My VoIP provider offers WireGuard tunnel to customers whos consumer VoIP equipment
does not support native SRTP ani ZRTP.
In the Win Wireguard client I have then generated my Private/Public Keys.
1]
Randomly generated settings for illustration only.
my PrivateKey iBEnA5dTGC3EN2OiAAuixpb4eAEnGy/pV2Pw16wXY3c=
and
my PublicKey N5/UPU5/OgxjBwBCapsizF1t1fkZrr/DKsSoIUlYIjU=
2]
I have provided my VoIP provider with my “PublicKey” “N5/UPU5/OgxjBwBCapsizF1t1fkZrr/DKsSoIUlYIjU=”
and in return I received “Interface” “Address” = 172.16.0.222/32 to add to my Interface settings.
3]
Wireguard template: (wg-sip.conf)
[Interface]
PrivateKey = iBEnA5dTGC3EN2OiAAuixpb4eAEnGy/pV2Pw16wXY3c=
Address=172.16.0.222/32
[Peer]
AllowedIPs = 11.22.111.222/28, 12.21.12.21/29, 21.12.212.212/27, 22.222.22.222/28, xxx.xxx.xxx.xxx/29, xxx.xxx.xxx.xxx/32, xx.xx.xx.xx/31, xx.xxx.xx.xxx/30, 172.16.0.0/16
PublicKey = vOCdWZHuIs0PrS/3eowHfNeizCo4n6QtjspJEPaLW3o=
Endpoint = 12.23.23.12:12345
PersistentKeepalive = 10
4]
Setting the above *.conf template in WireGuard client on Windows works, and traffic that meant to be
for my VoIP provider is routed through the WG tunnel and traffic that is not to be directed
to my VoIP does not go through the WireGuard connection on the Windows PC.
Just in case, I have checked running following.
5]
traceroute sip.xxxxxxx.xxx
(Only 2 hops)
and
traceroute mt.lv
(Many hops to reach the destination)
So it works as it should.
6]
Now I want to set this up on my Router running 7.13.1, where my IP phone is connected to
with the following CLI settings:
7]
/interface/wireguard add private-key="iBEnA5dTGC3EN2OiAAuixpb4eAEnGy/pV2Pw16wXY3c=" name=wg-sip
/interface/wireguard/peers add allowed-address=11.22.111.222/28,12.21.12.21/29,21.12.212.212/27,22.222.22.222/28,xxx.xxx.xxx.xxx/29,xxx.xxx.xxx.xxx/32,xx.xx.xx.xx/31,xx.xxx.xx.xxx/30,172.16.0.0/16 \
client-address=172.16.0.222/32 \
disabled=no \
endpoint-address=12.23.23.12 \
endpoint-port=12345 \
interface=wg-sip \
persistent-keepalive=10s \
public-key="vOCdWZHuIs0PrS/3eowHfNeizCo4n6QtjspJEPaLW3o="
8]
So connections is established, but running the command below would result in the following:
/tool/traceroute interface=wg-sip sip.xxxxxxx.xxx
Columns: LOSS, SENT, LAST
# LOSS SENT LAST
1 100% 10 timeout
2 100% 10 timeout
3 100% 10 timeout
4 100% 10 timeout
5 100% 10 timeout
-- [Q quit|D dump|C-z pause]
9]
So at this point, I am not sure if my CONFIG is wrong, or I need to set-up
more (IP ROUTES maybe) in order for this to work.
10]
Looking at the WireGuard help pages, makes me even more confused
https://help.mikrotik.com/docs/display/ROS/WireGuard#WireGuard-Windows10configuration
As in the *.conf file the page has the following:
[Interface]
PrivateKey = your_autogenerated_public_key=
How can the “your_autogenerated_public_key=” be placed in section, which says clearly “PrivateKey”?
My Mikrotik Router config is basic/default settings.
ether1 is connected to VDSL2 modem
and I have PPPoE created to go via the ether1.
I have also revisited all the settings and they all sound to be correct:
https://help.mikrotik.com/docs/display/ROS/WireGuard
private-key=“iBEnA5dTGC3EN2OiAAuixpb4eAEnGy/pV2Pw16wXY3c=”
(string; Default: )
A base64 private key. If not specified, it will be automatically generated upon interface creation.
disabled=no
(yes | no; Default: no)
Enables/disables the tunnel.
name=wg-sip
(string; Default: )
Name of the tunnel.
comment=“SIP traffic”
(string; Default: )
Short description of the tunnel.
allowed-address=11.22.111.222/28,12.21.12.21/29,21.12.212.212/27,22.222.22.222/28,xxx.xxx.xxx.xxx/29,xxx.xxx.xxx.xxx/32,xx.xx.xx.xx/31,xx.xxx.xx.xxx/30,172.16.0.0/16
(IP/IPv6 prefix; Default: )
List of IP (v4 or v6) addresses with CIDR masks from which incoming traffic for this peer is allowed and to which outgoing traffic for this peer is directed.
The catch-all 0.0.0.0/0 may be specified for matching all IPv4 addresses, and ::/0 may be specified for matching all IPv6 addresses.
client-address=
(IP/IPv6 prefix; Default: )
When imported using a qr code for a client (for example, a phone), then this address for the wg interface is set on that device.
disabled=no
(yes | no; Default: no)
Enables/disables the peer.
endpoint-address=12.23.23.12
(IP/Hostname; Default: )
The IP address or hostname. It is used by WireGuard to establish a secure connection between two peers.
endpoint-port=12345
(integer:0..65535; Default: )
The Endpoint port is the UDP port on which a WireGuard peer listens for incoming traffic.
interface=wg-sip
(string; Default: )
Name of the WireGuard interface the peer belongs to.
persistent-keepalive=10s
(integer:0..65535; Default: 0)
A seconds interval, between 1 and 65535 inclusive, of how often to send an authenticated empty packet to the peer for the purpose of keeping a stateful
firewall or NAT mapping valid persistently. For example, if the interface very rarely sends traffic, but it might at anytime receive traffic from a peer,
and it is behind NAT, the interface might benefit from having a persistent keepalive interval of 25 seconds.
public-key=“vOCdWZHuIs0PrS/3eowHfNeizCo4n6QtjspJEPaLW3o=”
(string; Default: )
The remote peer’s calculated public key. It also can be generated if private-key is specified.
So I can not understand, why it is not working and when running:
/tool/traceroute interface=wg-sip sip.xxxxxxx.xxx
I get timeout …
) In your single peer case you could probably also set it to 0.0.0.0/0 and do the rest via routes.