Wireguard Client - Traffic Routing Issue

503dev · May 13, 2026, 5:41am

Hi everyone, I really need your help. I’ve read through countless other guides on here and tried so many things. I am new to Mikrotik and losing it.

What I want to do:

Connect Mikrotik to my existing network for internet (I plugged in the WAN / Port 1, the Mikrotik is not direct to my router it’s direct to my home router)
Setup wireguard client (this works, I have confirmed)
Route all traffic on the router from any device on ethernet ports to the wireguard

As it stands:

Router with defaults has network no problem by just plugging in WAN
Connected laptop to mikrotik has access to local and internet, but does not route over Wireguard

I have tried adding the wireguard interface to the WAN list as per another post but it made no difference.

What am I missing here? I know I am doing something stupid but I have a hard time with routing and firewall, any help appreciated.

/interface bridge
add admin-mac=B8:69:F4:B1:81:03 auto-mac=no comment=defconf name=bridge
/interface wireguard
add listen-port=51820 mtu=1384 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=wireguard1 list=WAN
/interface wireguard peers
add allowed-address=0.0.0.0/0 client-allowed-address=0.0.0.0/0
endpoint-address=wg.starzone.io`` endpoint-port=1276 interface=wireguard1
name=peer1 persistent-keepalive=25s public-key=
"NsyFeiW4z67A5FEEX/FnFM5dCwwp+WwfbHwD7Q/h2go="
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=
192.168.88.0
add address=10.2.153.196 interface=wireguard1 network=10.2.153.196
/ip dhcp-client
add comment=defconf interface=ether1 name=client1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=
192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
in-interface=lo src-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN"
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade"
ipsec-policy=out,none out-interface-list=WAN
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute"
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=input comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6"
connection-state=established,related
add action=accept chain=forward comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1"
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=forward comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
/system clock
set time-zone-name=America/New_York
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

CGGXANNX · May 13, 2026, 6:51am

What you need to additionally do is to:

Add a routing table, with the name via-starzone for example:
```
/routing table
add fib name=via-starzone
```

Add a default route in this routing table:

/ip route
add dst-address=0.0.0.0/0 gateway=wireguard1 routing-table=via-starzone

Add the following routing rules to have all clients plugged to bridge to use the Wireguard interface for internet access:

/routing rule
add action=lookup min-prefix=0 table=main
add action=lookup dst-address=0.0.0.0/0 interface=bridge table=via-starzone

That should do it!

If you also want to add some failsafe and have the LAN clients fallback to the default internet when Wireguard is not working, then replace step 2 above with these two routes instead:

Add recursive routes, using 1.0.0.3 as canary:

/ip route
add dst-address=1.0.0.3/32 gateway=wireguard1 \
    routing-table=main scope=11 target-scope=10
add dst-address=0.0.0.0/0 check-gateway=ping gateway=1.0.0.3@main \
    routing-table=via-starzone scope=30 target-scope=11

See Simple recursive failover for bears of little brain for more details.

503dev · May 14, 2026, 1:55am

Thank you so much. Through reading and experimenting I had managed to get it working before your reply but my traffic was doing a weird thing where some websites seemed to get routed without the wireguard.

I can see based on your reply that my routing is possibly then issue. I'm going to restart the setup and configure it based on your suggestion.

Thank you

CGGXANNX · May 14, 2026, 2:14am

I forgot to mention that some MSS adjustments are needed otherwise you might experience MTU related connection issues. You should also add the following mangle rules to clamp the TCP MSS for connections going through wireguard.

/ip firewall mangle
add action=change-mss chain=forward comment="reduce MSS for WG" \
    new-mss=1344 out-interface=wireguard1 protocol=tcp tcp-flags=syn tcp-mss=1345-65535
add action=change-mss chain=forward comment="reduce MSS for WG" \
    new-mss=1344 in-interface=wireguard1 protocol=tcp tcp-flags=syn tcp-mss=1345-65535

The values 1344 and 1345 are used based on the MTU value 1384 set on your WireGuard interface.