Hello
I have strange issue with wireguard, I have make the cofiguration correctly and peers can connect using the wg without any issues
one week ago and when some peers use specific isp it block the connection but when they use another internet connection they can connect successfully using wg
this is the message I got or the peer try to connect through specific internet provider
Handshake for peer 1 (xx.xx.xx.xx:13231) did not complete after 5 seconds, retrying (try 16)
Please provide a diagram because your LAN and WAN dont make any sense…
You have no bridge, some assorted vlans random and then random assigned IPs to some ports but some ports have nothing, LACKS structure such that I have no clue of what you are doing.
so there’s no duplicates these two different network subnets , I use one with server and the other subnet with wireguard interface .. is there any wrong configurations in them?
You did not give details what country. Many world countries now block VPNs. If you live in a such one that means they start blocking. Another variant — specific ISP blocks. First of all you should talk to the ISP where is not working and get official answer about open port or DPI hardware. Only then look into your router.
If it starts a week ago without touching config — absolutely obviously the issue is not on your side.
AN ISP providing you with a private IP address 10.10.1.2
So you do not have a public IP address.?
Can the ISP router forward the wireguard port to your router??
You have no firewall rules WHY??
You have three pools listed and this doesnt match the vlans in the diagram at all… in fact, you have two pools that overlap.,… /ip pool
add name=dhcp_server_main ranges=172.16.10.50-172.16.11.200
add name=dhcp_pool2 ranges=172.16.10.2-172.16.10.62
add name=dhcp_pool6 ranges=10.10.0.2-10.10.0.254
and the very next line indicates a dhcp server accessing a dhcp_pool1
/ip dhcp-server
add address-pool=dhcp_pool1 interface=ether1-local lease-time=3d10m name=\
So nothing in the config and the diagram make sense to me…
Do you have enough ports for each VLAN, if not use bridge and assign all vlans to bridge and go from there…
Why is WLAN1 a WAN interface, you have two WAN interfaces???
Why is SSPFplus1 a LAN member but a disabled interface??
Why do you have two ether1s define… get rid of the disbled one, just adds confusion add address=172.16.10.1/23 interface=ether1-local network=172.16.10.0
add address=10.10.1.2/24 interface=ether6 network=10.10.1.0
add address=172.16.1.1/24 disabled=yes interface=ether1-local network=
172.16.1.0
Why is this in static DNS setting? /ip dns static
add address=192.168.99.99 comment=defconf name=router.lan
Dont understand your maquerade rules…
You fail to identify out-interface=ether6 anywhere??
The first rule is WRONG, if you want to assign a fixed IP the method is incorrect.
The second is disable, more confusing stuff to remove. /ip firewall nat
add action=masquerade chain=srcnat comment=“local LANs masquerade”
dst-address-list=!local src-address-list=local to-addresses=10.10.1.0/24
add action=masquerade chain=srcnat disabled=yes src-address=10.10.10.0/24
Its either add action=masquerade chain=srcnat out-interface=ether6 ( dynamic but can be used for static)
add action=src-nat chain=srcnat out-interface=ether6 to-address=10.10.1.2
If 13231 is the default wg port number then yes chnge it to something else 15689 and perhaps that will help. The rest is config issues not WG related I dont think