accept chain=forward comment=“remote admin to trusted vlan” in-interface=BTHWireguard out-interface=vlan-mgmt

I’ve added the rule you suggested. Now the situation is as follows: I can ping both 10.99.0.1 and 10.99.0.2 I can connect with Winbox to 10.99.0.2 I cannot connect with Winbox to 10.99.0.1 - Probably because there is no rule on the input chain for BTH, but why is it needed if I already allow MGMT_…

Easy Peasy now that I have facts to work with! :slight_smile: /interface list member add interface=ether7 list=WAN add interface=PRIVATE_VLAN list=VLAN add interface=GUEST_VLAN list=VLAN add interface=IOT_VLAN list=VLAN add interface=SECURITY_VLAN list=VLAN add interface=MGMT_VLAN list=VLAN …

Almost there :slight_smile: Now I can Winbox into both 10.99.0.1 and 10.99.0.2 but Neighbor Discovery still doesn’t show any of the devices. Besides that, does my config look correct? Am I achieving separation between the VLANs and is it a secure firewall config when it comes to WAN? EDIT: I don’…

Not sure what you mean… You have this on the config, which is a good start. /ip neighbor discovery-settings set discover-interface-list=MGMT BUT THE ERROR comes later. You reversed the settings /tool mac-server set allowed-interface-list=MGMT /tool mac-server mac-winbox set allowed-interfac…

VPN with relay on a VPS - working around the CGNAT

RouterOS Beginner Basics

IgorAugustynski March 30, 2025, 9:17am 6

I think you’re missing the VLAN part. Allowing the WireGuard interface on the input chain gives me access to the router only, not the switch or any other device on the MGMT_VLAN.