WireGuard MT-Server/Android-Client

[bourneagainsh]

First comment, you should upgrade to the stable 7.1.1 version.

The single android device should have an IP in this format I think?
– Addresses: 10.1.101.2/32 (single IP) ?? The rest of the client looked fine…


TO
/interface wireguard peers add allowed-address=10.1.101.2/32 endpoint-port=13231 interface=wireguard1 public-key=“PUB-KEY-ANDROID=”
/ip address add address=10.1.101.1/24 network=10.1.101.0 interface=wireguard1
/ip route add dst-address=10.1.101.0/24 gateway=wireguard1 (not required since you have the IP address above !!!
/ip firewall filter add action=accept chain=input dst-port=13231 protocol=udp { good although you could be more accurate and state in-interface-list=WAN }

If you didnt use a firewall address list, the the IP routes would not be created dynamically and you would need the dst-route.
dst-address=10.1.101.2/32 gwy=wireguard interface

If you are going to have multiple single android devices and various IPs, then ensure you use single IPs within the subnet described by the IP address and you are good to go.

Sure, I am already on 7.1.1 but back in November when I posted it was still 7.1rc6

Yes, you are right, my mistake ammended: That should be 10.1.101.1/32 for the first client?
/interface wireguard peers print
/interface wireguard peers edit number=0 allowed-address
10.1.101.1/32
Ctrl+o=save&quit

My Android Client has Interface - Address 10.1.101.1/32



/ip address print
/ip address disable numbers=1
/ip address add address=10.1.101.1/24 network=10.1.101.0 interface=wireguard1 #should that not be 10.1.101.0/24?
/ip address print
Flags: X, D - DYNAMIC
Columns: ADDRESS, NETWORK, INTERFACE

ADDRESS NETWORK INTERFACE

;;; defconf
0 192.168.88.1/24 192.168.88.0 bridge
1 X 10.255.255.1/30 10.255.255.0 wireguard1
2 D xxx.xxx.xxx.xxx/26 xxx.xxx.xxx.xxx ether1
3 10.1.101.1/24 10.1.101.0 wireguard1




/ip firewall filter print
ip firewall filter edit number=7 value-name=in-interface-list
WAN
Ctrl+o=save&quit

/ip route print
Flags: D - DYNAMIC; A - ACTIVE; c, d, y - COPY
Columns: DST-ADDRESS, GATEWAY, DISTANCE

DST-ADDRESS GATEWAY DISTANCE
DAd 0.0.0.0/0 xxx.xxx.xxx.xxx 1
DAc 10.1.101.0/24 wireguard1 0
DAc xxx.xxx.xxx.xxx/26 ether1 0
DAc 192.168.88.0/24 bridge 0


But now the tunnel does not work at all Ups.