WireGuard in action, experiences, not theory

Doberman · March 9, 2024, 8:17pm

I made during my work of more than a hundred wireguard connections.
30% is site to site between two MikroTik and the rest is connection to individual computers.

In your experience whether it is possible within the same wireguard to have multiple peers between MikroTik or each site to site connection must have a separate wireguard? ( for example, one MikroTik that behaves like a server and four Microtics that connect to it )

What is the number of road warriors peers within a one wireguard that works stably?

holvoetn · March 9, 2024, 8:23pm

Multiple peers: absolutely no problem provided you got your addressing scheme correct.
Quantity of peers: no idea. My maximum is 8. Not so easy to test …

Splitting in multiple connections:
that’s a bit up to you.
Personally I would keep every site-to site separate. That also allows to setup redundancy if you interconnect them in a mesh.
Road warriors connecting to the same break-out point should be kept together.

anav · March 9, 2024, 8:32pm

You dont get mesh… You get a mess. Its peer to peer, and you best know what you are doing in firewall rules and routes.

Depends on any given scenario:
For example, if you have three Routers then you should have B,C connect to A, and the backup best be on either C and B and a connection between them. A is out of the picture!

I suspect that you wont get too much feedback as few probably run that many WG connections between routers at a time.
You can also assign different IP addresses to differentiate routers USING the same wireguard interface.

gigabyte091 · March 9, 2024, 9:36pm

Right now I have 11 wireguard connections between RB4011 and wAP LTE and don’t have any problems. There is no much traffic at all, it’s for management only and to access device on the other side if needed so i can’t tell how it will work with some real traffic.

Plan is to have all 42 sites connected… Will see how it will work…

Doberman · March 9, 2024, 9:42pm

what do you think?

Doberman · March 9, 2024, 9:45pm

this is 11 separate wireguard or only one wireguard with 11 peers ?

gigabyte091 · March 9, 2024, 9:55pm

1 wireguard with 11 peers.

Doberman · March 9, 2024, 10:04pm

nice
i cant achieve that … after 3 … one of them stop working …

anav · March 9, 2024, 11:48pm

What do I think…
Not setup correctly is what I think but I am probably wrong seeing as you have so much experience.

gigabyte091 · March 10, 2024, 4:45am

@OP

Why don’t you post your configuration here if something is not working right ?

@anav helped me with my configuration so if you are willing listen and learn from him im sure you will have no problem with your wireguard setup.

Njumaen · March 10, 2024, 6:32am

I‘ve got a mixed setup:

to one wg-interface approx. 20 external customer devices connecting for configuration (inbound) and
to another wg-interface I have 10 routable subnets (outbound) and
yet another wg-interface for interconnetion of two LTE routers behind CGN

All seperated by firewall rules and stable as rocks!

One customer has 5 offices connected to central wg-interface and 25 roadwarriors to another wg-interface!

All inbound routers have fixed IPv4 WAN addresses.

Doberman · March 10, 2024, 11:01am

Dear ANAV, believe me, i now how little is my knowledge … and one of my favorite source is your posts.
I know I’m wrong somewhere and that’s why I turned to you guys for help. I did not at start with configurations because it was easier for me to start the topic with general information and already now I received confirmation that it can be done as I thought. Now I’ve given myself time to build a new lab that can throw out configurations
Everyday i try to find new pieces of wisdom and you help me a lot.

SERVER config:

/interface bridge
auto-mac=yes name=BridgeLAN
/interface ethernet
set [ find default-name=ether1 ] disable-running-check=no
set [ find default-name=ether2 ] disable-running-check=no
set [ find default-name=ether3 ] disable-running-check=no
set [ find default-name=ether4 ] disable-running-check=no
set [ find default-name=ether5 ] disable-running-check=no
set [ find default-name=ether6 ] disable-running-check=no
set [ find default-name=ether7 ] disable-running-check=no
set [ find default-name=ether8 ] disable-running-check=no
set [ find default-name=ether9 ] disable-running-check=no name=ether9-WAN
/interface wireguard
add listen-port=55555 mtu=1420 name=WG_Server_Host
/interface list
add name=LAN
add name=WAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=10.100.101.1-10.100.101.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=BridgeLAN name=dhcp1
/port
set 0 name=serial0
/interface bridge port
add bridge=BridgeLAN disabled=yes interface=ether9-WAN
add bridge=BridgeLAN interface=ether1
add bridge=BridgeLAN interface=ether2
add bridge=BridgeLAN interface=ether3
add bridge=BridgeLAN interface=ether4
add bridge=BridgeLAN interface=ether5
add bridge=BridgeLAN interface=ether6
add bridge=BridgeLAN interface=ether7
add bridge=BridgeLAN interface=ether8
/interface list member
add interface=ether9-WAN list=WAN
/interface wireguard peers
add allowed-address=10.1.1.0/26,10.100.101.0/24,10.100.102.0/24 endpoint-port=55555 interface=\
    WG_Server_Host public-key="q6gOq9ez2inS01vWLW5LuyCFFTqCvuCu4RC0GrfPTRc="
add allowed-address=10.1.1.0/26,10.100.101.0/24,10.100.103.1/24 endpoint-port=55555 interface=\
    WG_Server_Host persistent-keepalive=10s public-key=\
    "6UIYMm2wsx6DRWoAQaRd+vYmtuYeTIUy3JlkohGEBko="
add allowed-address=10.1.1.0/26,10.100.101.1/24,10.100.104.0/24 endpoint-port=55555 interface=\
    WG_Server_Host persistent-keepalive=10s public-key=\
    "Eu9c01ZR7w4+e8pksbzAd+nSJCqQrQMXxPCyuHKdr0c="
/ip address
add address=10.100.101.1/24 interface=BridgeLAN network=10.100.101.0
add address=10.1.1.1/26 interface=WG_Server_Host network=10.1.1.0
/ip dhcp-client
add interface=ether9-WAN
/ip dhcp-server network
add address=10.100.101.0/24 gateway=10.100.101.0
/ip firewall filter
add action=accept chain=input src-address-list=Remote_Access
add action=drop chain=input comment="Block DNS Request on INCOMING WAN INTERFACE port 53" dst-port=\
    53 in-interface-list=WAN protocol=tcp
add action=drop chain=forward dst-port=53 in-interface-list=WAN protocol=tcp
add action=drop chain=input dst-port=53 in-interface-list=WAN protocol=udp
add action=drop chain=forward dst-port=53 in-interface-list=WAN protocol=udp
add action=accept chain=input comment="defconf: accept established,related,untracked" \
    connection-state=established,related,untracked
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=\
    established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" \
    connection-state=established,related,untracked
add action=accept chain=input comment="PPTP VPN" dst-port=1723 protocol=tcp
add action=accept chain=input comment="L2TP VPN" dst-port=500,1701,4500 protocol=udp
add action=accept chain=input comment=IPSec-ESP protocol=ipsec-esp
add action=accept chain=output comment=IPSec-ESP protocol=ipsec-esp
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=forward comment="Allow Port Forwarding" connection-nat-state=dstnat \
    connection-state=new in-interface-list=WAN
add action=drop chain=forward comment="defconf:  drop all from WAN not DSTNATed" \
    connection-nat-state=!dstnat connection-state=new in-interface=ether9-WAN
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input \
    comment="Port scanners to list" protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input \
    comment="NMAP FIN Stealth scan" protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input \
    comment="SYN/FIN scan" protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input \
    comment="SYN/RST scan" protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input \
    comment="FIN/PSH/URG scan" protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="" address-list-timeout=2w chain=input comment=\
    "ALL/ALL scan" protocol=tcp src-address-list="Port scanners" tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input \
    comment="NMAP NULL scan" protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=input comment="Dropping port scanners" in-interface-list=WAN log=yes \
    log-prefix="Drop port scanners" src-address-list="Port scanners"
add action=drop chain=input comment="ftp brute forcers" dst-port=21 in-interface-list=WAN protocol=\
    tcp src-address-list=ftp_blacklist
add action=accept chain=output comment="530 Login incorrect" content="530 Login incorrect" \
    dst-limit=1/1m,9,dst-address/1m protocol=tcp
add action=add-dst-to-address-list address-list=ftp_blacklist address-list-timeout=3h chain=output \
    comment="530 Login incorrect" content="530 Login incorrect" protocol=tcp
add action=drop chain=input comment="ssh brute forcers" dst-port=22 in-interface-list=WAN protocol=\
    tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w3d chain=input \
    connection-state=new dst-port=22 in-interface-list=WAN protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=10m chain=input \
    connection-state=new dst-port=22 in-interface-list=WAN protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=10m chain=input \
    connection-state=new dst-port=22 in-interface-list=WAN protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=input \
    connection-state=new dst-port=22 in-interface-list=WAN protocol=tcp
add action=drop chain=input comment="drop Black_list" in-interface-list=WAN protocol=tcp \
    src-address-list=Black_list
add action=drop chain=input comment="drop telnet brute forcers" dst-port=23 in-interface-list=WAN \
    protocol=tcp src-address-list=telnet_black_list
add action=add-src-to-address-list address-list=telnet_black_list address-list-timeout=1d chain=\
    input connection-state=new dst-port=23 in-interface-list=WAN protocol=tcp src-address-list=\
    telnet_stage3
add action=add-src-to-address-list address-list=telnet_stage3 address-list-timeout=1m chain=input \
    connection-state=new dst-port=23 in-interface-list=WAN protocol=tcp src-address-list=\
    telnet_stage2
add action=add-src-to-address-list address-list=telnet_stage2 address-list-timeout=1m chain=input \
    connection-state=new dst-port=23 in-interface-list=WAN protocol=tcp src-address-list=\
    telnet_stage1
add action=add-src-to-address-list address-list=telnet_stage1 address-list-timeout=1m chain=input \
    connection-state=new dst-port=23 in-interface-list=WAN protocol=tcp
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/ip route
add disabled=no distance=50 dst-address=10.100.102.0/24 gateway=WG_Server_Host routing-table=main \
    scope=10 suppress-hw-offload=no
add disabled=no distance=50 dst-address=10.100.103.0/24 gateway=WG_Server_Host pref-src="" \
    routing-table=main scope=10 suppress-hw-offload=no target-scope=10
add disabled=no distance=50 dst-address=10.100.104.0/24 gateway=WG_Server_Host pref-src="" \
    routing-table=main scope=10 suppress-hw-offload=no target-scope=10
/system identity
set name=MikroTik_1

HOST_1 config:

/interface bridge
add name=BridgeLAN
/interface ethernet
set [ find default-name=ether1 ] disable-running-check=no
set [ find default-name=ether2 ] disable-running-check=no
set [ find default-name=ether3 ] disable-running-check=no
set [ find default-name=ether4 ] disable-running-check=no
set [ find default-name=ether5 ] disable-running-check=no
set [ find default-name=ether6 ] disable-running-check=no
set [ find default-name=ether7 ] disable-running-check=no
set [ find default-name=ether8 ] disable-running-check=no
set [ find default-name=ether9 ] disable-running-check=no
set [ find default-name=ether10 ] disable-running-check=no
set [ find default-name=ether11 ] disable-running-check=no
/interface wireguard
add listen-port=55555 mtu=1420 name=WG_Host1_Server
/disk
set slot1 slot=slot1
/interface list
add name=LAN
add name=WAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=10.100.102.2-10.100.102.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=BridgeLAN name=dhcp1
/port
set 0 name=serial0
/interface bridge port
add bridge=BridgeLAN disabled=yes interface=ether11
add bridge=BridgeLAN interface=ether1
add bridge=BridgeLAN interface=ether2
add bridge=BridgeLAN interface=ether3
add bridge=BridgeLAN interface=ether4
add bridge=BridgeLAN interface=ether5
add bridge=BridgeLAN interface=ether6
add bridge=BridgeLAN interface=ether7
add bridge=BridgeLAN interface=ether8
add bridge=BridgeLAN interface=ether9
add bridge=BridgeLAN interface=ether10
/interface list member
add interface=ether11 list=WAN
/interface wireguard peers
add allowed-address=10.1.1.0/26,10.100.101.0/24,10.100.102.1/24 endpoint-address=10.11.20.50 endpoint-port=55555 interface=\
    WG_Host1_Server persistent-keepalive=10s public-key="3OLElWXWqYXQZ4xonwrh/j0pHyDZKZBewaN9qnoMBUQ="
/ip address
add address=10.100.102.1/24 interface=BridgeLAN network=10.100.102.0
add address=10.1.1.2/26 interface=WG_Host1_Server network=10.1.1.0
/ip dhcp-client
add interface=ether11
/ip dhcp-server network
add address=10.100.102.0/24 gateway=10.100.102.1
/ip firewall filter
add action=accept chain=input src-address-list=Remote_Access
add action=drop chain=input comment="Block DNS Request on INCOMING WAN INTERFACE port 53" dst-port=53 in-interface-list=WAN \
    protocol=tcp
add action=drop chain=forward dst-port=53 in-interface-list=WAN protocol=tcp
add action=drop chain=input dst-port=53 in-interface-list=WAN protocol=udp
add action=drop chain=forward dst-port=53 in-interface-list=WAN protocol=udp
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=accept chain=input comment="PPTP VPN" dst-port=1723 protocol=tcp
add action=accept chain=input comment="L2TP VPN" dst-port=500,1701,4500 protocol=udp
add action=accept chain=input comment=IPSec-ESP protocol=ipsec-esp
add action=accept chain=output comment=IPSec-ESP protocol=ipsec-esp
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=forward comment="Allow Port Forwarding" connection-nat-state=dstnat connection-state=new \
    in-interface-list=WAN
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input comment=\
    "Port scanners to list" protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input comment=\
    "NMAP FIN Stealth scan" protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input comment="SYN/FIN scan" \
    protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input comment="SYN/RST scan" \
    protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input comment="FIN/PSH/URG scan" \
    protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="" address-list-timeout=2w chain=input comment="ALL/ALL scan" protocol=tcp \
    src-address-list="Port scanners" tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input comment="NMAP NULL scan" \
    protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=input comment="Dropping port scanners" in-interface-list=WAN log=yes log-prefix="Drop port scanners" \
    src-address-list="Port scanners"
add action=drop chain=input comment="ftp brute forcers" dst-port=21 in-interface-list=WAN protocol=tcp src-address-list=\
    ftp_blacklist
add action=accept chain=output comment="530 Login incorrect" content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m \
    protocol=tcp
add action=add-dst-to-address-list address-list=ftp_blacklist address-list-timeout=3h chain=output comment="530 Login incorrect" \
    content="530 Login incorrect" protocol=tcp
add action=drop chain=input comment="ssh brute forcers" dst-port=22 in-interface-list=WAN protocol=tcp src-address-list=\
    ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w3d chain=input connection-state=new dst-port=\
    22 in-interface-list=WAN protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=10m chain=input connection-state=new dst-port=22 \
    in-interface-list=WAN protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=10m chain=input connection-state=new dst-port=22 \
    in-interface-list=WAN protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=22 \
    in-interface-list=WAN protocol=tcp
add action=drop chain=input comment="drop Black_list" in-interface-list=WAN protocol=tcp src-address-list=Black_list
add action=drop chain=input comment="drop telnet brute forcers" dst-port=23 in-interface-list=WAN protocol=tcp src-address-list=\
    telnet_black_list
add action=add-src-to-address-list address-list=telnet_black_list address-list-timeout=1d chain=input connection-state=new \
    dst-port=23 in-interface-list=WAN protocol=tcp src-address-list=telnet_stage3
add action=add-src-to-address-list address-list=telnet_stage3 address-list-timeout=1m chain=input connection-state=new dst-port=23 \
    in-interface-list=WAN protocol=tcp src-address-list=telnet_stage2
add action=add-src-to-address-list address-list=telnet_stage2 address-list-timeout=1m chain=input connection-state=new dst-port=23 \
    in-interface-list=WAN protocol=tcp src-address-list=telnet_stage1
add action=add-src-to-address-list address-list=telnet_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=23 \
    in-interface-list=WAN protocol=tcp
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/system identity
set name=MikroTik_2

HOST_2 config:

/interface bridge
add name=BridgeLAN
/interface ethernet
set [ find default-name=ether1 ] disable-running-check=no
set [ find default-name=ether2 ] disable-running-check=no
set [ find default-name=ether3 ] disable-running-check=no
set [ find default-name=ether4 ] disable-running-check=no
set [ find default-name=ether5 ] disable-running-check=no
set [ find default-name=ether6 ] disable-running-check=no
set [ find default-name=ether7 ] disable-running-check=no
set [ find default-name=ether8 ] disable-running-check=no
set [ find default-name=ether9 ] disable-running-check=no
set [ find default-name=ether10 ] disable-running-check=no
set [ find default-name=ether11 ] disable-running-check=no
/interface wireguard
add listen-port=55555 mtu=1420 name=WG_Host2_Server
/interface list
add name=LAN
add name=WAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=10.100.103.2-10.100.103.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=BridgeLAN name=dhcp1
/port
set 0 name=serial0
/interface bridge port
add bridge=BridgeLAN disabled=yes interface=ether11
add bridge=BridgeLAN interface=ether1
add bridge=BridgeLAN interface=ether2
add bridge=BridgeLAN interface=ether3
add bridge=BridgeLAN interface=ether4
add bridge=BridgeLAN interface=ether5
add bridge=BridgeLAN interface=ether6
add bridge=BridgeLAN interface=ether7
add bridge=BridgeLAN interface=ether8
add bridge=BridgeLAN interface=ether9
add bridge=BridgeLAN interface=ether10
/interface list member
add interface=ether11 list=WAN
/interface wireguard peers
add allowed-address=10.1.1.0/26,10.100.101.0/24,10.100.103.1/24 endpoint-address=10.11.20.50 endpoint-port=55555 interface=WG_Host2_Server persistent-keepalive=10s public-key="3OLElWXWqYXQZ4xonwrh/j0pHyDZKZBewaN9qnoMBUQ="
/ip address
add address=10.100.103.1/24 interface=BridgeLAN network=10.100.103.0
add address=10.1.1.3/26 interface=WG_Host2_Server network=10.1.1.0
/ip dhcp-client
add interface=ether11
/ip dhcp-server network
add address=10.100.103.0/24 gateway=10.100.103.1
/ip firewall filter
add action=accept chain=input src-address-list=Remote_Access
add action=drop chain=input comment="Block DNS Request on INCOMING WAN INTERFACE port 53" dst-port=53 in-interface-list=WAN protocol=tcp
add action=drop chain=forward dst-port=53 in-interface-list=WAN protocol=tcp
add action=drop chain=input dst-port=53 in-interface-list=WAN protocol=udp
add action=drop chain=forward dst-port=53 in-interface-list=WAN protocol=udp
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=accept chain=input comment="PPTP VPN" dst-port=1723 protocol=tcp
add action=accept chain=input comment="L2TP VPN" dst-port=500,1701,4500 protocol=udp
add action=accept chain=input comment=IPSec-ESP protocol=ipsec-esp
add action=accept chain=output comment=IPSec-ESP protocol=ipsec-esp
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=forward comment="Allow Port Forwarding" connection-nat-state=dstnat connection-state=new in-interface-list=WAN
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input comment="Port scanners to list" protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input comment="NMAP FIN Stealth scan" protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input comment="SYN/FIN scan" protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input comment="SYN/RST scan" protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input comment="FIN/PSH/URG scan" protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="" address-list-timeout=2w chain=input comment="ALL/ALL scan" protocol=tcp src-address-list="Port scanners" tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input comment="NMAP NULL scan" protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=input comment="Dropping port scanners" in-interface-list=WAN log=yes log-prefix="Drop port scanners" src-address-list="Port scanners"
add action=drop chain=input comment="ftp brute forcers" dst-port=21 in-interface-list=WAN protocol=tcp src-address-list=ftp_blacklist
add action=accept chain=output comment="530 Login incorrect" content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m protocol=tcp
add action=add-dst-to-address-list address-list=ftp_blacklist address-list-timeout=3h chain=output comment="530 Login incorrect" content="530 Login incorrect" protocol=tcp
add action=drop chain=input comment="ssh brute forcers" dst-port=22 in-interface-list=WAN protocol=tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w3d chain=input connection-state=new dst-port=22 in-interface-list=WAN protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=10m chain=input connection-state=new dst-port=22 in-interface-list=WAN protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=10m chain=input connection-state=new dst-port=22 in-interface-list=WAN protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=22 in-interface-list=WAN protocol=tcp
add action=drop chain=input comment="drop Black_list" in-interface-list=WAN protocol=tcp src-address-list=Black_list
add action=drop chain=input comment="drop telnet brute forcers" dst-port=23 in-interface-list=WAN protocol=tcp src-address-list=telnet_black_list
add action=add-src-to-address-list address-list=telnet_black_list address-list-timeout=1d chain=input connection-state=new dst-port=23 in-interface-list=WAN protocol=tcp src-address-list=telnet_stage3
add action=add-src-to-address-list address-list=telnet_stage3 address-list-timeout=1m chain=input connection-state=new dst-port=23 in-interface-list=WAN protocol=tcp src-address-list=telnet_stage2
add action=add-src-to-address-list address-list=telnet_stage2 address-list-timeout=1m chain=input connection-state=new dst-port=23 in-interface-list=WAN protocol=tcp src-address-list=telnet_stage1
add action=add-src-to-address-list address-list=telnet_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=23 in-interface-list=WAN protocol=tcp
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/system identity
set name=MikroTik_3

HOST_3 config:

/interface bridge
add name=BridgeLAN
/interface ethernet
set [ find default-name=ether1 ] disable-running-check=no
set [ find default-name=ether2 ] disable-running-check=no
set [ find default-name=ether3 ] disable-running-check=no
set [ find default-name=ether4 ] disable-running-check=no
set [ find default-name=ether5 ] disable-running-check=no
set [ find default-name=ether6 ] disable-running-check=no
set [ find default-name=ether7 ] disable-running-check=no
set [ find default-name=ether8 ] disable-running-check=no
set [ find default-name=ether9 ] disable-running-check=no
set [ find default-name=ether10 ] disable-running-check=no
set [ find default-name=ether11 ] disable-running-check=no
/interface wireguard
add listen-port=55555 mtu=1420 name=WG_Host3_Server
/interface list
add name=LAN
add name=WAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=10.100.104.2-10.100.104.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=BridgeLAN name=dhcp1
/port
set 0 name=serial0
/interface bridge port
add bridge=BridgeLAN disabled=yes interface=ether11
add bridge=BridgeLAN interface=ether1
add bridge=BridgeLAN interface=ether2
add bridge=BridgeLAN interface=ether3
add bridge=BridgeLAN interface=ether4
add bridge=BridgeLAN interface=ether5
add bridge=BridgeLAN interface=ether6
add bridge=BridgeLAN interface=ether7
add bridge=BridgeLAN interface=ether8
add bridge=BridgeLAN interface=ether9
add bridge=BridgeLAN interface=ether10
/interface list member
add interface=ether11 list=WAN
/interface wireguard peers
add allowed-address=10.1.1.0/26,10.100.101.0/24,10.100.104.0/24 endpoint-address=10.11.20.50 endpoint-port=55555 interface=WG_Host3_Server persistent-keepalive=10s public-key="3OLElWXWqYXQZ4xonwrh/j0pHyDZKZBewaN9qnoMBUQ="
/ip address
add address=10.100.104.1/24 interface=BridgeLAN network=10.100.104.0
add address=10.1.1.4/26 interface=WG_Host3_Server network=10.1.1.0
/ip dhcp-client
add interface=ether11
/ip dhcp-server network
add address=10.100.104.0/24 gateway=10.100.104.1
/ip firewall filter
add action=accept chain=input src-address-list=Remote_Access
add action=drop chain=input comment="Block DNS Request on INCOMING WAN INTERFACE port 53" dst-port=53 in-interface-list=WAN protocol=tcp
add action=drop chain=forward dst-port=53 in-interface-list=WAN protocol=tcp
add action=drop chain=input dst-port=53 in-interface-list=WAN protocol=udp
add action=drop chain=forward dst-port=53 in-interface-list=WAN protocol=udp
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=accept chain=input comment="PPTP VPN" dst-port=1723 protocol=tcp
add action=accept chain=input comment="L2TP VPN" dst-port=500,1701,4500 protocol=udp
add action=accept chain=input comment=IPSec-ESP protocol=ipsec-esp
add action=accept chain=output comment=IPSec-ESP protocol=ipsec-esp
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=forward comment="Allow Port Forwarding" connection-nat-state=dstnat connection-state=new in-interface-list=WAN
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input comment="Port scanners to list" protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input comment="NMAP FIN Stealth scan" protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input comment="SYN/FIN scan" protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input comment="SYN/RST scan" protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input comment="FIN/PSH/URG scan" protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="" address-list-timeout=2w chain=input comment="ALL/ALL scan" protocol=tcp src-address-list="Port scanners" tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="Port scanners" address-list-timeout=2w chain=input comment="NMAP NULL scan" protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=input comment="Dropping port scanners" in-interface-list=WAN log=yes log-prefix="Drop port scanners" src-address-list="Port scanners"
add action=drop chain=input comment="ftp brute forcers" dst-port=21 in-interface-list=WAN protocol=tcp src-address-list=ftp_blacklist
add action=accept chain=output comment="530 Login incorrect" content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m protocol=tcp
add action=add-dst-to-address-list address-list=ftp_blacklist address-list-timeout=3h chain=output comment="530 Login incorrect" content="530 Login incorrect" protocol=tcp
add action=drop chain=input comment="ssh brute forcers" dst-port=22 in-interface-list=WAN protocol=tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w3d chain=input connection-state=new dst-port=22 in-interface-list=WAN protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=10m chain=input connection-state=new dst-port=22 in-interface-list=WAN protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=10m chain=input connection-state=new dst-port=22 in-interface-list=WAN protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=22 in-interface-list=WAN protocol=tcp
add action=drop chain=input comment="drop Black_list" in-interface-list=WAN protocol=tcp src-address-list=Black_list
add action=drop chain=input comment="drop telnet brute forcers" dst-port=23 in-interface-list=WAN protocol=tcp src-address-list=telnet_black_list
add action=add-src-to-address-list address-list=telnet_black_list address-list-timeout=1d chain=input connection-state=new dst-port=23 in-interface-list=WAN protocol=tcp src-address-list=telnet_stage3
add action=add-src-to-address-list address-list=telnet_stage3 address-list-timeout=1m chain=input connection-state=new dst-port=23 in-interface-list=WAN protocol=tcp src-address-list=telnet_stage2
add action=add-src-to-address-list address-list=telnet_stage2 address-list-timeout=1m chain=input connection-state=new dst-port=23 in-interface-list=WAN protocol=tcp src-address-list=telnet_stage1
add action=add-src-to-address-list address-list=telnet_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=23 in-interface-list=WAN protocol=tcp
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/ip route
add disabled=no distance=50 dst-address=10.100.101.0/24 gateway=WG_Host3_Server routing-table=main scope=10 suppress-hw-offload=no
/system identity
set name=MikroTik_4

anav · March 10, 2024, 3:15pm

No point in looking at configs without first understanding the intent of your diagram.
It would appear that the router on the left call it R1 is the Server Peer for handshake purposes ( with address 10.3.2.1) and the three routers on the right R2,R3,R4 are the PEER clients for handshake. Can you confirm?

Im assuming R1 has a reachable public IP.
Do any of the other routers have reachable public IP.
If so what are the WAN throughputs of R2,R3,R4

Doberman · March 10, 2024, 10:28pm

Yep … left one R1 is server with public IP
WAN throughputs for other … some have public … some is behind NAT

If the GNS3 were helpful, I can send a file.

anav · March 11, 2024, 1:45pm

First setup is some fixes to primary setup and the second is for a backup.

Primary Wireguard Interface
R1 (Main Server Peer )

/interface wireguard peers
add allowed address - 10.3.2.2/32,10.21.30.0/24 interface=WG_mikrotik_R1 comment=“peer Router 2” public key=“*******************”
add allowed address - 10.3.2.3/32,10.22.30.0/24 interface=WG_mikrotik_R1 comment=“peer Router 3” public key=“##############”
add allowed address - 10.3.2.4/32,10.23.30.0/24 interface=WG_mikrotik_R1 comment=“peer Router 4” public key=“+++++++++++++”
{ add road warriors as required }

/ip route
add dst-address=10.21.30.0/24 gateway=WG_mikrotik_R1 routing-table=main
add dst-address=10.22.30.0/24 gateway=WG_mikrotik_R1 routing-table=main
add dst-address=10.23.30.0/24 gateway=WG_mikrotik_R1 routing-table=main

/ip filter rules
add chain=input action=accept dst-port=55555 protocol=udp comment=“wg handshake”
add chain=forward action=accept in-interface=WG_mikrotik_R1 dst-address=10.20.30.0/24 comment=“remote traffic incoming”
add chain=forward action=accept src-address=10.20.30.0/24 out-interface=WG_mikrotik_R1 comment=“allow local traffic to wg”
add chain=forward action=accept out-interface=WG_mikrotik-R1 in-interface=WG_mikrotik_R1 comment=“relay of peer traffic”

Example of routers 2,3,4 using 2, extrapolate to R3,R4

R2 ( Client Peer )

/interface wireguard peers
add allowed address - 10.3.2.0/26,10.20.30.0/24,10.22.30.0/24,10.23.30.0/24 interface=WG_mikrotik_R2
endpoint=85.86.87.30 endpoint-port=55555 persistent-keep-alive=25sec public key=“*******************”

/ip route
add dst-address=10.20.30.0/24 gateway=WG_mikrotik_R2 routing-table=main
add dst-address=10.22.30.0/24 gateway=WG_mikrotik_R2 routing-table=main
add dst-address=10.22.30.0/24 gateway=WG_mikrotik_R2 routing-table=main

/ip filter rules
add chain=forward action=accept in-interface=WG_mikrotik_R2 dst-address=10.21.30.0/24 comment=“remote traffic incoming”
add chain=forward action=accept src-address=10.21.30.0/24 out-interface=WG_mikrotik_R2 comment=“allow local traffic to wg”

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Back-up Wireguard for R2,R3,R4 ( R1 is not available and R3 will act as the Main router in this case ) - 10.44.44.0/24 is the backup wg subnet. R3 address is 10.44.44.3/24)
Note: We will need to modify current routes and add additional routes to the configs.

Secondary Wireguard Interface

R3 (BackUp Server Peer )

/interface wireguard peers
add allowed address - 10.44.44.2/32,10.21.30.0/24 interface=WG_backup_R3 comment=“peer to Router 2” public key=“*******************”
add allowed address - 10.44.44.4/32,10.23.30.0/24 interface=WG_backup_R3 comment=“peer to Router 4” public key=“##############”
{ add road warriors as required }

/ip filter rules
add chain=input action=accept dst-port=44555 protocol=udp comment=“wg handshake”
add chain=forward action=accept in-interface=WG_backup_R3 dst-address=10.22.30.0/24 comment=“remote traffic incoming”
add chain=forward action=accept src-address=10.22.30.0/24 out-interface=WG_backup_R3 comment=“allow local traffic to wg”
add chain=forward action=accept out-interface=WG_backup in-interface=WG_backup_R3 comment=“relay of peer traffic”

/ip route
add dst-address=10.20.30.0/24 gateway=WG_mikrotik_R3 routing-table=main
add check-gateway=ping distance=1 dst-address=10.21.30.0/24 gateway=WG_mikrotik_R3 routing-table=main
add check-gateway=ping distance=1 dst-address=10.23.30.0/24 gateway=WG_mikrotik_R3 routing-table=main
add distance=2 dst-address=10.21.30.0/24 gateway=WG_backup_R3 routing-table=main
add distance=2 dst-address=10.23.30.0/24 gateway=WG_backup_R3 routing-table=main

Example of routers 2,4 using 2, extrapolate to R4

R2 ( Client Peer )
/interface wireguard peers
add allowed address - 10.44.44.0/24,10.22.30.0/24,10.23.30.0/24 interface=WG_backup_R2
endpoint=IPCloudAddress(R3) endpoint-port=44555 persistent-keep-alive=35sec public key=“*******************”

/ip filter rules
add chain=forward action=accept in-interface=WG_backup_R2 dst-address=10.21.30.0/24 comment=“remote traffic incoming”
add chain=forward action=accept src-address=10.21.30.0/24 out-interface=WG_backup_R2 comment=“allow local traffic to wg”

/ip route
add dst-address=10.20.30.0/24 gateway=WG_mikrotik_R2 routing-table=main
add check-gateway=ping distance=1 dst-address=10.22.30.0/24 gateway=WG_mikrotik_R2 routing-table=main
add check-gateway=ping distance=1 dst-address=10.23.30.0/24 gateway=WG_mikrotik_R3 routing-table=main
add distance=2 dst-address=10.22.30.0/24 gateway=WG_backup_R2 routing-table=main
add distance=2 dst-address=10.23.30.0/24 gateway=WG_backup_R2 routing-table=main

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Doberman · March 11, 2024, 1:46pm

Dear guys, is this case so hopeless or still has a chance to find a solution?

Dear Anav … in same moment we send posts. I read your post … and I admit it look very interesting.

anav · March 11, 2024, 2:11pm

It will work just fine.
You have A primary wg network where all are connected.
In case R1 falls off line, you have a backup connection via R3 ( keeping r2,r3,r4 connected ) and any roadwarriors needing access.

What I suggest you do is setup a firewall list callled Authorized.

add address=10.3.2.11 list=Authorized comment=admin laptop wg-main
add address=10.3.2.12 list=Authorized comment=admin smartphone/ipad wg-main
add address=10.44.44.11 list=Authorized comment=admin laptop wg-backup
add address=10.44.44.12 list=Authorized comment=admin smartphone/ipad wg-backup
add address=10.20.30.11 list=Authorized comment=admin local IP-wired on R1
add address=10.21.30.11 list=Authorized comment=admin local IP-wired on R2
add address=10.22.30.11 list=Authorized comment=admin local IP-wired on R3
add address=10.23.30.11 list=Authorized comment=admin local IP-wired on R4
add address=10.20.30.12 list=Authorized comment=admin local IP-wifi on R1
add address=10.21.30.12 list=Authorized comment=admin local IP-wifi on R2
add address=10.22.30.12 list=Authorized comment=admin local IP-wifi on R3
add address=10.23.30.12 list=Authorized comment=admin local IP-wifi on R4

ON ALL FOUR ROUTERS you have
add chain=input action=accept in-interface-list=Authorized

Thus from any router or roadwarrior you can reach and config any device.

Doberman · March 11, 2024, 4:28pm

It will work just fine.
You have A primary wg network where all are connected.
In case R1 falls off line, you have a backup connection via R3 ( keeping r2,r3,r4 connected ) and any roadwarriors needing access.

What I suggest you do is setup a firewall list callled Authorized.

add address=10.3.2.11 list=Authorized comment=admin laptop wg-main
add address=10.3.2.12 list=Authorized comment=admin smartphone/ipad wg-main
add address=10.44.44.11 list=Authorized comment=admin laptop wg-backup
add address=10.44.44.12 list=Authorized comment=admin smartphone/ipad wg-backup
add address=10.20.30.11 list=Authorized comment=admin local IP-wired on R1
add address=10.21.30.11 list=Authorized comment=admin local IP-wired on R2
add address=10.22.30.11 list=Authorized comment=admin local IP-wired on R3
add address=10.23.30.11 list=Authorized comment=admin local IP-wired on R4
add address=10.20.30.12 list=Authorized comment=admin local IP-wifi on R1
add address=10.21.30.12 list=Authorized comment=admin local IP-wifi on R2
add address=10.22.30.12 list=Authorized comment=admin local IP-wifi on R3
add address=10.23.30.12 list=Authorized comment=admin local IP-wifi on R4

ON ALL FOUR ROUTERS you have
add chain=input action=accept in-interface-list=Authorized

Thus from any router or roadwarrior you can reach and config any device.

vauuuu …
like i said before … most valuable member

I worship the king

anav · March 11, 2024, 4:31pm

I lean on others for many answers so consider it a team effort.