Wireguard behind CGNAT

RouterOS General
1

Can Wireguard work behind CGNAT and also one side being dynamic.

This first setup would be Mikrotik to Mikrotik with one side being a static public IP (server side) with the other side a Mikrotik router with a LTE interface (USB dongle) using CGNAT?

The second setup would also be Mikrotik to Mikrotik again the server would have static public IP and the other side a Mikrotik router but a dynamic public IP.

I currently have both these configs working using SSTP VPN with the client connecting into the server but I’m considering moving over to Wireguard.

2

Yes, that should work. However you will have to use a script to update peer’s endpoint-address when the ip address changes.

3

You need at least one external point to connect to.
Dynamic or static does not matter. Can be solved with cloud ip.

I have setup like that with Hex at home and SXTLTE in France using Wireguard.

4

Thanks.

5

Make the unit with the public IP the server.

The office has Starlink with CG NAT.
The warehouse has a typical dynamic public IP address.

VPN to the warehouse… And it links you back to the office.