Wireguard - After second client added, first client cannot connect until I change key

RouterOS Security
1

I have a CCR2004-16G-2S+ as my homelab’s core router. With that, I use Wireguard for my VPN (after Rocky Linux 10 broke my ocserv VPN due to EPEL issues).

The problem is, when I add a second client and public key to a Wireguard interface, the first one is not able to connect. This is even when the second client isn’t connected and I didn’t replace the public keys. Heck, if I remove the second key the first client key still refuses to connect. Each key/client has a different IP, but I’m sharing the MT-side IP.

The only thing which works is after removing the second key is rotating the first client’s public key.

Is there a workaround? Am I better off using OpenVPN? Should I have multiple Wireguard interfaces/ports?

My WAN is technically a L2TP tunnel for a public IP because I use an unlocked T-Mobile US 5G SIM (Calyx SIM) as my internet (that in NYC) for upload speeds alone, but 5G uses CGNAT and I lack fiber or upgraded DOCSIS. Wireguard’s MTU is 1280 due to it being inside L2TP. Client is normally my Fedora HP OmniBook Ultra, but I want my MacBook and Pixel with VPNs too.

2

Show us what you got! (If you don't get the Rick & Morty reference, this means to export your config and post it.)

The most common error that leads to this is having overlapping allowed-ip fields for your clients. They should generally not be specified as 0.0.0.0/0, but as cli.ent.ip.addr/32

3

Check the content of the Allowed Address field of the peers on the router. Don't put overlapping address ranges in there for peers of the same WG interface.

For example if one peer has 10.10.10.5/24 and one has 10.10.10.7/24, then they overlap, both are actually 10.10.10.0/24. Same if you put 10.10.10.5/24 and 10.10.10.7/32 because the later is contained inside the other subnet. If a peer has 0.0.0.0/0 then it even overlaps all other subnets.

If one has 10.10.10.5/32 and one has 10.10.10.7/32 (note the /32 prefix length) then they are distinct address ranges and will not have problem.

TLDR: fix your prefix length.

1 Like