Hi,
I have two VLANS on my network SOHO (vlan=10) and GUEST (vlan=20).
I configured WinGuard with two endpoints:
- Windows Computer
- Android Phone(/list]
Both establish a connection to the Mikrotik (I can see traffic on the Peer) but I am not able to access local resources.
On the Windows Computer I have Block untunnel traffic (kill-switch) unchecked. i am able to surf the internet
On the Android phone I have Exclude private IPS unchecked.
- I would like WireGuard to operate on vlan=10. How can I do that?
- In WireGuard, (following a non Mikrotik video), I set the DNS to 8.8.8.8. When I set it to 192.168.66.1 (WireGuard address), it fails.
Thanks
# 2024-11-17 17:01:38 by RouterOS 7.16.1
# software id = YYB5-JQXK
#
# model = C53UiG+5HPaxD2HPaxD
/interface bridge
add admin-mac=D4:01:C3:9E:zz:ff auto-mac=no comment=defconf name=BR1 \
vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] comment="Connected to ISP"
set [ find default-name=ether2 ] comment="Connected to Unifi AP"
set [ find default-name=ether3 ] comment="Connected to fff"
set [ find default-name=ether4 ] comment="Connected to fff"
set [ find default-name=ether5 ] comment="Connected to fff"
/interface wireguard
add listen-port=13231 mtu=1420 name=HOMENET-WireGuard
/interface vlan
add interface=BR1 name=GUEST_VLAN vlan-id=20
add arp=proxy-arp interface=BR1 name=SOHO_VLAN vlan-id=10
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=VLAN
add name=BASE
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no name=WIFI_SOHO
add authentication-types=wpa2-psk,wpa3-psk disabled=no name=WIFI-GUEST
/interface wifi configuration
add country=Malta disabled=no mode=ap name=GUEST-Configuration security=\
WIFI-GUEST ssid=GUESTS-AP
add country=Malta disabled=no mode=ap name=SOHO-Configuration security=\
WIFI_SOHO ssid=AP-HOMENET
/interface wifi
set [ find default-name=wifi2 ] channel.band=2ghz-ax .skip-dfs-channels=\
10min-cac .width=20/40mhz configuration=SOHO-Configuration \
configuration.mode=ap disabled=no name=wlan-SOHO-2G \
security.authentication-types="" .ft=yes .ft-over-ds=yes
set [ find default-name=wifi1 ] channel.band=5ghz-ax .skip-dfs-channels=\
10min-cac .width=20/40/80mhz configuration=SOHO-Configuration \
configuration.mode=ap disabled=no name=wlan-SOHO-5G security=WIFI_SOHO \
security.authentication-types="" .ft=yes .ft-over-ds=yes
add channel.band=5ghz-ax .skip-dfs-channels=10min-cac .width=20/40/80mhz \
configuration=GUEST-Configuration configuration.mode=ap disabled=no \
mac-address=D4:01:C3:9E:58:83 master-interface=wlan-SOHO-2G name=\
wlan-GUEST-2G security.authentication-types="" .ft=yes .ft-over-ds=yes
add channel.band=2ghz-ax .skip-dfs-channels=10min-cac .width=20/40mhz \
configuration=GUEST-Configuration configuration.country=Malta .mode=ap \
disabled=no mac-address=D4:01:C3:9E:58:84 master-interface=wlan-SOHO-5G \
name=wlan-GUEST-5G security.authentication-types="" .ft=yes .ft-over-ds=\
yes
/ip pool
add name=GUEST_POOL ranges=10.0.20.2-10.0.20.254
add name=SOHO_POOL ranges=192.168.16.20-192.168.16.99
/ip dhcp-server
add address-pool=SOHO_POOL interface=SOHO_VLAN name=SOHO_DHCP
add address-pool=GUEST_POOL interface=GUEST_VLAN name=GUEST_DHCP
/ppp profile
set *0 use-upnp=no
set *FFFFFFFE use-upnp=no
/disk settings
set auto-media-interface=BR1 auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=BR1 interface=ether2 pvid=10
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged interface=\
ether3 pvid=10
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged interface=\
ether4 pvid=10
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged interface=\
ether5 pvid=10
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged interface=\
wlan-SOHO-5G pvid=10
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged interface=\
wlan-SOHO-2G pvid=10
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged interface=\
wlan-GUEST-5G pvid=20
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged interface=\
wlan-GUEST-2G pvid=20
/ip neighbor discovery-settings
set discover-interface-list=BASE
/interface bridge vlan
add bridge=BR1 tagged=BR1,ether2 untagged=\
ether3,ether4,ether5,wlan-SOHO-5G,wlan-SOHO-2G vlan-ids=10
add bridge=BR1 tagged=BR1,ether2 untagged=wlan-GUEST-5G,wlan-GUEST-2G \
vlan-ids=20
/interface list member
add comment=defconf interface=BR1 list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=SOHO_VLAN list=VLAN
add interface=GUEST_VLAN list=VLAN
add interface=SOHO_VLAN list=BASE
add interface=HOMENET-WireGuard list=VLAN
/interface wireguard peers
add allowed-address=192.168.66.2/32 interface=HOMENET-WireGuard name=\
ACB-Laptop public-key="w8LznG02jCqC5wT1ZluQOV0OsBCc9a0scHKc//jAOzw="
add allowed-address=192.168.66.3/32 interface=HOMENET-WireGuard name=\
ACB-OnePlus public-key="t/AdlTX6N7CDunILMQPbpJHnT7/SiQIV0IEYOjzBxkk="
/ip address
add address=192.168.16.1/24 interface=SOHO_VLAN network=192.168.16.0
add address=10.0.20.1/24 interface=GUEST_VLAN network=10.0.20.0
add address=192.168.66.1/24 comment="Wireguard interface" interface=\
HOMENET-WireGuard network=192.168.66.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server
add address-pool=*1 interface=BR1 name=defconf
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8,9.9.9.9,8.8.4.4
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=Wireguard dst-port=13231 protocol=udp
add action=drop chain=forward comment="Drop SMTP traffic" dst-port=25 log=yes \
protocol=tcp
add chain=input comment="Allow all ICMP" protocol=icmp
add action=accept chain=input comment=\
"Allow Establised and Related Connections" connection-state=\
established,related
add action=accept chain=input comment="Allow VLAN" in-interface-list=VLAN
add action=accept chain=forward comment="Allow Estab & Related" \
connection-state=established,related
add action=accept chain=forward comment="VLAN Internet Access only" \
connection-state=new in-interface-list=VLAN out-interface-list=WAN
add action=accept chain=forward connection-nat-state=dstnat
add action=accept chain=forward comment=\
"Source: https://forum.mikrotik.com/viewtopic.php\?f=2&t=171682" \
in-interface=all-ppp out-interface=SOHO_VLAN
add action=accept chain=forward comment=\
"Source: https://forum.mikrotik.com/viewtopic.php\?f=2&t=171682" \
in-interface=SOHO_VLAN out-interface=all-ppp
add action=drop chain=input comment=Drop
add action=drop chain=forward comment=Drop
/ip firewall nat
add action=masquerade chain=srcnat comment="Hairpin NAT" ipsec-policy=\
out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment="HTTP (VM-onN)" dst-address=\
77.aa.bb.cc dst-port=80 protocol=tcp to-addresses=192.168.16.11
add action=dst-nat chain=dstnat comment="HTTPS (VM-onN)" dst-address=\
77.aa.bb.cc dst-port=443 protocol=tcp to-addresses=192.168.16.11
add action=dst-nat chain=dstnat comment="SFTP (VM-BITV)" dst-address=\
77.aa.bb.cc dst-port=5552 protocol=tcp to-addresses=192.168.16.12 \
to-ports=22
add action=dst-nat chain=dstnat comment="Plex (SRV-PLEX)" dst-address=\
77.aa.bb.cc dst-port=52400 protocol=tcp to-addresses=192.168.16.8 \
to-ports=32400
add action=dst-nat chain=dstnat comment="Synology WebDAV" dst-address=\
77.aa.bb.cc dst-port=5006 protocol=tcp to-addresses=192.168.16.253 \
to-ports=5006
add action=dst-nat chain=dstnat comment=uBT dst-address=77.aa.bb.cc \
dst-port=53501 protocol=tcp to-addresses=192.168.16.9 to-ports=53501
add action=masquerade chain=srcnat comment="WireGuard NAT rule" src-address=\
192.168.66.0/24
/ip service
set telnet disabled=yes
set ftp disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=input comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
add action=accept chain=forward comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=forward comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
/system clock
set time-zone-name=Europe/Malta
/system note
set show-at-login=no
/system routerboard mode-button
set enabled=yes on-event=dark-mode
/system routerboard wps-button
set enabled=yes on-event=wps-accept
/system script
add comment=defconf dont-require-permissions=no name=dark-mode owner=*sys \
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
source="\r\
\n :if ([system leds settings get all-leds-off] = \"never\") do={\r\
\n /system leds settings set all-leds-off=immediate \r\
\n } else={\r\
\n /system leds settings set all-leds-off=never \r\
\n }\r\
\n "
add comment=defconf dont-require-permissions=no name=wps-accept owner=*sys \
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
source="\r\
\n :foreach iface in=[/interface/wifi find where (configuration.mode=\"a\
p\" && disabled=no)] do={\r\
\n /interface/wifi wps-push-button \$iface;}\r\
\n "
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
