@Larsa … I ABSOLUTLY agree with you 100% 
…
…
Forgot to mention that there are plenty of real world scenarios that can be found in stackexchange, serverfault etc, where wg is used in combination with netfilter/nftables which might give some guidance on how Ros is organising things behind the scenes.
Try google for example “linux wireguard lan-to-lan routing using nat” or “linux wireguard lan-to-lan multiple networks” …
Goodness Gracious Great Balls of Fire … @anav – The configuration Guru is back and kicking …
Just to make sure that you understand, I’m not against doing things differently, pushing limits, even some abuse. It can be fun, and if it’s for good cause and has some clear benefits, why not, I’m all for it. I will be the first one to commend you, if you come up with such thing. The more twisted (but useful!), the better. Something like @sindy’s magic loop, it’s horrible and makes me sick every time I see it, but at the same time it’s beautiful. Problem with this invention of yours is that it’s nothing like that. It doesn’t do anything not otherwise possible, doesn’t make anything easier to do or understand (quite the opposite), nothing. I feel bad for every beginner who will try to use it, because it will bring only confusion with no benefits.
So @mozerd here makes some copy-pasta from that github link which mostly covers stuff used by wg-quick which does not exist in RouterOS, and some config files which again do not exist in RouterOS, facts thay only confuses people expecting RouterOS stuff even more (this is the MikroTik forum, still), gives no credit to the guy he stole this from and has nothing personal to say about it
And has some serious issues understanding basic networking.
What am I missing? What is the value in these topics opened recently?
…
@anav
Very sorry but I can no longer recommend your link because I absolutely disagree with your wg approach …..
…
Main error is that you got caught in that retarded idea (your “(2) IP ADDRESS FOR IP ROUTES”) and refuse to understand this simple fact. It’s broken beyond repair (and by design). You can’t save it. But you keep piling on this nonsense and making it even worse (surprisingly, it’s still possible). At least your initial version worked. Current one won’t even do that.
…
You’re cheating, now you made it half-right. The part that wouldn’t work at all was:
/ip address
add address=10.10.5.45/32 interface=wg-local network=10.10.5.0
add address=10.10.5.48/32 interface=wg-local network=10.10.5.0
And what you posted now:
Q1) As it is, 50% between yes and no. Assuming that 40/50 was typo and it should be 50 everywhere, the answer would be yes. But 50% would be still wrong.
Q2/Q3) Yes, you will get routes, but that’s not the point.
Once more (and possibly for the last time):
192.168.45.1/24 is correct, because it’s local subnet on WG interface. Clients (192.168.45.2/32, 192.168.45.230/32) are in this local subnet. That’s how it’s done.
192.168.50.1/24 is wrong, because 192.168.50.0/24 is remote subnet, it belongs somewhere else, no 192.168.50.x address should be on your router, they all should be in remote LAN, because that’s where this subnet is. You want route to this subnet, so just add route. What you do doesn’t make any sense. If you want one thing, why would you add another thing that gets you the thing you want, intead of adding directly what you want? Plus it breaks things. What if you want to connect to remote 192.168.50.1? You can’t, you will connect to your router, because your router thinks it owns this address.
…
And for a moment I dared to think that you finally understood…
Two things:
-
Why? If you want route and it’s simple and easy to add route, why do you add address (remember, you hate addresses) in order to get route? It’s like if you want egg for breakfast. You can either reach in fridge and simply take an egg that’s sitting there, or you can go out, fetch a hen, let it lay egg, then let hen run around and shit everywhere. If you remember that you just wanted egg (and you had it available), isn’t it better to leave out hen?
-
It doesn’t work. Let’s say I’m peer 3 and this 192.168.50.0/24 is mine. Aside from you stealing my address, I need to be able to access your network from all 192.168.50.x addresses (x = 1-254). You can’t put any of them on your router, because it will break access from mine.
It’s not MT’s mistake, it’s your mistake. It’s like if you make your whole firewall:
/ip firewall filter
add chain=input action=drop
and you lock yourself out. MT allowed this to happen, but it’s your fault.
…
You missed one post.
…
I will leave all wg assistance to others then.