First post in this community, hope you guys can help out.
I’ve been trying to make a dynamic WG connection between 2 sites, both of them using a ddns address. Site A has an EdgeRouter and is the current WG server (public IP under ddns.net) Site B has a Mikrotik and is the one to connect to WG as as client (public IP under duckdns.org)
So far I was able to get a handshake but unfortunately I’m not able to get any traffic from the Mikrotik via the WG tunnel
Can you guys help to identify the issue?
EdgeRouter config (server)
Public IP under xxx.ddns.net
Wireguard interface: 10.6.69.1
Listening port: 51280
Peer: mikrotik
Allowed IP: 10.6.69.6/32
endpoint: xxx.duckdns.org:13231
Peer address on the Mikrotik router should be /interface wireguard peers
add allowed-address=0.0.0.0/0 client-address=10.6.69**.0/**24 endpoint-address=xxx.ddns.net endpoint-port=51280 interface=
WG-CasaPollo persistent-keepalive=25s public-key=
“xxx”
Do not require client address on edgerouter, it is acting as server for handshake.
Do not require input chain rule for wireguard on MT, it is NOT server for handshake, so remove… add action=accept chain=input comment=“WG-casapollo (Mikrotik guides)”
dst-port=13231 protocol=udp src-port=“”
+++++++++++++++++++++++++++++++++++++++++
If you didnt want to masquerade all the MT traffic out the wireguard to its IP address .6, and simply allow the local subnets to enter the tunnel.
ONe would only need to include those subnets on the edgerouter allowed IPs.
for example- Allowed IP: 10.6.69.6/32,192.168.88.0/24
Its not a matter of belonging to a particular interface is some rule.
It can be assigned to a particular interface for various reasons…
In fact, for third party Wireguard connections, making the WG interface part of the WAN interface makes sense.
Then one need not create a separate sourcenat rule for wireguard.
If the router is the server for handshake, and you have users coming in that need access to the WAN for example, ensuring they are part of the LAN interface will
a. allow them access to DNS services and any forward chain LAN to WAN allow rules.
Bottom line, look at your firewall rules and traffic needs and apply what makes sense.
I’ve modified my config as you’ve proposed but I still can’t ping 10.6.69.1 from the Mikrotik or get any traffic out from the WG interface.
On the Edge router i’ve added as allowed IP 10.6.69.6/32 and 192.168.88.0/24 but as soon as I remove the endpoint xxx.duckdns.org:13231 I no longer get a handshake.
jfad, YOU HAD TWO endpoints in your mikrotik config.
There is no such thing as client endpoint in your scenario.
The edgepoint router acts as the server for the initial handshake ( after established its a peer to peer connection).
SO two things need to happen’
get rid of client duckstuff on MIkrotik Allowed IPs setting. You only need the endpoint identifying the edge router .
get rid of the duck settings on the edge router, they are meaningless
all that should be on the edge router for address on the allowed IPs, is the 10.6.69.6/32
To to recap:
MT
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=xxx.ddns.net endpoint-port=51280 interface=
WG-CasaPollo persistent-keepalive=25s public-key=“xxx”