Now i can ping across the tunnel on both sides, i can reach the server from mikrotik terminal and i can reach the client from the server. Server is running on Ubuntu btw.
But when i do the last step to route the traffic from my local subnets across the tunnel, like described here:
Third - Then make the associated route rule
src-address=192.168.50.0/24
Action=Lookup-only-in-table
Table=useWG
Note: If the admin wants the users to be able to access internet locally if WG is down then use ACTION=Lookup
Note:2 If you have multiple peers going through the same tunnel/interface then you may need multiple such routes.
After that i got no internet connection. Im guessing there is some more routing necessary?
I will guess that you are sending out to a wireguard third party vpn provider and you want
one IP on your network to use the internet of the third party…
Hopefully you put in fake numbers for the PEER settings!!
Lets fix up your IP routes… they look okay I think… but not sure what that second 0.0.0.0 is doing there and missing the construction of the table…
EDIT: Found it you have the rule!!
So to be clear your IP routes should only contain two entries
dst-address=0.0.0.0/0 gwy= ISP_gwy-IP routing-table=main
dst-address=0.0.0.0/0 gwy=wireguard1 routing-table=useWG
+++++++++++++++++++++++++++++++++++++++++++
In summary, all looks good except I dont see where you have IP DHCP client and thus the primary route for traffic going out through the ISP.
I’ve got the port 51820 forwarded on my ISP router to the fixed IP of the MikroTik .
The server side is running on a cloud server on Ubuntu.
I’ve got two identical servers running with OpenWRT devices and they are working.
I’m going to try out your suggestions now.
Also im going to change the keys after i got this sorted out of course
Hi there, well in the case of wireguard if the initial connection is being established from your local MT to the CLOUD instance, there would be no need to forward port from your ISP router to the MT device.
Okay what are you trying to reach at or through the UBUNTU SERVERs??
If you are trying to reach subnets there, then 0.0.0.0/0 is not that useful, instead put in the actual subnets 192.168.20.0/24, 192.168.40.0/24 etc…
The IP route for this is simple
dst-address=192.168.20.0/24 gwy=wg table=main
dst-address=192.168.40.0/24 gwy=wg table=main
Depending upon your firewall rules (assuming you use drop rule at end of forward chain)
add chain=forward action=accept src-address=local subnet out-interface=WG
If you are trying to reach subnets AND the internet, then 0.0.0.0/0 covers both subnets and internet,
In this case then you need to create a table and force subnet traffic out the wg interface.
however at the ubuntu server you will need to use firewall rules to separate the traffic based on what is allowed.
Suggesting dont use the same subnet for both accessing subnet on the other side and internet or use firewall rules at ubuntu side to filter traffic accordingly,
I don’t really need to reach the subnets but i need to reach the internet. The purpose of the wg-tunnel is to give my device a fixed IP and to forward port TCP 44158.
I know that i’m missing the rule for port forwarding on the MT but first i’m trying to get internet access running.
I added ether2 to LAN interface list and also tried to remove the masquerade rule but that sadly didn’t change anything. https://www.youtube.com/watch?v=2pFcVRaoscE&t=166s is where i got that rule from.
The only difference to that video is that i’m behind an ISP router so i think that i am missing something.
I have two identical servers running with other devices so i think the firewall rules on the server should be fine.
My firewall config on the server looks like this if it’s helpful:
Generated by iptables-save v1.8.7 on Tue Feb 8 02:31:58 2022
*filter
:INPUT ACCEPT [108546:15562238]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [101737:11792733]
-A INPUT -i enp1s0 -p udp -m udp --dport 51820 -j ACCEPT
-A INPUT -i wg0 -j ACCEPT
-A FORWARD -i wg0 -o enp1s0 -j ACCEPT
-A FORWARD -i enp1s0 -o wg0 -j ACCEPT
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1240
-A FORWARD -i wg0 -j ACCEPT
-A FORWARD -i enp1s0 -o wg0 -p tcp -m tcp --dport 44158 --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -i enp1s0 -o wg0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
COMMIT
Completed on Tue Feb 8 02:31:58 2022
Generated by iptables-save v1.8.7 on Tue Feb 8 02:31:58 2022
