WG-Tunnel / NAT / Masquerading - something's missing...

RouterOS General
1

Hey all,
for testing Purposes I setup a private WireGuard-Tunnel between two private DSL-Networks.
Both Home-Networks should share a common network (best case) or a private network on each site made accessible to the other.

The setup which is WORKING as following:

Site 1:
RB941-2nd (hAP-lite) - Local LAN (Internet-Gateway) 192.168.178.0/24 - WireGuard-Interface 10.10.10.1/24

Site 2:
RB941-2nd (hAP-lite) - Local LAN (Internet Gateway) 192.168.178.0/24 - WireGuard-Interface 10.10.10.2/24

WireGuard is Setup on both sites, is connecting and handshaking.
Allowed IPs for the peers are:
Site1: 10.10.10.2/24, 10.10.10.0/24
Site2: 10.10.10.1/24, 10.10.10.0/24
One can ping each other’s Interface from the other site. Now the addition:

Site 1:
Additional Subnet: 10.10.20.0/24 (LAN-Ports and WLAN with DHCP), BridgePort: 10.10.20.1
Site 2:
Additional Subnet 10.10.30.0/24 (LAN-Ports and WLAN with DHCP), BridgePort: 10.10.30.1

IP-Routes are set for each other:
Site1 is routing to site2’s additional subnet and vice-versa via Gateway “wireguard1”
BOTH wireguard-peers have the OWN and the OTHER site’s additional subnet ADDED in list of allowed IPs (as /24):
PING is working
One can access the routers web-Interface of the other site via HTTP-Request of the other LAN (e.g.: Access http://10.10.30.1 from site1 (192.168.178.xxx)

Now I’m stuck.
In order to get above working, I setup NAT MASQUERADE (srcnat) from each WIREGUARD-INTERFACE to the OTHER’S SITE additional Subnet.
(e.g. on Site 1: Dst.Address 10.10.30.0/24, OUT. Interface “wireguard1” → masquerade)
Without masquerading, the other site’s subnet is not reachable.

But: No Other hosts are reachable than the other’s gateway.
If I setup another service (e.g. a webserver) on site1 (10.10.20.2 - Port80, working for site1, reachable),
site2 is not able to connect the webserver on port80 (Site2 - 192.168.178.xxx → WG 10.10.10.2 → WG 10.10.10.1 → 10.10.20.1 → 10.10.20.2:80).
Also: No PING from Router’s Terminal to this host on the other site (Site2 - hAP-Lite Terminal - 10.10.10.2 → WG 10.10.10.1 → 10.10.20.1 → 10.10.20.2 ICMP timeout)
The other way round, same. Only the gateway of this subnet is reachable (10.10.xx.1) from the other site.

Am I stuck in a NAT (masquerading) clusterf…ck?
Why is it not possible (or just beyond my knowledge) of reaching the other’s subnet without NAT masquerading?
NO Firewall-Rules (except NAT masquerade) are in place at the moment. Just to eliminate errors on that side.

Somehow got lost in understanding what is happening, I fear.

ANY help appreciated in this case - I owe you a beer afterwards!

Best regards,
Martin!


EDIT: The connection I try to establish is listed in both routers as “TCP SYN” - so i guess it’s “halfway there”, but the way back is missing?

2

https://forum.mikrotik.com/viewtopic.php?p=908118

3

I’m no expert on RouterOS, but I use WG heavily, and might be able to help. Please post your full configs for both sites, and concisely what IPs need to be accessible across the tunnel.

4

And… that’s it? I’ll draw the diagram and collect the infos - if it’s the ticket for this ride…
Dont think me rude, I thought my structured text was clearly understandable for anyone dealing with RouterOS. Will be back with the information later then…

Regards

5

Does this make it clearer or worse then..?
WG-Tunnel.jpg
Edit: Replaced Diagram for better symbology (“VPN” → “WireGuard”)

6

Correct me if I’m wrong, but your end goal is to access 10.10.20.0/24 (Site1) from Site2 and 10.10.30.0/24 (Site2) from Site1?

Please post your full configurations from both sites. In Terminal:

/export hide-sensitive file=xxxxx

Make sure to remove public IPs, sensitive data, etc.

Without seeing your configs, I think you need to do routing instead of masquerades, but can provide better advice with configs.

7

themdrprof… you are dating yourself.

Hide sensitive is no longer valid in version 7 ( no longer needed).
Instead its more like

/export file=anynameyouwish ( minus router serial # and any public WANIP information)

To the op … why have both UDP port forwardings to the same port, I find it utterly confusing especially if both sides can initiate a tunnel.

++++++++++++++

As to your question mildly better, the problem is you have your head up the configuation so far, there is no clue tot he requirements, which is also part of that link which you either glossed over or ignored… Speak about the users and their requirements (including you as admin) WITHOUT referring to any config speak… wonderful exercise…

8

There is no need for NAT for sites to reach other across a wireguard tunnel. You only have to route the networks as any other internal network, just send the traffic to the ip of the wireguard interface on the other end. You just have to make sure that both routers know about all networks needing to route. Also, the allowed addresses if for all networks you want to allow to cross the tunnel from the other side.

9

That is generally correct, it depends if the two ends are both under the control of the individual and reachable so as to make the necessary changes…
Another typical scenario is when one is using a third party VPN service which provides one with a single IP and thus sourcnatting local users to that IP is necessary.

In any case, getting a clear set of requirements from the OP, without talk about the config will demonstrate a clear path to a successful config.

10

Timezone is Europe here - sorry for the late reply and thanks for the input so far. Will answer more precisely when fully booted and filled with coffee :slight_smile:

11

Hey anav - do they not have to be? Could it be I’m having a secondary tunnel, then?
I would love to have them both initiating a tunnel (doesn’t matter which site will initiate, as long as it’s active) since I found they sometimes do not initiate at all after a reboot (maybe lack of power on the hardware - hAP-lite(s)).


You’re right, of course. And I apologize for not providing this information in the first post. Sometimes, when you’re very close to a success in your config and think “Man… there must only be one tiny thing missing here…” - it is tempting to just post ahead instead of sharing all information. But yeah, it IS a wonderful exercise to run through the exports and try to find all sensitive data by reading the lines in plain apart from the GUI of WinBox.


That’s the goal. I also want to reach the other’s LAB-Net from 192.168.178.0/24 (FritzNet) - this is already setup in that router as a static route to the own internal MikroTik (as static routes to 10.10.20.0/24 and 10.10.30.0/24 → GW 192.168.178.xxx (IP of internal MikroTik-Device holding the Tunnel)).
We do not and cannot connect each other’s “FritzNet” for security reasons. Also, the internal IP-Pool is the same for those networks on each site and we do not like to modify this atm. So this is not purely site-2-site WireGuard, but offering a LAB-Subnet to each other’s site which is also reachable internally of course. The “FritzNet” of every site should be able to REACH all subnets, at best, excluding the other site’s “FritzNet”.

Attached are the exports of SITE1 and SITE2 as TXT-Files (Admin, PLEASE delete or help if I forgot sensitive Data, did it best I could).
As you can see, I pushed forward with some firewall-rules which SHOULD not interfer the routing.

THANKS so much for any input - appreciated!!

Edit: Config-Files were in this post - deleted after review from anav - thx!

12

Touche anav! Correct as always. I’m actually doing such a thing on one end of a tunnel I run.

13

excellent all explained here - https://forum.mikrotik.com/viewtopic.php?t=182340

14

( no nothing wrong with same port, just bloody confusing for me LOL)

What throws me off is the FRITZ stuff. So I understand that the Fritz is the ISP router? It gets a public IP from the ISP modem?
Why do they both have the same private IP structure…192.168.178.0/24…

In any case really dont care if two things are true…
Both sites have a reachable IP and second you can go from anywhere on the internet… and reach the haps…

publicIP_Site1:wireguard-port_XXXXXXX and the traffic will reach the hap lite on its input chain!!
OR
publicIP_Site2:wireguard-port_YYYYYY and the traffic will reach the hap lite on its input chain!!

IF so yes recommend you change UDP port on site two to 14231, and thus we can work with that for any side to initiate the tunnel.

15

Okay, anav - WHY did I not come there before? (This is a question, you won’t need to answer, it’s pointed at ME)


Defaults. Thats’s the answer.
In Europe (Germany) Internet-Gateways of AVM (Called: “Fritz!Box”) are very common and honestly the best choice one could make for stability, simplicity and number of features.
What they do: Standard internal Subnet is 192.168.178.0/24 with a guest network of 192.168.179.0/24 not reaching each other. They tend to be secure “out-of-the-box”, so most household-DSL-Networks running on this hardware. Modem is included, so literally plug’n’play.

Changing subnets afterwards is possible - but annoying. Every setting / Port-Forward / Child-safety / etc. needs to be reconfigured IF you get your LAN up and your clients running with the new IPs. It’s just a setting, no sweat, but some customers complain about internet not being reachable afterwards or other quirks they did not have before.

Since we do not intend to see each others’ PCs, mobile phones, Smart-TVs, etc - it’s okay to bypass this subnet and only get access to the ones our MikroTik-Devices span.
We’re talking about LAB-Environments, LoRaWAN and yes, gameservers for the kids :slight_smile:

Just one question:
Did somebody / you review the config.txt - Files I posted? Is there anything which jumped to your eyes as an error resulting in the original behaviour I stated above?

Best regards!

16

Site1:
(1) Allowed IP peers setup
Its for two cases.
a. destination addresses for local traffic entering the tunnel
b. incoming remote addresses exiting the tunnel
Also one identifies the other sites by their wireguard IP address. (typically only the server uses /32 addresses but in your case both sides will)

Just change this… to
/interface wireguard peers
add allowed-address=10.10.10**.2/32,1**,10.10.30.0/24 comment=
WireGuard-Site2 endpoint-address=(hidden dyndns of site2) endpoint-port=14231
interface=wireguard1 persistent-keepalive=25s public-key=
“(hidden)”

(2) This rule is not required - serves no purpose.
add action=accept chain=input log=yes log-prefix=13231 protocol=udp
src-port=13231

(3) The firewall rules are a big hairy mess IMHO, and I would simplify and focus on required traffic and skip all the other noise.

(4) You rules are partially there,
From
add action=accept chain=forward comment=
“WireGuard-Ruleset: ALLOW FenceNet – DROP FritzNet access”
dst-address-list=NET-FenceNet log=yes log-prefix=WG-Interconnect
src-address-list=NET-WireGuard

TO:add action=accept chain=forward src-address=10.10.30.0/24 in-interface=wireguard1 dst-address=10.10.20.0/24 { exiting the tunnel }
add action=accept chain=forward dst-address=10.10.30.0/24 out-interface=wireguard1 src-address=10.10.20.0/24 { entering the tunnel }

In this manner the local subnet can reach the remote subnet through wireguard and vice versa.

(Also get rid of this rule…
add action=drop chain=forward dst-address-list=NET-FritzNet src-address-list=
NET-WireGuard)


(and these two rules…
_add action=accept chain=forward comment=
“WireGuard - Interconnectivity - Site2 ↔ Site1” dst-address-list=
NET-Site2 src-address-list=NET-FritzNet
add action=accept chain=forward comment=“----------> incoming”
dst-address-list=NET-FenceNet src-address-list=NET-Site_2

(5) Why is this required…???
/ip firewall nat
add action=masquerade chain=srcnat dst-address-list=NET-Site1 log-prefix=
!Mask_ out-interface=wireguard1

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

I get the feeling I dont understand what you are trying to accomplish…

17

Site 2
(1) change listening port to 14321.

(2) TO:
/interface wireguard peers
add allowed-address=10.10.10.1/32,10.10.20.0/24 comment=
WireGuard-Site1 endpoint-address=(hidden dyndns-name of Site1) endpoint-port=
13231 interface=wireguard1 persistent-keepalive=25s public-key=
“(hidden)”


(3) Probably same issues with firewall as site A, but hurts my eyes to look at the mess.

(4) Why two addresses for local subnet…??
add address=10.10.30.1/24 interface=NET-WG-Site2 network=10.10.30.0
add address=10.10.30.9/24 disabled=yes interface=NET-WG-Site2 network=
10.10.30.0

18

anav - THANKS!

Just to explain WHY you see so much rules sitting there with “forward → accept”:
I tried to narrow down the traffic, espacially that one coming towards my MikroTik. As you might guess, Site1 is my own MT-Lite, which is accessible even if I mess up.
I needed to know / understand where the traffic gets stuck, so I created some (as you correctly stated) unnessesary rules just to watch where traffic counters stop.

Also, this device is for testing loads of things like how to fence a game- or webserver, how to isolate things like some suspicious Reolink-Cameras which, every time they woke up, did a DHCP-Request which “offer” they did not care about (My FritzBox (DSL-Router) went mad because it ran out of IP-Addresses…).

Those MikroTiks are running internally, firewalled through the DSL-Router - only port exposed is WireGuard. So everything you see at the firewall is for cutting my own devices against each other.

BUT:
I honestly thank you for having a look at the config(s) - learning and understanding is what I’m here for!
I owe you a beer (as stated in the beginning)- preferably a German one - just give me a hint, when nearby :wink: I have a good feeling now, getting this sorted!

19

Well First I have to get to Europe but the good thing is with all the booze promised I can sleep in the street as AirBnBs are bloody expensive.