Wireguard on Android not getting internet

Zazaer · February 17, 2024, 12:53am

Hello! Fellow Mikrotikers, Recently I decided to join the Mikrotik community changing over from Ubiquiti. I’m more of a hobbyist than a professional. So far the setup of my HAP Ax3 and been successful except during the setup of Wireguard. I’ve been following the guides I’ve found on the internet.
What I’ve done

I’ve a static Public IP
Setup Wireguard
My mobile is able to connect to wireguard

My Issue is i have no internet once my wireguard is connected to my mobile and it seems like my android mobile is unable to resolve the DNS.
I’ve been cracking my head for over 2 days and losing sleep over this. Please help!
Below is my router config

# 2024-02-17 08:39:20 by RouterOS 7.13.4
# software id = A2BN-0QWI
#
# model = C53UiG+5HPaxD2HPaxD
# serial number = 
/interface bridge
add admin-mac= arp=proxy-arp auto-mac=no comment=defconf \
    name=Bridge port-cost-mode=short
/interface ethernet
set [ find default-name=ether1 ] name="ether1[WAN]"
/interface wifi
set [ find default-name=wifi1 ] channel.skip-dfs-channels=10min-cac \
    configuration.country=Singapore .mode=ap .ssid=Hoooob!-R \
    security.authentication-types=wpa2-psk,wpa3-psk
set [ find default-name=wifi2 ] channel.skip-dfs-channels=10min-cac \
    configuration.country=Singapore .mode=ap .ssid=Hoooob!-R \
    security.authentication-types=wpa2-psk,wpa3-psk
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=dhcp ranges=192.168.1.100-192.168.1.254
/ip dhcp-server
add address-pool=dhcp interface=Bridge lease-time=8h name=defconf
/interface bridge port
add bridge=Bridge comment=defconf interface=ether2 internal-path-cost=10 \
    path-cost=10
add bridge=Bridge comment=defconf interface=ether3 internal-path-cost=10 \
    path-cost=10
add bridge=Bridge comment=defconf interface=ether4 internal-path-cost=10 \
    path-cost=10
add bridge=Bridge comment=defconf interface=ether5 internal-path-cost=10 \
    path-cost=10
add bridge=Bridge comment=defconf interface=wifi1 internal-path-cost=10 \
    path-cost=10
add bridge=Bridge comment=defconf interface=wifi2 internal-path-cost=10 \
    path-cost=10
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes
/interface list member
add comment=defconf interface=Bridge list=LAN
add comment=defconf interface="ether1[WAN]" list=WAN
add interface=wireguard1 list=LAN
/interface ovpn-server server
set auth=sha512 certificate=server-cert cipher=aes256-cbc,aes256-gcm \
    default-profile=VPN-Profile require-client-certificate=yes tls-version=\
    only-1.2
/interface wireguard peers
add allowed-address=192.168.2.0/24,192.168.1.0/24 comment="to Mobile" \
    interface=wireguard1 persistent-keepalive=10s private-key=\
    "" public-key=\
    "="
/ip address
add address=192.168.1.1/24 comment=defconf interface=Bridge network=\
    192.168.1.0
add address=192.168.2.1/24 interface=wireguard1 network=192.168.2.0
/ip dhcp-client
add comment=defconf interface="ether1[WAN]"
/ip dhcp-server network
add address=192.168.1.0/24 comment=defconf dns-server=192.168.1.1 gateway=\
    192.168.1.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.1.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="Allow wireguard" dst-port=13231 \
    protocol=udp
add action=accept chain=forward comment="Wg to Internet" in-interface=\
    wireguard1 out-interface-list=WAN
add action=accept chain=forward comment="Wg to Lan Traffic" in-interface=\
    wireguard1 out-interface-list=LAN
add action=accept chain=input comment="allow WireGuard Traffic" src-address=\
    192.168.2.0/24
add chain=forward in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward connection-nat-state=dstnat
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    disabled=yes in-interface-list=!LAN log=yes
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new disabled=yes in-interface-list=WAN
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface=wireguard1
add action=dst-nat chain=dstnat comment=OpenVPN-NAS dst-port=4500 \
    in-interface-list=WAN protocol=udp to-addresses=192.168.1.4 to-ports=4500
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.1.0/24,192.168.2.0/24
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Asia/Singapore
/system logging
add topics=ovpn,info
add topics=ovpn,debug
/system note
set show-at-login=no
/system routerboard settings
set auto-upgrade=yes
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Zazaer · February 17, 2024, 7:02am

Some updates on my further testing, I was lurking on the forum and read that it could be my phone problem so i tested on another android tablet.
The current behavior I’m getting is once connected on wireguard on my devices,
the transfer rx:0 B and the tx: is constantly increasing. Seems like i’m not receiving any packets from the router.

Mesquite · February 17, 2024, 1:35pm

Firstly, it would be necessary to see the wireguard config on the android phone as well for a complete assessment. I suspect errors there as well.

Second remove actual keys from your config before posting!! ( and go back and remove them from your post if that is the case )
As for the router…

Assuming the router is the server for handshake, you dont need keep alive, that is a client function not a server function. Remove it.
I believe only the public key shows on the config for Peers, at allowed addresses, so not sure why the private key was there, if you added it, remove it???
Allowed IPs are wrong! This is a peer to peer network with a single device as client,
a. how could it have multiple IP addresses?
b. how could it have two wireguard addresses?
c. How could it be a subnet address??]

_/interface wireguard peers
add allowed-address=192.168.2.0/24,192.168.1.0/24 comment=“to Mobile”
interface=wireguard1 persistent-keepalive=10s private-key=_

Should be
/interface wireguard peers
add allowed-address=192.168.2.2/32 comment=“to Mobile”
interface=wireguard public-key=////////////////

You can remove the static IP DNS settings,
/ip dns static
add address=192.168.1.1 comment=defconf name=router.lan
YOur firewall rules are.
a. not in proper order
b. disorganized in that the chains are not together for easy reading and thus troubleshooting.

Rather its clear you do not understand the firewall rules, lots of repetition (redundant rules) as well.

Why are you masquerading your wireguard interface ???
Point of completeness, ipv6 is disabled, you can remove all the associated nonused config like ipv6 firewall rules and address lists.

Zazaer · February 17, 2024, 5:09pm

Hi Mesquite, thank you so much for the reply. It has been quite helpful. Apologies for the firewall rules are in a mess. I’ve been doing the configurations in the middle of the night after I put my kids to bed.

Firstly, it would be necessary to see the wireguard config on the android phone as well for a complete assessment. I suspect errors there as well.

Second remove actual keys from your config before posting!! ( and go back and remove them from your post if that is the case )
As for the router…

Assuming the router is the server for handshake, you dont need keep alive, that is a client function not a server function. Remove it.

I believe only the public key shows on the config for Peers, at allowed addresses, so not sure why the private key was there, if you added it, remove it???

Allowed IPs are wrong! This is a peer to peer network with a single device as client,
a. how could it have multiple IP addresses?
b. how could it have two wireguard addresses?
c. How could it be a subnet address??]

/interface wireguard peers
add allowed-address=192.168.2.0/24,192.168.1.0/24 comment=“to Mobile”
interface=wireguard1 persistent-keepalive=10s private-key=\

Should be
/interface wireguard peers
add allowed-address=192.168.2.2/32 comment=“to Mobile”
interface=wireguard public-key=////////////////

I followed your recommendations and reviewed all the setup steps and it is working now! It was a misconfiguration on the allowed address on the wireguard peers on both ends.
I didn’t notice that my public and private keys were there, I’ve completely changed the public key to a new set removing the private key

You can remove the static IP DNS settings,
/ip dns static
add address=192.168.1.1 comment=defconf name=router.lan

I’ve removed this

YOur firewall rules are.
a. not in proper order
b. disorganized in that the chains are not together for easy reading and thus troubleshooting.

Rather its clear you do not understand the firewall rules, lots of repetition (redundant rules) as well.

I’ve sorted out the firewall rules and removed the redundant/duplicated rules

Why are you masquerading your wireguard interface ???

I was reading on the forums and some of the threads suggested that it may work hence i decided to try it although i know it doesn’t make sense

Point of completeness, ipv6 is disabled, you can remove all the associated nonused config like ipv6 firewall rules and address lists.

I’ve removed them all.

Thank you so much Mesquite for your help and patiently responding and looking through the mess of my firewall rules. Couldn’t have done this without your help!

Mesquite · February 18, 2024, 3:52am

No worries, learning can be fun with an open mind!!
In terms of the sourcenat question.
A general rule of thumb is that when the router is a server for handshake, it means more than likely client peers are going to connect to the router and access either the subnets or the internet.
In this case, its makes more sense for the Wireguard to be made part of the LAN interface → due to the firewall rules which in my case include
allowing the LAN list to reach DNS services on the input chain and allowing LAN list to the WAN in forward chain etc…

Another general rule of thumb is that when a router is not the server for handshake but a client, then its likely its going to visit subnets at the remote server router via the tunnel and then the likelihood of source nat increases. It depends mainly on if you have control over the distant router and if so can put your MT subnets on the remote server router allowed IPs peer settings and all is good.

However, if not and more specifically in the case where people are connecting to THIRD PARTY VPN providers, is pretty much required to use sourcenat.
The reason being is that the third party sites give you one IP address and thus we use sourcenat to give the assigned IP address as source vice all the subnet source addresses which would not work.
There are two ways to do this…
a. make a separate source nat rule for the out-interface=wireguard

/ip firewall nat
add action=masquerade chain=srcnat out-interface=wireguard1

OR

b. simply add the wireguard interface, this time to the WAN interface list and then we can take advantage of the default sourcenat rule already on the router.
We no longer need to add a rule, because the wireguard interface is now included in the default one.

/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN