I have a router model RB941-2nD firmware 7.12.1, trying to connect to a Wireguard VPN server on AWS, however, when activating the Wireguard interface I completely lose the internet connection.
I am not an expert in networks.
I followed the following steps to configure my Mikrotik…
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard-inet private-key=“MyPrivateKey on VPNServer”
Using a Windows client for Wireguard works normally, however I would like to use the router directly, so that I can have several devices connected.
Can anyone help me?
Although not blocked I would probably add an explicit allow rule in forward chain, prior to the last rule. add chain=forward action=accept src-address=192.168.88.0/24 out-interface=wireguard-inert
This rule is NOT required add action=masquerade chain=srcnat out-interface=wireguard-inet src-address=192.168.88.0/24
The reason is you already added wireguard-inert to the WAN interface list and your existing default rule thus already accomplishes the rule you created. /ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade”
ipsec-policy=out,none out-interface-list=WAN
To ensure ALL your traffic goes out WIREGUARD for internet you need to
a.. create a table
b. create a route
c. create a couple of routing rules.
/routing table add fib name=useWG
/ip route add dst-address=0.0.0.0/0 gateway=wireguard-inert routing-table=useWG and
/routing rule add min-prefix=0 action=lookup-only-in-table table=main comment=“allows any local traffic to occur”
/routing rule add src-address=192.168.88.0/24 action=lookup=only-in-table table=useWG
REMOVE the static IP dns rule /ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
Change the following
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=10.7.0.1 gateway=
192.168.88.1 /ip dns set servers=10.7.0.1
and finally one still has to be able to reach the external Server via DNS so make a static DNS with forward record
/ip dns static add address=endpoint-server_IP forward-to=8.8.8.8 name=ReachWGServer type=FWD
I did this procedure and lost access to the router
I tried several times to do a hard reset without success.
I appreciate your response, but I ended up giving up on this process. And I’m going to use the Wireguard client for Windows, which will partially help me.
I think MK is definitely not intended for users like me.
Certainly, assumed you were doing wireguard that you already had basic MT setup and use under your belt.
Not a good plan if not had some practical experience
Tks anav;
I understand and appreciate your willingness to help, but I have already solved my problem.
I destroyed the device, because it was not even possible to hard reset it.
Cheap devices from shitty brands like Mikrotik deserve to be thrown in the trash.
Next time, I will buy an Asus that works perfectly.
MTs are actually very cost effective, flexible and powerful devices, just needs a brain and some patience and they work just fine.
For anybody else, aka with a lobotomy and the attention span of gnat, yes, Asus is better.