Wireguard not reconect after route change

RouterOS General
1

Please help!

I have connected two MikroTik routers over WireGuard VPN. On the “server” MikroTik, we have two routes: a primary and a secondary (with distances 1 and 2). Everything works without problems until we disable the primary route on the “client” MikroTik.

MikroTik starts sending all traffic via the secondary route, and that works without issues. However, WireGuard stops working, and there is no ping until the MikroTik is restarted. After the restart, WireGuard works again. Before restarting, I tried disabling the interface and the peer, but only a restart gets everything working again.

On server side there is a active option Responder, on client side active option is Persistent-keepalive: 00:00:25

2

Post both configs to see what is going on.
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.).

Conceptually once a wireguard connection is established, both ends keep the other end up to date on the relevant WANIP.
Hence if the main router changes its main WANP from WAn1 to Wan2, the wireguard process includes the router informing the clieint of the new WANIP to connect to.
There should be a short delay in connectivity (could be related to the keep alive ping but not sure would have to read the docs again ), but it should come back up on its own.

3

Server:

/interface wireguard
add listen-port=51820 mtu=1420 name=wireguard1
/interface wireguard peers
add allowed-address=10.1.38.2/32,10.0.0.0/8 interface=wireguard1 is-responder=\
    yes name=wg-server-test public-key="hidden"

Client:

/interface wireguard
add listen-port=51820 mtu=1420 name=wireguard1
/interface wireguard peers
add allowed-address=10.1.38.1/32,10.0.0.0/8 endpoint-address=public_address \
    endpoint-port=51820 interface=wireguard1 name=peer2 persistent-keepalive=\
    25s public-key="hidden"
4

Two things I would change,
(1) On the Client for handshake change the allowed IPs from 10.1.38.1/32 to:
10.1.38.0/24

(2) The allowed Ips cannot include 10.0.0.0/8 on both routers! It is ONLY to identify either
a. remote subnet that local users need to reach OR
b. remote subnet whose users need to access your local subnet.

In other words, NO LOCAL subnets are placed in allowed IPs.

5

Thanks!