Dear board members, I am struggling with wireguard client firewall settings. I am able to connect to the wireguard interface with my client (192.168.90.100) and access the router via the web interface (192.168.88.1 - allowed via a firewall rule). There is another device on the network of the 88 (“bridge1”) subnet, e.g. 192.168.88.2 but even if I allow this device explicitly in the firewall, analogue to the allow-wireguard-router rule, it does not work. The same problem appears with the dhcp subnet and devices on this (e.g. 192.168.89.250) - I cannot ping or access them.
In my wiregurad client config, I set the Permitted-Networks to 192.168.0.0/16 (just to be sure) - and the subnet-jump from 192.168.90.x to 88.x seems to work. Or maybe this only works because the “wireguard” interface is in the .90.x subnet and thus accessible…?
What am I missing here? Maybe someone can help me since I am struggling for a while now. Thanks a lot in advance.
(1) Why do you have your WAN address down twice ??? Oh I see the first one is disabled! Get rid of it, its garbage that creates confusion. /ip address add address=removed comment=defconf disabled=yes interface=wan-sfpplus1
network=removed
add address=192.168.88.1/22 interface=bridge1 network=192.168.88.0 add address=removed interface=wan-sfpplus1 network=removed
add address=192.168.90.10/24 interface=wireguard-vpn network=192.168.90.0
(2) why is your IP pool so big?? or is it a typo? Ah I see you have a /22 network, OKAY.
/ip pool
add name=dhcp ranges=192.168**.89**.2-192.168.91.254
(3) Dont keep garbage around remove the config line of wan on bridge ports!! add bridge=bridge1 disabled=yes interface=wan-sfpplus1
(4) I see you have one wireguard peer,
(5) Assuming you have fixed static public IP address (not private).
(6) Please fix your settings from ( never seen first line before self-invented?, regardless not required, do not put in net masks either ) /ip dhcp-server network
add address=0.0.0.0/24 dns-server=0.0.0.0 gateway=0.0.0.0 netmask=24
add address=192.168.88.0/22 dns-server=192.168.88.1 gateway=192.168.88.1
netmask=22
TO /ip dhcp-server network add address=192.168.88.0/22 dns-server=192.168.88.1 gateway=192.168.88.1
(7) Why are servers removed from /ip dns ( nothing hidden about 1.1.1.1, or 8.8.8.8 for example )
(8) Your firewall rules are woefully lacking for being an internet facing router, adjust to the following: /ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input comment=“wireguard handshake” dst-port=54896 protocol=udp
add action=accept chain=input comment=“accept LAN traffic only” in-interface-list=LAN
add action=drop chain=input comment=“Drop all else”
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
add action=fasttrack-connection chain=forward connection-state=established,related hw-offload=yes
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“wg to LAN” in-interface=wireguard-vpn dst-address=192.168.88.0/22
add action=accept chain=foward comment=“port forwarding” disabled =yes connection-nat-state=dstnat { enable if required or remove }
add action=drop chain=forward comment=“Drop all else”
If your WANIP is a static public IP then you could do this instead for sourcenat rule. /ip firewall nat
add action=src-nat chain=srcnat out-interface=wan-sfpplus1 to-address=static-WAN-IP
Thanks for your advice on my configuration. I adjusted it and implemented your suggestions.
Still, I can’t access the other subnet(s). I.e. a connection between my Wireguard client and the Mikrotik is possible. But not to any other device on the net, e.g. another client or AP.
I thought the “input” and “forward” part of the firewall that you also proposed should allow the WG client to access or even just ping the AP or any client in the 192.168.88.x network but it does not work. Is there some kind of additional interface separation I am missing? Thanks in advance.
I did the quick network diagram with draw.io, tell me if you need more information or if I can help clarify.
Would recommend upgrade firmware to at least 7.12.2 later.
Modify this rule. From add action=accept chain=input comment=“accept LAN traffic only” in-interface=bridge1
TO: add action=accept chain=input comment=“accept LAN traffic only” in-interface**-list=LAN**
REMOVE this rules its nonsensical. You are trying to control traffic through the router ( lan to lan, lan to wan, wan to lan) not in the proper forward chain, but in the input chain. which is traffic TO the router. add action=accept chain=input dst-address=192.168.88.0/22 in-interface=
wireguard-vpn
Still, I cannot ping or otherwise access a device in the “ether1” ethernet belonging to “bridge1” in the 192.168.88.x subnet from my Wireguard client in the 192.168.90.x subnet. I put a log in the firewall and can see that the ping attempts go into the appropriate forward rule of the firewall, the packets are not dropped there. So I assume it’s not a firewall problem?! I feel like I am missing something basic here.
When people get cute they run into issues…
For example why do you have such a huge /22 network for the main subnet??
In any case, I think thats where you run into problems, overlap maybe??
(1) Try changing wireguard IPaddress to 192.168.80.1/24 interface=wireguard-vpn network=192.168.80.0
( shouldnt make a difference but grasping at straws here ). Of course, adjust client IP as well ( 192.168.80.100/32 )
(2) Minor, Remove ether1 from list=LAN, its covered by the fact that list=LAN includes bridge1, and ether1 is listed as a bridge port.
(3) Why is this rule here. what purpose do you think it serves? add action=accept chain=input disabled=yes dst-address=192.168.88.0/22
in-interface=wireguard-vpn ???
(4) Why is this rule still in your config?? add action=accept chain=forward disabled=yes in-interface=wireguard-vpn
out-interface=bridge1
(5) Duplicate rule at end needs to be removed.
add action=accept chain=input connection-state=established,related,untracked
disabled=yes
Hi Jaclaz, yes that is true…
Keep in mind that I read thoroughly all the configs, everytime I read a disabled rule that has no potential purpose I BARF,
Its a distraction and a waste of my time, to read a cluttered config full of garbage.
The cleaner and leaner the config, its easier for all to spot errors and do so efficiently.
Therefore I care little that the last rule in the firewall rule, which was a duplicate, was also disabled.
I had to read the line, understand the line and then see that it was disabled… Once or twice fine, after a few 100 configs it gets old fast.
Its just good practice as well to keep a clean config, be it software coding or MT configs. Comments are good to let the reader know what you are doing as well.
Maybe this should be a request to Mikrotik, set an option in
/export
such as
hide-disabled=yes
or (possibly more in Mikrotik style)
show-not-enabled=no
I want to see the config, warts and all LOL and it may provide OP intentions thus I dont favour your approach.
I have no heartache with disabled rules that may have a purpose.
Case in point. ( planning on port forwarding later ) add action=accept chain=forward comment=“internet traffic” in-interface=list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat disabled=yes
add action=drop chain=forward comment=“Drop all else”
So maybe a Mikrotik code parser for Scite/Scintilla or Notepad++ or similar that can find entries with disabled=yes and renders them striken or bold or anyway highlighted …
Nope, just a first post process that eliminates 99% of the problems I see on initial posts and one of the points would be cleaning up disabled rules that have no purpose.
Thanks a lot for your help so far. Indeed the overlapping subnets posed a problem. I am now able to ping the hosts in the bridge1 subnets / also the dhcp clients from the wireguard client.
Still, I cannot access e.g. the web interface of the AP (in the DHCP subnet xxx.xxx.88.2 , see my graphics). I can ping it without a problem. Web access to the mikrotik router (x.x.88.1) works fine. Web interface access with a client in the network on-site works fine. Any ideas?
I just started another random web interface on one client in the dhcp subnet (x.x.89.250:3000) with a specific port and it works. SSH too. So I still don’t know why the AP web interface (x.x.88.2 http(s)) is not accessible but the major problem of not being able to access the subnets at all is solved I guess.
