Wireguard client can't access LAN

Stef4n · May 31, 2025, 12:47pm

New to Mikrotik – although I am a fan already.

My setup:
Ubuntu client connecting to my WAN via a DynDNS IP with Wireguard.
WAN Firewall/Router (Zyxel Flex200h) forwards the WG port udp:51820 to the Mikrotik hEX (latest model) via 1:1 NAT.
hEX local IP: 192.168.1.60 (on ether port-2)
local LAN: 192.168.1.0/24 | router 192.168.1.1
IP for Wireguard 192.168.77.1/24 | network 192.168.77.0
Wireguard client IP: 192.168.77.2/32 | client DNS: 192.168.77.1 (is this correct?)

The client connects fine, it can ping the 192.168.77.0/24 range.
But nothing in the 192.168.1.0/24 range.
Using Torch on the Wireguard profile I can see the ping packages going to the hEX and then nothing.

Right now I am trying to set this up for testing, but ultimately the Wireguard clients should be available only on the hEX via one of the other ports:
#1 Client connects to hEX via WG
#2 Client can communicate with machines on let’s say port 5 of the hEX.
#3 Clients should not reach the main LAN (192.168.1.0/24)

my config is:

# 2025-05-31 14:12:16 by RouterOS 7.19.1
# software id = BM8J-9LKD
#
# model = E50UG
# serial number = XXXXX
/interface bridge
add admin-mac=F4:1E:57:6A:D5:98 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] comment=alias1 name=1-WAN-PORT
/interface veth
add address=192.168.1.66/32 gateway=192.168.1.1 gateway6="" name=veth1
/interface wireguard
add comment="KIOSK WireGuard" listen-port=51820 mtu=1420 name=wireguard1
/disk
set usb1 media-interface=bridge media-sharing=yes smb-sharing=yes
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp_pool1 ranges=192.168.77.11-192.168.77.254
/routing bgp template
set default disabled=no routing-table=main
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=1-WAN-PORT list=WAN
add comment="WG LAN" interface=wireguard1 list=WAN
/interface ovpn-server server
add mac-address=FE:E9:A9:55:45:33 name=ovpn-server1
/interface wireguard peers
add allowed-address=0.0.0.0/0 client-address=192.168.77.2/32 client-dns=\
    192.168.77.1 interface=wireguard1 name=Kiosk-test-1 private-key=\
    "PRIV-KEY=" public-key=\
    "PUB-KEY/ZN+6Mz4="
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=192.168.77.1/24 comment="WG IP" interface=wireguard1 network=\
    192.168.77.0
/ip dhcp-client
add comment=defconf interface=bridge
# Interface not active
add interface=1-WAN-PORT
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/ip dhcp-server network
add address=192.168.77.0/24 dns-server=192.168.77.10 gateway=192.168.77.10
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="\F0\9F\9F\A1 KIOSK to KIOSK ADMIN" \
    dst-address=192.168.1.0/24 in-interface=wireguard1 log=yes src-address=\
    192.168.77.0/24
add action=accept chain=input comment="\F0\9F\9F\A1 KIOSK ADMIN to KIOSK" \
    dst-address=192.168.77.0/24 in-interface=wireguard1 log=yes src-address=\
    192.168.1.0/24
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat src-address=192.168.1.0/24
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/routing rule
add action=lookup disabled=no dst-address=::%ether2/128 src-address=\
    ::%wireguard1/128 table=main
/snmp
set contact="Mikrotik Contact" enabled=yes location=\
    "Mikrotik LOCATION 123 \C3\B6\C3\A4\C3\BC" trap-version=2
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name="MikroTik hEX"
/system logging
add disabled=yes topics=wireguard
/tool graphing interface
add interface=1-WAN-PORT
/tool graphing resource
add
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

anav · June 1, 2025, 12:44pm

Why are you giving an IP pool to WIreguard, no such entity required, remove!!
Why did you make the wireguard interface a member of the WAN interface list??
The allowed addresses in peers, is to identify REMOTE device requireing access to the local router, or REMOTE subnets that local users need to access
Therefore your peer settings are wrong and should only indicate 192.168.77.2
WHY DO YOu have dhcp client set to the bridge, the WAN is coming NOT on the bridge but etherport1…
So
a. either use dhcp client interface=1-WAN-PORT
OR
b. use an IP address (static WAN) on interface 1-WAN-PORT

AKA should be:
/ip dhcp-client
interface=1-WAN-PORT

What are the purposes of these two rules…??
add action=accept chain=input comment=“\F0\9F\9F\A1 KIOSK to KIOSK ADMIN”
dst-address=192.168.1.0/24 in-interface=wireguard1 log=yes src-address=
192.168.77.0/24
add action=accept chain=input comment=“\F0\9F\9F\A1 KIOSK ADMIN to KIOSK”
dst-address=192.168.77.0/24 in-interface=wireguard1 log=yes src-address=
192.168.1.0/24 ???
Where is in the input chain rule for the handshake on the wireguard port ???
What is the purpose of this sourcenat rule??
add action=masquerade chain=srcnat src-address=192.168.1.0/24 ??
If not using IPV6, should be disable and associated firewall address lists and firewall rules remvoed.