Wireguard Client connection issue - both sides based on Mikrotik, same ISP

RouterOS General
1

Dear All,

Or should I say Dear Anav already :slight_smile:. I am facing a very strange issue with the Wireguard client connection that works perfectly well from virtually anywhere but the designated desired neighbours local area network.

I have three separate WG interfaces set up (used to have two only and tried to create just another peer for my “WG-External” for my neighbour):

WG-Internal - rather self explanitory used for my household needs
WG-External - to share the net traffic with my family without access to the LAN resources
WG-TheNetwork - a copy of the External, set up for the listen port 51820 to see if the ISP is not blocking this port

Like stated above, I started this journey by simply creating a new peer called “Lukaszek” for WG-External.

I was able to test it out with flying colors using both my LAN connection (so connected from within the same network the WG “Server” is located in) and externally using my 5G mobile data plan - i thought this would be it, all good to go.

I couldnt be further form the truth. I gave out the credentials to my neighbour and he was never able to connect, not even to establish the handshake.

Both networks are Mikrotik based, we do share the same ISP with two separate public IPs handed out by the ISP. When i go to any other neighbour to use their LAN for testing both on Mikrotik and non-Mikrotik based hardware everything works flawlessly. Chat GPT ran out of ideas after comparing the configs all over again - so maybe some of you can pin point some config issue that I missed ruling out any possibility that our ISP is somehow blocking any UDP traffic.

Here is the WG server config file (my LAN):


# 2026-01-13 00:00:49 by RouterOS 7.20.6
# software id = 1P5S-ZVHM
#
# model = RB5009UG+S+
# serial number = 
/interface bridge
add admin-mac=78:9A:18:96:2E:20 auto-mac=no comment=LAN name=Bridge_Local port-cost-mode=short
/interface wireguard
add listen-port=13232 mtu=1420 name=WG-External
add listen-port=13231 mtu=1420 name=WG-Internal
add listen-port=51820 mtu=1420 name=WG-TheNetwork
/interface vlan
add interface=Bridge_Local name=IoT vlan-id=30
add interface=ether1 name=LAN_ vlan-id=20
add interface=Bridge_Local name=Management vlan-id=10
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi channel
add band=2ghz-ax disabled=no name="2.4Ghz AX upstairs" width=20mhz
add band=5ghz-ax disabled=no frequency=5300 name="5Ghz AX downstairs" width=20/40/80mhz
add band=2ghz-ax disabled=no name="2.4Ghz AX downstairs" width=20mhz
add band=5ghz-ax disabled=no name="5Ghz AX upstairs" width=20/40/80mhz
add band=2ghz-ax disabled=no name=IoT_band width=20mhz
/interface wifi datapath
add bridge=Bridge_Local disabled=no name=datapath1
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disable-pmkid=yes disabled=no encryption="" ft=yes ft-over-ds=yes name=Main wps=disable
add authentication-types=wpa2-psk disable-pmkid=yes disabled=no ft=yes ft-over-ds=yes name=IoT wps=disable
/interface wifi configuration
add comment="TBA with future supported APs" country=Poland datapath=datapath1 disabled=no manager=capsman mode=ap name="Main 6Ghz" security=Main ssid="Swiat Dysku"
/interface wifi steering
add disabled=no name=Main_Steer neighbor-group="dynamic-Swiat Dysku-5740aa3f" rrm=yes wnm=yes
add disabled=no name=IoT_Steer neighbor-group=dynamic-Calypso-a8f8c3f3 rrm=yes wnm=yes
/interface wifi configuration
add channel="5Ghz AX downstairs" comment="Main home wireless network" country=Poland datapath=datapath1 disabled=no mode=ap name="Main 5Ghz" security=Main ssid="Swiat Dysku" steering=\
    Main_Steer
add channel="2.4Ghz AX downstairs" comment="Main home wireless network" country=Poland datapath=datapath1 disabled=no mode=ap name="Main 2.4Ghz" security=Main ssid="Swiat Dysku" steering=\
    Main_Steer
add channel=IoT_band comment="Dedicated wireless network for IoT devices" country=Poland datapath=datapath1 disabled=no mode=ap name=IoT security=IoT ssid=Calypso steering=IoT_Steer
/interface wifi
add channel.frequency=5300 configuration="Main 5Ghz" configuration.mode=ap disabled=no name=cap-wifi1 radio-mac=F4:1E:57:12:8C:37
# operated by CAP F4:1E:57:0B:28:14%Bridge_Local, traffic processing on CAP
add channel.frequency=5300 configuration="Main 5Ghz" configuration.mode=ap disabled=no name=cap-wifi2 radio-mac=F4:1E:57:0B:28:16
# operated by CAP F4:1E:57:0B:28:14%Bridge_Local, traffic processing on CAP
add configuration="Main 2.4Ghz" configuration.mode=ap disabled=no name=cap-wifi3 radio-mac=F4:1E:57:0B:28:17
# operated by CAP F4:1E:57:0B:28:14%Bridge_Local, traffic processing on CAP
add configuration=IoT configuration.mode=ap disabled=no mac-address=F6:1E:57:0B:28:17 master-interface=cap-wifi3 name=cap-wifi3-virtual1
add configuration="Main 2.4Ghz" configuration.mode=ap disabled=no name=cap-wifi4 radio-mac=F4:1E:57:12:8C:38
add configuration=IoT configuration.mode=ap disabled=no mac-address=F6:1E:57:12:8C:38 master-interface=cap-wifi4 name=cap-wifi4-virtual1
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.1.10-192.168.1.254
add name=lan_pool ranges=10.10.20.2-10.10.20.254
add name=management_pool ranges=10.10.10.2-10.10.10.254
add name=iot_pool ranges=10.10.30.2-10.10.30.254
/ip dhcp-server
add address-pool=dhcp disabled=yes interface=Bridge_Local lease-time=10m name=defconf
add address-pool=dhcp interface=Bridge_Local lease-time=1d name=dhcp1
add address-pool=management_pool interface=Management lease-time=1d name=management_dhcp
add address-pool=lan_pool interface=LAN_ lease-time=1d name=lan_dhcp
add address-pool=iot_pool interface=IoT lease-time=1d name=iot_dhcp
/ip smb users
set [ find default=yes ] disabled=yes
/interface bridge port
add bridge=Bridge_Local interface=ether2 internal-path-cost=10 path-cost=10
add bridge=Bridge_Local interface=ether3 internal-path-cost=10 path-cost=10
add bridge=Bridge_Local interface=ether4 internal-path-cost=10 path-cost=10
add bridge=Bridge_Local interface=ether5 internal-path-cost=10 path-cost=10
add bridge=Bridge_Local interface=ether6 internal-path-cost=10 path-cost=10
add bridge=Bridge_Local interface=ether8 internal-path-cost=10 path-cost=10
add bridge=Bridge_Local disabled=yes interface=ether1 internal-path-cost=10 path-cost=10
add bridge=Bridge_Local interface=sfp-sfpplus1 internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=all lan-interface-list=LAN
/interface list member
add interface=Bridge_Local list=LAN
add interface=ether1 list=WAN
add interface=WG-Internal list=LAN
/interface ovpn-server server
add mac-address=FE:07:7F:11:5C:7D name=ovpn-server1
/interface wifi cap
set discovery-interfaces=Bridge_Local slaves-datapath=datapath1
/interface wifi capsman
set ca-certificate=auto certificate=auto enabled=yes interfaces=Bridge_Local package-path="" require-peer-certificate=no upgrade-policy=none
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration="Main 5Ghz" supported-bands=5ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration="Main 2.4Ghz" slave-configurations=IoT supported-bands=2ghz-ax
/interface wireguard peers
add allowed-address=192.168.100.2/32 client-address=192.168.100.2/32 client-dns=1.1.1.1,8.8.8.8 client-endpoint=secret.sn.mynetname.net interface=WG-Internal name="Wojtek - Smartfon" \
    private-key="secret" public-key="secret" responder=yes
add allowed-address=192.168.100.3/32 client-address=192.168.100.3/32 client-dns=1.1.1.1,8.8.8.8 client-endpoint=secret.sn.mynetname.net interface=WG-Internal name=\
    "Wojtek - Laptop Prywatny" private-key="" public-key="" responder=yes
add allowed-address=192.168.100.4/32 client-address=192.168.100.4/32 client-dns=1.1.1.1,8.8.8.8 client-endpoint=secret.sn.mynetname.net interface=WG-Internal name=\
    "Wojtek - Laptop Sluzbowy" private-key="" public-key="" responder=yes
add allowed-address=192.168.100.5/32 client-address=192.168.100.5/32 client-dns=1.1.1.1,8.8.8.8 client-endpoint=secret.sn.mynetname.net interface=WG-Internal name="Tablet - Tab S9" \
    private-key="" public-key="" responder=yes
add allowed-address=192.168.100.6/32 client-address=192.168.100.6/32 client-dns=1.1.1.1,8.8.8.8 client-endpoint=secret.sn.mynetname.net interface=WG-Internal name="Ania - Smartfon" \
    private-key="" public-key="" responder=yes
add allowed-address=192.168.100.7/32 client-address=192.168.100.7/32 client-dns=1.1.1.1,8.8.8.8 client-endpoint=secret.sn.mynetname.net interface=WG-Internal name=\
    "Ania - Laptop Sluzbowy" private-key="" public-key="" responder=yes
add allowed-address=192.168.100.8/32 client-address=192.168.100.8/32 client-dns=1.1.1.1,8.8.8.8 client-endpoint=secret.sn.mynetname.net interface=WG-Internal name=\
    "Ania - Laptop Prywatny" private-key="" public-key="" responder=yes
add allowed-address=192.168.200.2/32 client-address=192.168.200.2/32 client-dns=1.1.1.1,8.8.8.8 client-endpoint=secret.sn.mynetname.net interface=WG-External name=Orzeszkowej \
    private-key="" public-key="" responder=yes
add allowed-address=192.168.100.50/32 client-address=192.168.100.50/32 client-dns=1.1.1.1,8.8.8.8 client-endpoint=secret.sn.mynetname.net interface=WG-Internal name="Rodzice Internal" \
    private-key=" public-key="" responder=yes
add allowed-address=192.168.220.2/32 client-address=192.168.220.2/32 client-dns=1.1.1.1,8.8.8.8 client-endpoint=secret.sn.mynetname.net interface=WG-TheNetwork name=Lukaszek \
    private-key="" public-key="" responder=yes
/ip address
add address=192.168.1.1/24 interface=Bridge_Local network=192.168.1.0
add address=192.168.100.1/24 interface=WG-Internal network=192.168.100.0
add address=192.168.200.1/24 interface=WG-External network=192.168.200.0
add address=10.10.10.1/24 interface=Management network=10.10.10.0
add address=10.10.20.1/24 interface=LAN_ network=10.10.20.0
add address=10.10.30.1/24 interface=IoT network=10.10.30.0
add address=192.168.220.1/24 interface=WG-TheNetwork network=192.168.220.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=1m
/ip dhcp-client
add disabled=yes interface=Bridge_Local
# Interface not active
add interface=sfp-sfpplus1
add interface=ether1
/ip dhcp-server lease
add address=192.168.1.18 client-id=1:a4:d7:3c:15:9e:f0 mac-address=A4:D7:3C:15:9E:F0 server=dhcp1
add address=192.168.1.5 client-id=1:f4:1e:57:b:28:14 mac-address=F4:1E:57:0B:28:14 server=dhcp1
add address=192.168.1.44 mac-address=4C:EB:D6:D3:46:FD server=dhcp1
add address=192.168.1.7 client-id=1:84:78:48:68:93:81 mac-address=84:78:48:68:93:81 server=dhcp1
add address=192.168.1.4 client-id=1:c8:7f:54:44:bb:90 mac-address=C8:7F:54:44:BB:90 server=dhcp1
add address=192.168.1.3 client-id=1:c8:7f:54:44:c3:30 mac-address=C8:7F:54:44:C3:30 server=dhcp1
add address=192.168.1.6 client-id=1:84:78:48:10:b2:10 mac-address=84:78:48:10:B2:10 server=dhcp1
add address=192.168.1.8 client-id=1:84:78:48:6a:ad:7e mac-address=84:78:48:6A:AD:7E server=dhcp1
/ip dhcp-server network
add address=0.0.0.0/24 comment=defconf dns-server=0.0.0.0 gateway=0.0.0.0 netmask=24
add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.1.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment="allow WireGuard traffic" src-address=192.168.100.0/24
add action=accept chain=input comment="allow WireGuard traffic" src-address=192.168.200.0/24
add action=accept chain=input comment="allow WireGuard traffic" src-address=192.168.220.0/24
add action=accept chain=input comment="WireGuard passthrough" dst-port=13231,13232,51820 protocol=udp
add action=accept chain=input comment="Accept established,related,untracked" connection-state=established,related,untracked
add action=accept chain=input comment="CAPsMAN connectivity" dst-port=5246,5247 protocol=udp
add action=drop chain=input comment="Drop invalid traffic" connection-state=invalid
add action=accept chain=input comment="Allow PING" protocol=icmp
add action=accept chain=input comment="Accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="[WinBox]Allow IP connection from LAN" dst-port=8291 protocol=tcp src-address=192.168.1.0/24 src-port=""
add action=accept chain=input comment="[WinBox]Allow IP connection from WG Internal" dst-port=8291 protocol=tcp src-address=192.168.100.2-192.168.100.5 src-port=""
add action=drop chain=input comment="Drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="Accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="Accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=Fasttrack connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="Accept established,related, untracked" connection-state=established,related,untracked
add action=accept chain=forward comment="Allow LAN to WAN connection" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="Allow WG-External to access WAN" in-interface=WG-External out-interface-list=WAN
add action=accept chain=forward comment="Allow WG-External to access WAN" in-interface=WG-TheNetwork out-interface-list=WAN
add action=accept chain=forward comment="Allow WG-Internal to talk to LAN" in-interface=WG-Internal out-interface-list=LAN
add action=drop chain=forward comment="Disallow WG-External to talk to LAN" in-interface=WG-External out-interface-list=LAN
add action=drop chain=forward comment="Disallow WG-External to talk to LAN" in-interface=WG-TheNetwork out-interface-list=LAN
add action=accept chain=forward comment="port forwarding" connection-nat-state=dstnat
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat comment="Basic NAT" ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment=Hairpin dst-address=!192.168.1.1 src-address=192.168.1.0/24
add action=masquerade chain=srcnat comment="WG Internal - Hairpin" disabled=yes dst-address=!192.168.100.0/24 src-address=192.168.100.0/24
add action=masquerade chain=srcnat comment="WG External - Hairpin" disabled=yes dst-address=!192.168.200.0/24 src-address=192.168.200.0/24
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip service
set ftp address=192.168.1.0/24,192.168.100.0/24
set telnet disabled=yes
set www disabled=yes
set ssh address=192.168.1.0/24,192.168.100.0/24 port=1308
set winbox address=192.168.1.0/24,192.168.100.0/24
set api disabled=yes
set api-ssl disabled=yes
/ip smb shares
set [ find default=yes ] directory=/pub
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/system clock
set time-zone-name=Europe/Warsaw
/system identity
set name=Templar
/tool e-mail
set from=Templar port=587 server=smtp.gmail.com tls=yes user=@gmail.com
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

and here is the neighbour’s LAN config, very liberal firewall rules just to set all of the UDP traffic free:

# 2026-01-12 21:37:13 by RouterOS 7.20.6
# software id = 
#
# model = C53UiG+5HPaxD2HPaxD
# serial number = 
/interface bridge
add admin-mac=F4:1E:57:4E:D7:4B auto-mac=no comment=defconf name=bridge
/interface wireguard
add listen-port=13235 mtu=1420 name=WG-Internal private-key=\
    ""
/interface ethernet switch
set 0 cpu-flow-control=yes
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi channel
add band=2ghz-ax disabled=no name=2.4G skip-dfs-channels=all width=20mhz
add band=5ghz-ax disabled=no name=5G width=20/40/80mhz
/interface wifi datapath
add bridge=bridge disabled=no name=datapath1
/interface wifi configuration
add channel=2.4G country=Poland datapath=datapath1 disabled=no mode=ap name=\
    Guest security=GuestWirelessLAN ssid=BeMyGuest
add channel=2.4G country=Poland datapath=datapath1 disabled=no mode=ap name=\
    IoT security=IoTWirelessLAN ssid=SmartThings
/interface wifi steering
add disabled=no name=steering1 neighbor-group=dynamic-KaerMorhen-27a0ca15 \
    rrm=no wnm=no
/interface wifi configuration
add channel=2.4G country=Poland datapath=datapath1 disabled=no mode=ap name=\
    "2.4G Wireless LAN" security=MainWirelessLAN security.ft=yes ssid=\
    KaerMorhen steering=steering1
add channel=5G country=Poland datapath=datapath1 disabled=no mode=ap name=\
    "5G Wireless LAN" security=MainWirelessLAN ssid=KaerMorhen steering=\
    steering1
/interface wifi
set [ find default-name=wifi1 ] channel.band=5ghz-ax .frequency=\
    5180,5200,5220,5745 .skip-dfs-channels=10min-cac .width=20/40/80mhz \
    configuration="5G Wireless LAN" configuration.country="United States" \
    .mode=ap datapath=datapath1 disabled=no security=MainWirelessLAN \
    security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel=2.4G channel.frequency=2412,2462,2437 \
    .skip-dfs-channels=10min-cac configuration="2.4G Wireless LAN" \
    configuration.country=Poland .mode=ap .tx-power=4 datapath=datapath1 \
    disabled=no security=MainWirelessLAN security.authentication-types=\
    wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=1d name=defconf
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface ovpn-server server
add mac-address=FE:FB:0E:CD:6C:1B name=ovpn-server1
/interface wifi capsman
set ca-certificate=auto certificate=auto enabled=yes interfaces=bridge \
    package-path="" require-peer-certificate=no upgrade-policy=none
/interface wifi provisioning
add action=create-dynamic-enabled comment="2.4G Provisioning" disabled=no \
    master-configuration="2.4G Wireless LAN" supported-bands=2ghz-ax
add action=create-dynamic-enabled comment="5G Provisioning" disabled=no \
    master-configuration="5G Wireless LAN" supported-bands=5ghz-ax
/interface wireguard peers
add allowed-address=192.168.250.2/32 client-address=192.168.250.2/32 \
    client-dns=1.1.1.1,8.8.8.8 client-endpoint=secret.sn.mynetname.net \
    interface=WG-Internal name="Remote Admin" private-key=\
    "" public-key=\
    "" responder=yes
add allowed-address=192.168.250.3/32 client-address=192.168.250.3/32 \
    client-dns=1.1.1.1,8.8.8.8 client-endpoint=secret.sn.mynetname.net \
    interface=WG-Internal name=Lukasz private-key=\
    "" public-key=\
    "" responder=yes
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=192.168.250.1/24 interface=WG-Internal network=192.168.250.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=192.168.88.2 client-id=1:f4:1e:57:4e:d8:bf mac-address=\
    F4:1E:57:4E:D8:BF server=defconf
add address=192.168.88.3 client-id=1:d4:1:c3:bc:37:f6 mac-address=\
    D4:01:C3:BC:37:F6 server=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=forward comment="TEMP: allow all UDP" protocol=udp
add action=accept chain=output comment="TEMP allow router UDP" protocol=udp

add action=accept chain=input comment="allow WireGuard traffic" \
    src-address=192.168.250.0/24
add action=accept chain=input comment="WireGuard passthrough" \
    dst-port=13231,13232,13235 protocol=udp

add action=accept chain=input \
    comment="Accept established,related,untracked" \
    connection-state=established,related,untracked

add action=accept chain=input comment="CAPsMAN connectivity" \
    dst-port=5246,5247 protocol=udp

add action=drop chain=input comment="Drop invalid traffic" \
    connection-state=invalid

add action=accept chain=input comment="Allow PING" protocol=icmp

add action=accept chain=input \
    comment="Accept to local loopback (for CAPsMAN)" \
    dst-address=127.0.0.1

add action=accept chain=input \
    comment="[WinBox]Allow IP connection from LAN" \
    dst-port=8291 protocol=tcp src-address=192.168.88.0/24

add action=drop chain=input \
    comment="Drop all not coming from LAN" \
    in-interface-list=!LAN

add action=accept chain=forward comment="Accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="Accept out ipsec policy" \
    ipsec-policy=out,ipsec

add action=fasttrack-connection chain=forward \
    comment="Fasttrack" \
    connection-state=established,related \
    disabled=yes hw-offload=yes

add action=accept chain=forward \
    comment="Accept established,related, untracked" \
    connection-state=established,related,untracked

add action=accept chain=forward \
    comment="Allow LAN to WAN connection" \
    in-interface-list=LAN out-interface-list=WAN

add action=accept chain=forward \
    comment="LAN to WG" \
    in-interface-list=LAN out-interface=WG-Internal

add action=accept chain=forward \
    comment="Allow WG-Internal to talk to LAN" \
    in-interface=WG-Internal out-interface-list=LAN

add action=accept chain=forward \
    comment="port forwarding" \
    connection-nat-state=dstnat

add action=accept chain=forward \
    comment="Allow LAN UDP to WAN (WireGuard)" \
    in-interface-list=LAN out-interface-list=WAN protocol=udp

add action=drop chain=forward comment="drop all else"
/ip firewall mangle
add action=change-mss chain=forward comment="Clamp MSS for WG" new-mss=1360 \
    out-interface-list=WAN protocol=tcp tcp-flags=syn
/ip firewall nat
add action=masquerade chain=srcnat comment="Basic NAT" ipsec-policy=out,none \
    out-interface-list=WAN
add action=masquerade chain=srcnat comment="WG Internal - Hairpin" disabled=\
    yes dst-address=!192.168.100.0/24 src-address=192.168.100.0/24
add action=masquerade chain=srcnat comment="WG External - Hairpin" disabled=\
    yes dst-address=!192.168.200.0/24 src-address=192.168.200.0/24
add action=masquerade chain=srcnat comment="LAN to WAN NAT" \
    out-interface-list=WAN
/ip service
set ftp disabled=yes
set telnet disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/Warsaw
/system identity
set name=Nexus
/system routerboard mode-button
set enabled=yes on-event=dark-mode
/system routerboard wps-button
set enabled=yes on-event=wps-accept
/system script
add comment=defconf dont-require-permissions=no name=dark-mode owner=*sys \
    policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    source="\r\
    \n   :if ([system leds settings get all-leds-off] = \"never\") do={\r\
    \n     /system leds settings set all-leds-off=immediate \r\
    \n   } else={\r\
    \n     /system leds settings set all-leds-off=never \r\
    \n   }\r\
    \n "
add comment=defconf dont-require-permissions=no name=wps-accept owner=*sys \
    policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    source="\r\
    \n   :foreach iface in=[/interface/wifi find where (configuration.mode=\"a\
    p\" && disabled=no)] do={\r\
    \n     /interface/wifi wps-push-button \$iface;}\r\
    \n "
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Any ideas what might be wrong? All Peers work perfectly fine anywhwre else but the neighbour’s LAN. I sit possible its blocked by our shared ISP somehow?

2

if no handshake, enable logging on firewall rules for port and or source address and confirm traffic even gets near your firewall.

Also if you both have public ip's that means there are other routers involved since i didn't see any config for public ip's or ISP settings.

3

Could you please make a small diagram of the involved MikroTik's with their correpsonding IP addresses? Bit difficult to understand...

But still...could it be that both peers are set with the setting responder=yes?

4

That is such a confusing setting. It certainly could be the problem in this case.

5

Think of it as being the server (the one public ally available). This site requires that Wireguard is available through a socket, the other site can be behind CGNAT/NAT.

6

Right, but as I understand it (maybe wrongly?), if I want to say “this wg server is the publicly available one”, I do that by setting responder=yes for every peer on that server.

If that’s correct the wording is confusing, and the help doesn’t make it clearer. And I suppose it’s partly due to that peer settings interface containing a combination of “attributes of the remote peer” like Endpoint, and “behaviors of this router when connecting to this peer” like Persistent Keepalive and Responder.

7

This "responder" thing has been explained and discussed to death on the forum. I think the meaning is abundantly clear: a responder will accept but never initiate a handshake.

Therefore two sides, both configured as responders, cannot create a connection.

It's the same as the ipsec "send initial contact", just in reverse.

The the configuration generation (what the other side should do) and what we should do is mixed together is unfortunate.

8

My understanding, is that the the Responder checkbox is available for each peer identified on the "server router for handshake" That is due to the fact that the router can interact differently with each client peer as determined by the checkbox. To be clear, this setting changes the behaviour on the Server peer (the router), and not on client devices.

Before we had this checkbox, the 'normal' behaviour was that the Router would not actively seek the client and would wait for the initial handshake (silent mode). This equates to Responder check box being checked. The router is ONLY a responder.......

If we DO NOT check the Responder box, then the router will proactive and try to reach the client peer and it will be proactive or Noisy Mode, not waiting for handshake, to attempt connections.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Why I find this intuitively confusing (LOL), is that the router has no idea what the IP of the client could be prior to any handshake....... Which makes me think my explanation/understanding is lacking somehow.

( it makes more sense to me if one has an endpoint entered but that is not the case, normally )

9

In terms of the config, not conversant with capsman, so I cannot see for the life of me how you associate wifi to vlans at all.......

There seems to be four subnets but only three vlans, and if you have mixed apples and oranges, attempted to have the bridge be responsible for a subnet, my sympathy wains quickly. Take the subnet make it a vlan and disperse the subnet via /interface bridge ports and interface bridge vlans appropriately.

Since you are sharing the internet ( completely legal in Poland :wink: ) I would definitely create a MGMT interface.

Neighbour discovery would be set to MGMT
tool mac-server mac-winbox would be set to MGMT
(note plain tool mac-server should be set to none!)

If not using iPV6, disable it and remove all associated noise.
Set this to NONE --> ```
/interface detect-internet
set detect-interface-list=all lan-interface-list=LAN


List members
vlan10 =MGMT
WG-Internal =MGMT
rest of vlans should be part of LAN.  ( bridge need not be identified )


You have ssfplus as part of IP DHCP client but not identified as  a WAN interface member???

You have an entry in ip dhcp server that should be removed...........
*/ip dhcp-server network*
*add address=0.0.0.0/24 comment=defconf dns-server=0.0.0.0 gateway=0.0.0.0 netmask=24*


In terms of INput chain rules, personal preference but I start admin rules after the default rules are done aka  start after the capsman  127.0.0.1 rule.

also I would not put any external wireguard here with access,  no need and not a good security practice. YOu already have remote access on your internal one!! Thus would remove these two.
*add action=accept chain=input comment="allow WireGuard traffic" src-address=192.168.200.0/24*
*add action=accept chain=input comment="allow WireGuard traffic" src-address=192.168.220.0/24*

What is the purpose of this rule??   I am unaware of a capsman service on those ports needing to be accessible from the internet?? SECURITY ISSUE??........... Again not familiar with capsman, so could be normal ???  Wouldnt one at least make this only accessible from lets say  **in-interface-list=LAN**
*add action=accept chain=input comment="CAPsMAN connectivity" dst-port=5246,5247 protocol=udp*

As for access to the router...................
You dont include your management subnet ??????
It would seem you have some individual IPs on the home subnet, that require access, if thats the case then ADD  the new home vlan to the Interface list for MGMT and why allow whole subnet>>>  You are wide open there but then only allow internal wg  2-5,   so be consistent and use firewall address list like so.

/ip firewall address-list
add address=192.168.1.X   list=Authorized comment="Admin desktop"
add address=192.168.1.Y   list=Authorized comment="Admin laptop"
add address=192.168.1.Z   list=Authorized comment="Admin smartphone"
add address=192.168.100.2-192.168.100.5  list=Authorized comment="Remote Admin Devices"
add address=10.10.10.0/24  list=Authorized comment="Mgmt subnet"

So the last three rules should look like these four rules....
add chain=input action=accept in-interface-list=MGMT src-address-list=Authorized
add chain=input action=accept in-interface-list=LAN dst-port=53 protocol=udp
add chain=input action=accept in-interface-list=LAN dst-port=53 protocol=tcp
add chain=input action=drop comment="drop all else"

Note:  this makes it consistent clean and clear,  right now you block wg internatl .6 and .7 on one rule, but then allow them on another rule etc....  Spiders nest of error prone type configuring.

Why all the hairpin nat rules.  For me that could be a source of your errors bringing you here.
They are not needed at all!!!  You have no port forwardings by the way.

Drop FTP as a service on the router,   its not a secure method of accessing the router but is a sure way to get your router hacked.

In general, I never include my ssh or winbox information on configs................. 
Also for subnets dont forget the 10.10.10.0/24  if you actually have a management subnet.
+++++++++++++++++++++++++++++++++

Neighbours router is in worse shape..............

I see no connection between the neighbours router and you router????????
10

When no endpoint is specified, responder=yes/no doesn't change the behavior, at least initially.

It comes into play once the client has connected, and the "current endpoint" value is filled in / established. With responder=no, the server will reach out to this address with handshakes, even when the client is no longer available. With responder=yes, these handshake requests are suppressed.

11

Much thanks Lurker, That makes complete sense to me now............

12

Hi Anav, muchas gracias for the valuable hints. I am not currently using any VLANs and for the time being i do not intend to. This was a brief VLAN experiment, I had the config done just to see if it works then i scraped the most of it. The remainign bits and pieces aka scraps are still there :slight_smile:

We are not sharing the internet conection by any means, we both have individual fiber WANs with public IPs provided by our local ISP also running whole their infrastructure on MikriTik devices. The only purpose to establish the WG connection between myself and my neighbour is allow him to access one particular network resource at my home - this is the whole story. We are phisically separated and we want to keep it this way.

There is one active Hairpin NAT rule for my main LAN active, the rest is currently disabled

13

Hey guys, thanks a lot for your inputs. I am not entirely sure if i follow everything here.

Should the responder be then set to responder=yes or should i try experimenting with it turned off responder=off?

Like i said the Peer config works flawlessly everywhere else but my neighbour. Other neighbours using the same ISP and some also MikroTik gear can connect, when we switch to mobile data plans all android phones or iphone connect immediately so I am really feeling lost here.

here’s my attempt to draw a diagram:

image
image677Ă—547 20.8 KB

14

When you have an actual home config to show, that is not full of noise, then it can be made sense of and further since the neighbours router has no peer settings to your router, in the config, it is equally unhelpful, or is he simply using a windows wireguard client and is expressed as 102.168.250.3 on your peer settings???

In terms of responder, normally its checked ( for any router acting as server for handshake ) and its the client peer that needs to be accounted for in some scenarios. Your case seems straightforward and thus leave checked.

Also why do you have hairpin nat at all, not needed in your config.

15

It's not a site to site type of a connection we try to achieve. We are talking a regular client on neighbours network trying to connect to my wireguard interface as shown in the diagram.

So in your words exactly a windows wireguard client from neighbours network using his dedicated wan connection trying to connect to the wireguard server on my router.

16

Can you (or have you) confirmed that your isp is set up correctly to route packets between you?

17

Also ensure there is no firewall or other windows type issue on his PC.

18

How would I be able to verify this myself? just ping between our WANs? There were no firewall rules put in place only the ones applied by MikroTik Router. I also disabled the whole firewall setup in my neighbours router - that didnt solve the issue.

19

On each router try to ping the other person wanip......
Then from a pc behind each router attempt the same...
It may not mean much if the ISP block ICMP though.

20

can do nothing today, they ran some network modernization works today on the ISP’s end - of course without letting the clients know beforehand. As a side effect everyone lost heir assigned public IPs… Service tickets are already in place