Connection is established but I can ping only 192.168.77.1 and 192.168.88.1 from laptop. What is a problem? I’ve made a static route for 192.168.88.0/24 with 192.168.77.1 as gateway - no result. And tried to forward 88.0/24 to 77.0/24 and backward through firewall filter.
So the conclusion is you wish to be able to connect to your MT router (Server) from a mobile device (laptop) for the purposes of accessing devices on the LAN of the mikrotik??
Why two peer settings identical on Mikrotik??Why keep alive ???Why do you have the subnet on the MT LAN as an allowed IP ???
/interface wireguard peers
add allowed-address=192.168.77.0/24,192.168.88.0/24 interface=wireguard
persistent-keepalive=10s public-key=
“XXXXXXX”
add allowed-address=192.168.77.0/24,192.168.88.0/24 interface=wireguard
persistent-keepalive=10s public-key=
“XXXXXXX”
Not sure what you mean by static routes, but NOT required.
(1) Allowed IPs
This needs fixing
For allowed IPs at MT device,
all you need is 192.168.77.2/32
THis is already correct!!
At mobile laptop all you need for allowed IPs is
192.168.88.0/24, 192.168.77.0/24
(2) IP Routes
NO need to add any routes as the IP address for the wireguard interface ensures there is a route back to the mobile laptop dynamically
(DAC) dst-address=192.168.77.0/24 gwy=wireguard
(3) IP address structure… looks fine.
(4) Firewall rules. …look fine, or more accurately nothing I see that will prevent laptop to lan subnet traffic?
I think this is not required as your dhcp client settings are all done in pppoe??? /ip dhcp-client
add comment=defconf disabled=yes interface=ether1 use-peer-dns=no
If you want to be able to configure the router through the wireguard tunnel this is preventing such traffic.
add action=drop chain=input comment=“drop all not coming from LAN”
in-interface-list=!LAN
Two options, add another input chain rule from in-interface=wireguard dst-port=winbox src-address=192.168.77.2
The purpose is to reach media server via samba on MT side. I can reach it through LAN. So I added even two of these options 1. wireguard interface to LAN interface list and 2. input chain rule but without dst-port
And I still can’t even ping anything in LAN except 88.1 (MT)
DHCP-client was disabled it was for other stuff
Allowed IPs I’ve fixed too
Not quite sure what you mean by via samba?
In any case there is nothing blocking in the firewall, no rules needed to be added.
If you cannot ping the server its because you have windows firewall or some software firewall or even the samba server software itself blocking the pinging.
Make sure your target responds to pings from another subnet.
If you test from the same LAN-space as the target machine it might reply while pinging remotely it might not.
What is this target machine ? Windows ? Linux+Samba ? Use tcpdump on the target to see if anything arrives etc,etc,etc
Is there any solution here?
I’m having the same issue here, I want to access all computer under the LAN network the following services/port, but WireGuard client on my phone not able to access it.
-smb file sharing
-RDP
-VNC
-http
-https
Best to start a new thread with clear description of your current setup (a drawing will always be helpful), export of your config of Mikrotik router, and what you already tried, how it turned out etc etc.
Also provide export of config of your phone.
Concur, post complete config of MT server device /export (minus serial number and any public WANIP info) and phone settings minus key info and publicWANIP info.
Just to be clear CoNFIRM WITH YES OR NO
Requirements from phone connection.,
a. reach LAN devices ?
b. configure router ?
c. reach internet via MT?