Hello. I am quite new to mikrotik but I was able to make a configuration that we could say “successful”
The router is a CCR2004-16G-2S+ (version 7.2.3)
Successfully implement a wireguard “server” with client connections from pc, cell phones, etc and also “lan<->lan”
I have 2 internet connections with public IPs by DHCP.
For wireguard to work assign different distances like 5 and 6 for wan1 and wan2
The problem, to be specific, is that I want wireguard to listen to both wans and respond correctly according to the wan connection for which I entered the request.
I was able to determine through the log that wireguard attends to both wans but the tunnel does not finish establishing itself in both. In the search for a solution, I left both WANs with identical distances, I marked connections and then routes and finally routing rules. All this without success.
The question in summary is:
Has anyone managed to configure with multiple wan connections where Wireguard attends and responds correctly according to the “wan” through which I enter?
I could not find practical examples on the Internet to take as a reference and then adapt it to my scenario.
I feel like I may be attempting something impossible to accomplish with a single router and would like your opinion if I am attempting an impossible configuration.
Thank you in advance for your time and any comments on the matter will be welcome.
D v 0.0.0.0/0 pppoe-out-ont-1 2
DAv 0.0.0.0/0 pppoe-out-ont-2 1
DAc + 2.176.192.1/32 pppoe-out-ont-1 0
DAc + 2.176.192.1/32 pppoe-out-ont-2 0
26 As 0.0.0.0/0 pppoe-out-ont-1 1
30 As 0.0.0.0/0 pppoe-out-ont-2 1
I think the problem is wireguard tries to send replies from default routing not marked one, I got it when i changed my mobile client address to the default gateway of mikrotik then works but I cannot connect to other wan.
if any idea thanks in advance.
Lets deal with one person at a time please it gets too confusing otherwise.
YOu need to state the requirements that make sense in terms of not what you want, but what should the users be able to do.
Identify users/groups of users and what they should be able to do and not be able to do. (also detail separately the admin).
Provide a network diagram so we have context of what MT devices or not are involved and the type of WANIP (public/private, static, dynamic) etc, without the actual real numbers of course.
Provide th FULL config of any MT devices involved at both ends.]
/export minus public WANIP info and serial numbers.
Then we can start to make think about a config that makes sense.
Reality check, the initiator of the connection is responsible for contacting and connecting to the receiver.
I dont think its possible for the receiver to do what is being asked.
If you want WAN1 to respond to wireguard interface A at port XXXXX
If you want WAN2 to respond to wireguard interface B at port YYYYY
Then I dont see why it shouldnt work,as the initiial connection will work and traffic will flow??
Firewall rules and IP routes take care of the rest.
Forward chain rules LAN traffic - strictly deal with entering the wg interface from the LAN and exiting the wg interface going to the LAN. Just ensure you have enough detail on the firewall rules to identify the source traffic and destination traffic etc, so the router can keep track of where the traffic originated.
Thus we are left with the IP routes issue.
Again, remote traffic to subnets returning to the tunnel simply requiire a route to the wg interface.
NOTE OTHER CASE: Primary-Failover (single dydns name with two records so when one goes down the dyndns name is stiill valid for the other record) - you still need two wireguard interfaces
++++++++++++++++++++++++++++++++++++++++++++++++++++++
Thus I fail to see the problem yet, please show me where the errors will occur??
( the use cases from the user perspective that wont work).
A. Dual WAN with PCC
B. Dual WAN with primary and failover
C. Dual WAN vlans 1-5 go through WAN1, vlans6-10 go through WAN2 (both active and with or without failover to other WAN).
D. Dual WAN with Primary WAN1 /Failover WAN2, where one subnet should always use WAN2
Without specifics the question is too vague.
Then you need to DEFINE< how you want users to access the Receiving router.
Is it by DYDNSNAME:port number ( does your dyndns have access to two records aka WAN1 and WAN2 )
Is it by TWO DYNDNS names (1/2 users got to WAN1 and 1/2 users go to WAN2)
Is it by DYNDNSNAME whiich is the IP Cloud name ??
ON wireguard,
How many interfaces do you want to use for this…assumign one wireguard interface.
What are the needs of the remote users (access servers, or internet).
What are the needs of the local users (access servers at remote sites, internet at remote sites, for the admin to access config at remote sites)???
pppoe connection without public IP (X.X.X.X) to which local IP is assigned (Xl.Xl.Xl.Xl) from the range 172.16.0.0/24
DHCP-client connection with public IP (Y.Y.Y.Y) to which local IP is assigned (Yl.Yl.Yl.Yl) from the range 10.0.0.0/24
I have a remote client that would like to connect to WAN2 over wireguard so it tries to connect to Y.Y.Y.Y on port 33677 (as in example). It enters fine and the communication goes well throught the whole firewall rules. I assign the connection-mark WAN2_to_router with a mangle rule to identify the connection later.
As soon as the incoming communication is processed on IP Yl.Yl.Yl.Yl, the outgoing (src) communication goes from another interface on IP Xl.Xl.Xl.Xl. Even though it could have, I still assigned the WAN2_to:router connection mark previously but it got stripped so I cannot force it to assing a new routing-mark WAN2.
This is the log from firewall which I hope clears it up a little bit. I simply cannot force the outgoing communication to continue with the same src address as the incoming communication. I also looked at the packet flow but still cannot find a way to force the packets leave on the same interface.
I have similar mangle rules applied. Basically I need to:
mark connection on mangle input with a connection mark
route connection on mangle output with a routing mark
What happens though is that within routing decision the dst address 10.27.11.139 on eth01 (WAN2) is changed to src address 172.28.168.20 on pppoe (WAN1). For some reason it switches the outgoing interface and drops the connection mark anyways so it behaves as if it was a completely new connection. Also it set the connection-state to new, as if it was not replying.
I have a similar setup and am seeing the same issue. The connection comes in one WAN interface but for some reason the reply source is a different WAN interface.
that may be true jkaufman its because your config is screwy, same with all others reporting here.
Network diagram
full configs
otherwise its all conjecture, and a waste of time
I use this config with OpenVPN and works well, but with WireGuard I got this same problem: the connection gets the connection-mark based on the eth input, but the reply goes always by the default route (eth1 in my case), checked in the ROS sniffer. In the firewall connections list there’s no reply, just the incoming data so looks like the reply of the WireGuard is done in a different connection and so the routing-mark is not present.
As I said, OVPN works fine with inputs from eth1 and eth2, but WireGuard just from eth1 as the reply packages get new connection status and lost the connection mark of eth2.
The VPN range is 10.8.1.0/24 and the LAN is 192.168.10.0/24.
The VPN is intended for traffic only LAN related, not all internet traffic so the client is configured according.
Overall cannot see anything that would be stopping wireguard traffic.
(1) I would put in an explicit allow rule just to be sure on the forward chain
FROM add action=drop chain=forward comment=
“descarta conexoes vindas da internet que nao tenham base no nat”
connection-nat-state=!dstnat connection-state=new in-interface-list=wan
TO:
add action=accept chain=forward in-interface=wireguard1 out-interface-list=LAN add action=drop chain=forward comment=
“descarta conexoes vindas da internet que nao tenham base no nat”
connection-nat-state=!dstnat connection-state=new in-interface-list=wan
WINDOWS CLIENT
(2) Client Address incorrect
FROM:
10.8.1.100/24
TO:
10.8.1.100/32
