Wireguard Access to LAN

atxishome · February 3, 2023, 10:36pm

Hello, I have a recent setup with a Wireguard VPN configured on a Mikrotik hAP. I am able to connect to the VPN and access the Mikrotik router at 192.168.88.1, but am unable to access or ping anything else on the LAN.

MT router is standard setup with 192.168.88.0/24
WG client is 10.10.105.3/32

Client WG config:

[Interface]
PrivateKey = xxxxx
Address = 10.10.105.3/24
DNS = 10.10.105.1, 192.168.88.1, 8.8.8.8

[Peer]
PublicKey = xxxxx
AllowedIPs = 0.0.0.0/0, 192.168.88.0/24
Endpoint = PublicIP:13231
PersistentKeepalive = 25

There are likely numerous duplicate rules in my MT config now that I’ve tried nearly every Internet write-up and forum post solution I can find, but I have not yet found a working solution.

# feb/03/2023 16:33:57 by RouterOS 7.7
# software id = JVXG-ZEAQ
#
# model = RB750Gr3
# serial number = D5030F3D0D4D
/interface bridge
add admin-mac=DC:2C:6E:7B:1C:8F auto-mac=no comment=defconf name=bridge
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=wg ranges=10.10.105.0/24
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/port
set 0 name=serial0
/routing table
add disabled=no fib name=wg
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=wireguard1 list=LAN
/interface wireguard peers
add allowed-address=10.10.105.3/32,192.168.88.0/24 interface=wireguard1 persistent-keepalive=25s public-key="xxxxx"
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
add address=10.10.105.1/24 interface=wireguard1 network=10.10.105.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=10.10.105.0/24 dns-server=10.10.105.1 gateway=10.10.105.1 netmask=24
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="allow WireGuard" dst-port=13231 protocol=udp
add action=accept chain=input comment="allow WireGuard traffic" src-address=10.10.105.0/24
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=accept chain=input comment="Accept WireGuard Traffic" dst-port=13231 protocol=udp src-address=0.0.0.0
add action=accept chain=forward dst-address=192.168.88.0/24 src-address=10.10.105.3 src-address-list=""
add action=accept chain=forward disabled=yes dst-address=10.10.105.0/30 src-address=192.168.88.0/24
add action=accept chain=forward dst-address=192.168.88.0/24 in-interface=wireguard1 out-interface=bridge
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip route
add disabled=no distance=1 dst-address=192.168.88.0/24 gateway=wireguard1 pref-src="" routing-table=main scope=30 suppress-hw-offload=no target-scope=10
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/routing rule
add action=lookup-only-in-table disabled=no dst-address=192.168.88.250/32 src-address=10.10.105.3/32 table=main
add action=lookup disabled=no dst-address=192.168.88.0/24 interface=wireguard1 src-address=10.10.105.3/32 table=main
/system clock
set time-zone-name=America/Chicago
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

I’ve been trying different solutions for weeks now. Please help!
Thank you

anav · February 5, 2023, 10:39pm

Overall you dont understand how to implement wireguard, some light reading for you ...... https://forum.mikrotik.com/viewtopic.php?t=182340
++++++++++++++++++++++
CLIENT
(1) Is the client another MT device or something else..................... If its an MT device you need to post the full config
/export file=anynameyouwish (minus router serial number, any public WANIP information and keys )

(2) Typically if its the client and not an MT device, then the WG address would be 10.10.105.3/32 ( you have it set up on its config with .3/24 ?? )

(3) WHY? The address 0.0.0.0/0 includes all addresses so don't need to define any others!!
AllowedIPs = 0.0.0.0/0, 192.168.88.0/24

SERVER
(4) WHY? One does not assign IP pools to wireguard subnet!!
add name=wg ranges=10.10.105.0/24

(5) WHY? Its clear you dont understand the purpose of allowed IPs........... you dont put your local LAN subnet here........... Also Keep alive is a client setting!!!
/interface wireguard peers
add allowed-address=10.10.105.3/32,192.168.88.0/24 interface=wireguard1 persistent-keepalive=25s public-key="xxxxx"

(6) WHY? Wireguard network does not get a dhcp-server network!
/ip dhcp-server network
add address=10.10.105.0/24 dns-server=10.10.105.1 gateway=10.10.105.1 netmask=24

(7) Order of firewall rules can be improved as well as content........ Why have duplicate rules for initial handshake to wireguard on input chain etc.........

(8) One doesnt need a route for wireguard in this case as you have a single client coming in and not a remote subnet. Your local subnet has nothing to do with wireguard in terms of routes.

(9) The routing rules are not required either.....

+++++++++++++++++++++++++++++++++++++++
Fixed config.... Show only changes.........

model = RB750Gr3

serial number = (removed for security reasons)

/ip pool { pool for WG removed }
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server { pool for wireguard removed }
add address-pool=default-dhcp interface=bridge name=defconf
/routing table { removed
/interface wireguard peers { local subnet removed }
add allowed-address=10.10.105.3/32 interface=wireguard1 public-key="xxxxx"
/ip dhcp-server network { dhcp-server network for WG removed }
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns static { removed left over from default settings }
/ip firewall filter { modified and order is critical and organization is good practice }
{Input Chain}
(Default rules)
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
(Admin Rules)
add action=accept chain=input comment="allow WireGuard" dst-port=13231 protocol=udp { allow initial handshake }
add action=accept chain=input comment="allow WireGuard traffic" in-interface=wireguard1 { To configure the router from Client Device }
add action=accept chain=input comment="allow admin" in-interface-list=LAN src-address-list=TRUSTED { to configure router by admin } *******
add action=accept chain=input comment="users to Router services" in-interface-list=LAN dst-port=53 protocol=tcp
add action=accept chain=input comment="users to Router services" in-interface-list=LAN dst-port=53 protocol=udp
add action=drop chain=input comment="Drop all else" { this goes in last so you don't lock yourself out of the router }
{Forward Chain}
(Default Rules)
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec { can remove if not doing ipsec }
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec { can remove if not doing ipsec }
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
(Admin Rules)
add action=accept chain=forward comment="allow internet" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="WG to LAN" in-interface=wireguard1 dst-address=192.168.88.0/24
add action=accept chain=forward comment="port forwarding" connection-nat-state=dstnat { optional: can remove if dont have servers }
add action=drop chain=forward comment="Drop all else"
/ip route { Route for wireguard removed**, created automatically for wg based on wg IP addres**s }
/routing rule { removed not required }

******* Where firewall address list = TRUSTED contains any Ip addresses the admin uses on the local lan subnet ex.
( based on setting static leases )
add ip-address=Admin_desktop-IP list=TRUSTED
add ip-address=Admin_laptop-IP_wired list=TRUSTED
add ip-address=Admin_laptop-IP_wifi list=TRUSTED
add ip-address=Admin_iphone/ipad IP list=TRUSTED

EoinSaad · June 21, 2023, 1:07pm

I achieved this by creating a firewall rule:

Chain=forward
In. Interface=[your wireguard]
Out. Interface=[your bridge]