Wireguard peer as exit node

RouterOS General
1

I want to add Mikrotik into a Wireguard network AS A PEER (not server), but then I would like to use this Mikrotik (which is a peer, not a server!) as a default gateway for my laptop.

The point is, I live in a country A, but my Mikrotik router is in country B. And it is behind the NAT. What I am trying to achieve is to be able to access internet from country's B IP address. However, I do not want that devices behind Mikrotik use default gateway from my Wireguard server. So Mikrotik will use exit IP of country B, NOT country A.

OK, this is what I did.

I have Mikrotik hAP lite. First I updated RouterOS to "testing", because Wireguard support is in RouterOS v7 and my "stable" channel offered only v6. I got version 7.12.1, but then switched back to "stable", updated, and now I have RouterOS v 7.15.3.

Then I created new interface called "wireguard1":

/interface/wireguard/add listen-port=51820 name=wireguard1

My Wireguard server is in country A, and I entered it's IP address (endpoint-address), Wireguard port (endpoint-port, which is default 51194) and my Wireguard server's public key (public-key):

/interface/wireguard/peers
add allowed-address=10.10.7.0/24 endpoint-address=xx.xxx.xx.xxx endpoint-port=51194 interface=wireguard1 persistent-keepalive=5s public-key="wireguard-server-public-ip"

When you create Wireguard interface, Microtik creates public and private key. So I print the Microtik's public key:

/interface/wireguard/print
Flags: X - disabled; R - running
0 R name="wireguard1" mtu=1420 listen-port=51820 private-key="********" public-key="**********"

Then I logged into my Wireguard server and added Mikrotik's public key and IP address into the "wg0.conf":

[Peer]

Mikrotik

PublicKey = **********
AllowedIPs = 10.10.7.155/32

Then I went back to Mikrotik and added this Wireguard VPN IP address to the "wireguard1" interface:

/ip address
add address=10.10.7.155/32 interface=wireguard1

As I understand, this setting also means that Mikrotik will NOT use default gateway from the Wireguard server, right?

Then I needed to set up route to my Wireguard network:

/ip route
dst-address=10.10.7.0/24 gateway=wireguard1

Finally, I needed to allow input traffic from my Wireguard network to Mikrotik:

/ip/firewall/filter
add action=accept chain=input comment="Access from my Wireguard network" in-interface=wireguard1 protocol=tcp src-address=10.10.7.0/24

Unfortunately, I do not know how to move that rule more on the top, so I opened menu IP > Firewall and moved the rule to the second place manually.

Also, I do not know how to add Preshared key from console, so I went to Wireguard > Peers and added PresharedKey that I created on a Wireguard server (and added it to "wg0.conf".

I restarted Wireguard on a server (systemctl restart wg-quick@wg0.service), and Mikrotik was connected to my Wireguard server! And it is also accessible through my VPN, from the VPN IP address 10.10.7.155.

So far, so good, but now comes the second part.

Now I would like to use Mikrotik as default gateway for my laptop. So I will be accessing internet with with IP from country B.

As someone explained me, I need to change the [Peer] configuration for Mikrotik ON A SERVER to have 0.0.0.0/0 as its AllowedIPs, so that WireGuard would internally route all "Internet" packets towards that peer.

Then I need to make sure the WG config tool (wg-quick) does not copy that into the server's main routing table, so I need to specify a custom Table= to turn this off. I do not know how to do this.

Also, they suggested to have a separate tunnel config for the Mikrotik (additional Wireguard interface), that this would let me move this specific route without affecting all regular clients' routes.

The the person states: "Once you have the 0.0.0.0/0 route in a separate table, use ip rule to hook it up – make the server select that routing table for packets 'from' client 1. (This should result in packets from wg0 going right back into the same wg0.)"

Also, don't know how to do that. And finally, I would probably need to apply src-nat (masquerade) rule to these packets coming from Wireguard network to Mikrotik.

2

/ip firewall filter print chain=input will list the firewall rules with reference numbers
/ip firewall filter move N destination=M will move rule with reference number N before rule with reference number M.


That’s a huge simplification (or an “executive summary”) - what you actually need to do in order that your laptop would access internet via the Wireguard tunnel to that Mikrotik is that you make your Wireguard server route the traffic coming from your laptop to that tunnel.


That is indeed necessary, but it is again not the complete information. The Wireguard subsystem, much like the OpenVPN one, kind of acts as a virtual router inside the actual one - the Wireguard stack receives a packet from the main router via the Wireguard interface and then searches through the allowed-address lists of peers to find the one to which the destination address of that packet matches. In RouterOS, such a search goes first (top) to last (bottom) until first match, so if there is only a single peer with allowed-addresses=0.0.0.0/0 and you place it as the very last one in the list of peers, it may work. But I’m not sure the search strategy is the same in case of bare Linux implementation of Wireguard, and it will definitely not work if you need distinct Wireguard peers to provide routes to internet to distinct local clients.


I’m not sure what you are talking about here, unless the Wireguard stack on Linux propagates routes to the allowed-address prefixes of all its peers to the main routing table.


This is definitely necessary if some other Wireguard peers need to serve as routes to internet for other local clients than your laptop. If an additional Wireguard interface with its own independent collection of peers is easy to set up on Linux, it is also the least complicated way to achieve the overall goal.


Indeed, a separate routing table is necessary whenever you want to route packets based on anything else but their destination address. So ideally you would create a named routing table, let’s name it wonderland, make the dedicated instance of Wireguard interface the gateway of a single default route in that table, and use (if on Linux) ip rule add from lap.top.add.ress table wonderland to make sure that packets coming with the source address of your laptop will use that table.


What is the operating system of your Wireguard server?


In the default configuration of the Mikrotik, whatever leaves through WAN gets src-nated, but you need to set up the firewall filter so that it would allow packets that come in via the Wireguard tunnel to leave via WAN. Also, the allowed-address of the Wireguard peer on the Mikrotik must contain also the address of the laptop, or there must be another src-nat rule on the Wireguard server.


In summary, do not expect more useful instructions until you provide the current configuration of the Mikrotik and of the Wireguard server, and if the laptop does not share a subnet with the Wireguard server, also the toploogy of the network. So not forget to remove all passwords, private keys, public addresses etc. before posting the configurations.

3

OK, so Wireguard server is running Debian.

sudo cat /etc/wireguard/wg0.conf

[Interface]
Address = 10.10.7.1/24
PostUp = /etc/wireguard/add-nat-routing.sh
PostDown = /etc/wireguard/remove-nat-routing.sh
ListenPort = 51194
PrivateKey = xxx

[Peer]
# My (Ubuntu) laptop
PublicKey = xxx
PresharedKey = xxx
AllowedIPs = 10.10.7.2/32

[Peer]
# Mikrotik
PublicKey = xxx
PresharedKey = xxx
AllowedIPs = 10.10.7.155/32

sudo cat /etc/wireguard/add-nat-routing.sh

#!/bin/bash
IPT="/sbin/iptables"

IN_FACE="ens3"                   # NIC connected to the internet
WG_FACE="wg0"                    # WG NIC
SUB_NET="10.10.7.0/24"           # WG IPv4 sub/net aka CIDR
WG_PORT="51194"                  # WG udp port

## IPv4 ##
$IPT -t nat -I POSTROUTING 1 -s $SUB_NET -o $IN_FACE -j MASQUERADE
$IPT -I INPUT 1 -i $WG_FACE -j ACCEPT
$IPT -I FORWARD 1 -i $IN_FACE -o $WG_FACE -j ACCEPT
$IPT -I FORWARD 1 -i $WG_FACE -o $IN_FACE -j ACCEPT
$IPT -I INPUT 1 -i $IN_FACE -p udp --dport $WG_PORT -j ACCEPT

# Peers can see each other
$IPT -I FORWARD -i $WG_FACE -o $WG_FACE -j ACCEPT

Mikrotik configuration is “standard”. It is behind PON and is getting IP address from DHCP. And acts as WiFi access point with two Ethernet devices connected.

admin@Mikrotik > ip firewall export 
/ip firewall connection tracking
set udp-timeout=10s
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=accept chain=input comment="Access from my Wireguard network" in-interface=wireguard1 protocol=tcp src-address=10.10.7.0/24
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip firewall service-port
set sip disabled=yes
4

OK, another idea?

Is it possible to run OpenVPN server or IPSec on a Mikrotik, and then I connect to OpenVPN/IPSec server through Wireguard connection? I know there will be some overhead, but still…

5

On a worldwide forum, owls may talk to early birds, and each of them may be in another time zone, so you cannot expect immediate answers :slight_smile:

Issue #1 is that this is a Mikrotik forum and you effectively seek advice for Linux (Debian), and the people fluent in Linux are just a subset of forum members.


Issue #2 is that I am not a huge fan of Wireguard so I am not familiar with the details of its operation on Linux; from what you have posted, the add-nat-routing.sh script only modifies the firewall (iptables), but from what other people in the internet ask, it seems that a firing up a WG interface also modifies the routing on the server. So I went to the original source, man wg-quick, and found the following:

It infers all routes from the list of peers’ allowed IPs, and automatically adds them to the system routing table. If one of those routes is the default route (0.0.0.0/0 or ::/0), then it uses ip-rule(8) to handle overriding of the default gateway.


  • Table — Controls the routing table to which routes are added. There are two special values: off' disables the creation of routes altogether, and > **auto’ (the default)** > adds routes to the default table and enables special handling of default routes.

So knowing this, the whole setup should actually be really easy:

  • add a line 20 wonderland to file /etc/iproute2/rt_tables; this way, you add a symbolic alias wonderland to routing table number 20.
  • copy the existing wireguard configuration to another one. Restrict the allowedIPs of the the mikrotik peer in the original one back to a /32 one so that you don’t lose contact with the Mikrotik if your only way there is the Wireguard tunnel and restart the wireguard instance that uses the old configuration.
  • now you have two options that seem to make sense to me - either run a second Wireguard tunnel between the Mikrotik and the Debian, or use the already existing one to encrypt an IPIP tunnel between the two. Running some other type of tunnel would only add complexity, not benefits.
  • assuming you want to use a second Wireguard tunnel:
  • take the new wireguard configuration file, remove the laptop peer from it, change the Address, ListenPort, and PrivateKey, and add a Table = wonderland clause to it. Once you fire up the second WG interface, ip route show tab wonderland should show you a single default route via the new wireguard interface; if it doesn’t, one possible reason is that wg-quick does not understand symbolic aliases of routing tables, so you would have to change Table = wonderland to Table = 20 and try again.
    • on the Mikrotik, add a second Wireguard interface wg-new and a peer linked to it, matching the parameters of the new one at the server side; it is a bit of a chicken-or-egg issue so you’ll have to iteratively adjust the public keys at both ends of course. However, there is a notable difference from the default configuration - the allowed-address of this new peer will be the one configured on your laptop.
    • at this point, you should still be able to access the Mikrotik directly from your laptop, but that will change once you touch the routing - from then on, you will only be able to connect to the Mikrotik from the server, so start by making sure its is possible before you make the further changes.
    • run ip rule add from 10.10.7.2 table wonderland on the server. This will make packets that come from the laptop via the “old” wg interface be sent to the Mikrotik via the other wg interface. But the responses will not get back because the peer representing the Mikrotik on the old wg interface only has 10.10.7.155 in AllowedIPs. So on the Mikrotik, you have to run /ip/route/add dst-address=10.10.7.2 gateway=wg-new to let the routing send packets for the laptop’s wg address via the new tunnel.
    • the above is all regarding the routing, but you may have to add some firewall rules at both the Linux and the Mikrotik to let the traffic get through. Once you set the firewall rules on the Mikrotik in such a way that you could configure it from the laptop via wg-new, you can shut down the old wireguard tunnel, but I would only do that if I really needed to save every bit of network bandwidth.
    • create a customized version of PostUp and PreDown scripts for the new Wireguard configuration file and add the ip rule add … and a matching /ip rule delete … command to them, respectively.

Issue #3:

I have gradually evolved an allergy to use of words “standard”, “usual”, “default” and “typical” to describe configurations, as these adjectives bear no actual information. You have posted the firewall part of the Mikrotik configuration, but there is nothing regarding routing, IP addresses, and the Wireguard setup itself, and these missing bits are definitely not part of any “standard” configuration. Plus some other bits, perceived as irrelevant, may actually affect the behavior without you even noticing. So only a complete export of the configuration can provide a complete picture.

6

OK, I didn’t thought of that (“default” config). Here is my actual config on Mikrotik:

# 2024-08-18 22:12:39 by RouterOS 7.15.3
# software id = ZQU6-C66Z
#
# model = RB931-2nDr2
# serial number = xxxxxx
/interface bridge
add admin-mac=xx:xx:xx:xx:xx:xx auto-mac=no comment=defconf name=bridge \
    port-cost-mode=short
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce \
    country=xxx disabled=no distance=indoors frequency=auto mode=\
    ap-bridge ssid=XXX station-roaming=enabled wireless-protocol=802.11
/interface ethernet
set [ find default-name=ether1 ] advertise="10M-baseT-half,10M-baseT-full,100M\
    -baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full" mac-address=\
    xx:xx:xx:xx:xx:xx
set [ find default-name=ether2 ] advertise="10M-baseT-half,10M-baseT-full,100M\
    -baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full"
set [ find default-name=ether3 ] advertise="10M-baseT-half,10M-baseT-full,100M\
    -baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full"
/interface wireguard
add listen-port=51820 mtu=1420 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \
    supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.200.10-192.168.200.254
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=10m name=defconf
#error exporting "/routing/rip/instance" (timeout)
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2 \
    internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3 \
    internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=wlan1 \
    internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface ovpn-server server
set auth=sha1 certificate=*3 cipher=aes128-gcm,aes192-gcm,aes256-gcm \
    default-profile=*1 enabled=yes max-mtu=1400 protocol=udp \
    redirect-gateway=def1 require-client-certificate=yes
/interface wireguard peers
add allowed-address=10.10.7.0/24 endpoint-address=xxx.xxx.xxx.xxx \
    endpoint-port=51194 interface=wireguard1 name=peer1 persistent-keepalive=\
    5s preshared-key="xxx" \
    public-key="xxx"
/ip address
add address=192.168.200.1/24 comment=defconf interface=bridge network=\
    192.168.200.0
add address=10.10.7.155 interface=wireguard1 network=10.10.7.155
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.200.0/24 comment=defconf gateway=192.168.200.1 netmask=24
/ip dns
set allow-remote-requests=yes cache-max-ttl=1d servers=\
    8.8.8.8,8.8.4.4,1.1.1.1
/ip dns static
add address=192.168.200.1 name=router.lan
add address=159.148.147.205 disabled=yes name=update.mikrotik.com
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=accept chain=input comment="Access from Wireguard network" \
    in-interface=wireguard1 protocol=tcp src-address=10.10.7.0/24
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ip firewall service-port
set sip disabled=yes
/ip route
add disabled=no dst-address=10.10.7.0/24 gateway=wireguard1 routing-table=\
    main suppress-hw-offload=no
#error exporting "/ipv6/route" (timeout)
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/system clock
set time-zone-name=xxx/xxx
/system identity
set name=xxxx
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.pool.ntp.org
add address=1.pool.ntp.org
/system scheduler
add comment="Wait 1 minute to not get DHCP requests blocked by PON" name=\
    WaitAfterReboot on-event="/ip dhcp-client disable [find];\
    \n:delay 60;\
    \n/ip dhcp-client enable [find];" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-time=startup
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
7

Sorry, but I am not really a network expert, just self-taught guy, trying to learn new things.

Am I understanding you correctly: you are saying I need to run TWO Wireguard servers on my Debian machine (one wg0 and another wg1) and Mikrotik would be connected to both (but there will be different networks, for instance 10.10.7.0/24 and 10.10.8.0/24), but laptop only to the first one? So right now, Mikrotik has interface “wireguard1”, and then I need to add “wg-new”, also (with the settings for wg1 on my Debian(?

So when I have this, I need to run “ip rule add from 10.10.7.2 table wonderland” on the server AND “/ip/route/add dst-address=10.10.7.2 gateway=wg-new” on Mikrotik, and this will “connect” wg0 and wg1 “networks”?

create a customized version of PostUp and PreDown scripts for the new Wireguard configuration file and add the ip rule add … and a matching /ip rule delete … command to them, respectively.

You mean to add “ip rule add from 10.10.7.2 table wonderland” to PostUp and remove this rule through PreDown?

So at the end of the day I would have two WG “networks” on Debian?

8

No what he is saying is stop asking questions about setting up Non-Mikrotik devices…
THere is no need for second wireguard networks, just ensure the firewall rules on the debian side allow the traffic and ensure allowed IPs are set correctly on all devices, and that any routes required are added.

would love to help but your initial explanation was so unclear I could not begin to have an inkling of an idea what you were attempting to do.,
Suggest a detailed network diagram showing both ends of the tunnel the devices involved, etc…

9

I am afraid I can say the same about myself when it comes to networking, but I admit I have spent quite a lot of time on that :slight_smile:


All the way to the last statement I’ve quoted, your summarization is correct. But the idea of “connecting” networks sounds too “circuit-switched” to me. The routing rule does not “connect” networks, it just tells the system to use a specific routing table for a specific packet.

But I forgot something important there: if you want the laptop to be able to access the server via wg0 with that routing rule in place, you need to add more routing rules before that one, such as from 10.0.7.2 to 10.0.0.0/8 table main if the server’s own address you access fits into 10.0.0.0/8. But this additional rule will also make the packets from the laptop to the Tik take the path via wg0, so you may want to make it more selective by specifying just the actual address of the server as the to address.

The order of the routing rules is important, the first (topomost) one to match is applied and the subsequent ones are ignored, but the system adds them in reverse order:
me@debian:~# ip rule add from 10.0.7.2 table wonderland
me@debian:~# ip rule add from 10.0.7.2 to 10.0.0.0/16 table main
me@debian:~# ip rule show
0: from all lookup local
32764: from 10.0.7.2 to 10.0.0.0/16 lookup main
32765: from 10.0.7.2 lookup wonderland
32766: from all lookup main
32767: from all lookup default

So in order not to disconnect yourself by adding them, add them on a single line:
ip rule add from 10.0.7.2 table wonderland ; ip rule add from 10.0.7.2 to 10.0.0.0/16 table main



Off topic, don’t take @anav too seriously - if you were able to explain your requirements so cleanly that anyone could understand them, you would probably not need to seek help here at first place. The rest of his statement, that no second tunnel is necessary, is just wrong - you cannot add a second default route into a system without using an additional routing table, unless you are OK with the system using that additional default route for its regular traffic, which is clearly not the case here.

10

Until I there is a clear need for more than one wireguard interface, I would stick to one tunnel.
My amusing friend sindy tends to overcomplicate issues :stuck_out_tongue_winking_eye:

The reason to go to two separate wireguard interfaces is if one has multiple cases or conflicting cases of 0.0.0.0/0 to deal with.

If you want this mikrotik device to be a wireguard portal to the internet somewhere, not use local internet for traffic, aka for your laptop,
then its simply a matter of using routes and routing rules OR mangling and routes etc…
Easy to separate different subnets on the mikrotik, the one your laptop is not associated with, to use the regular internet vice the wireguard tunnel for internet.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Lets say the wireguard network looks like such and your router is assigned .2
/ip address
10.20.30**.2**/24 interface=wireguard-MT network=10.20.30.0

The concept is
/ip allowed ips
add address=0.0.0.0/0 interface=wireguard-MT endpoint-address=ServerPublicIP endpoint-port=Server-WG-Port persistent-keep-alive=35s public-key=“xxxxxx”
note:1 where public key comes from the Server device.
note2: use 0.0.0.0/0 which allows any address from the local users outbound (aka internet for your laptop) AND any address inbound ( will show an example of this as well )

Lets say you have three subnets on the MT router, they could be associated to different ports no bridge,
or assigned to the bridge as vlans.
/ip address
add address=192.168.10.1/24 interface=ether2 network=192.168.10.0 { laptop subnet }
add address=192.168.20.1/24 interface=ether3 network=192.168.10.0
add address=192.168.30.1/24 interface=ether4 network=192.168.10.0

/ip address
add address=192.168.10.1/24 interface=vlan10 network=192.168.10.0 { laptop subnet }
add address=192.168.20.1/24 interface=vlan20 network=192.168.10.0
add address=192.168.30.1/24 interface=vlan30 network=192.168.10.0

Note the laptop network could be from wifi
add address=192.168.10.1/24 interface=wlan2 network=192.168.10.0 { laptop subnet }
or if on a vlan same as above.
add address=192.168.10.1/24 interface=vlan10 network=192.168.10.0 { laptop subnet }

One has a single internet connection setup in IP routes as such
/ip route
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP-gateway-IP routing-table=main
all traffic will go out this WAN , and then one for wireguard
add dst-address=0.0.0.0/0 gateway=ISP-gateway-IP routing-table=use-WG
this will only be used by the laptop subnet.

a special table for wireguard
/routing table
add fib name=use-WG

Then one can invoke a routing rule to tie it all together
/routing rule
add src-address=192.168.10.0/24 action=lookup-only-in table table=use-WG
This basically states FORCE all traffic from that subnet to the route with assigned special table.

If you need any traffic locally for that subnet ( between subnets or to the router ) then this allows that to occur and forces all other remaining traffic into tunnel
/routing rule
add min-prefix=0 action=lookup-only-in-table table=main
add src-address=192.168.10.0/24 action=lookup-only-in table table=use-WG

For firewall rules, nothing needed on input chain YET!!!
on forward chain ensure
…
add chain=forward action=accept chain=forward comment=“local internet traffic” in-interface-list=LAN out-interface-list=WAN
add chain=forward action=accept chain=forward comment=“laptop internet thru wireguard” src-address=192.168.10.0/24 out-interface=wireguard-MT
add chain=forward action=drop comment=“drop all else”

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

There is a question or not if you have to sourcenat your wireguard traffic out the door. If you were going to a third party provider that only expects ONE IP at their end the clear answer is YES.
However, if you are going to a wireguard device that you have access too and can include the subnet 192.168.10.0/24 as part of the allowed IPs
AND you can also create a static route at the other end to ensure that any return traffic for 192.168.10.0/24 goes back into the tunnel, then you dont need to sourcenat!

However if you have not control over the other end and wish to simply then add
/ip firewall nat
add chain=srcnat action=masquerade out-interface=wireguard-MT.

Then the other device (server for handshake) will only see your wireguard address and will not require any extra allowed IP entries or require an additional route.

+++++++++++++++++++++++++++++++++++++++
Lastly, lets talk about when you are away from your MT router and wish to be able to config that router.

In this case you are NOT connected to the router with your laptop and you are travelling to Canada and wish to access something on your LAN or configure your MT router while travelling.
Then you would need an additional wireguard instance setup on the laptop.
/ip address
10.20.30.50/24 interface=wireguard-MT network=10.20.30.0

There would be an additional client peer setting on the Server DEVICe identifying your REMOTE laptop wireguard connection.
On your laptop you would need
/allowed addresses
/ip allowed ips
add address=0.0.0.0/0 interface=wireguard-MT endpoint-address=ServerPublicIP endpoint-port=Server-WG-Port persistent-keep-alive=35s public-key=“xxxxxx”

On the server device, one would need something similar to this firewall rule
add chain=forward action=accept in-interface=WG-SERVER out-interface=WG-SERVER

This reflects the path of the intended traffic, from the laptop peer to peer, ends up on the Server device, and then by the destination address 10.20.30.2, has to have permission to renter the tunnel for the associated peer client MT router. This permits access to the MT router.
So in the input chain of the router one would need to have
add chain=input action=accept in-interface=wireguard-MT src-address=10.20.30.50

It is clear here that if you wanted to reach one of your lan subnet devices, that the Server Router would then require a static route for that subnet pointing into the wireguard tunnel AND an entry of the subnet on the allowed addresses setting for the peer client MT router.

11

OK, this is what I want to achieve.
Mikrotik_WG.png

  1. VPN (Wireguard server) has several peers. Three peers on the left side (laptops) has default gateway through WG server, so they are accessing the internet through WG’s server exit IP from country A.

  2. Mikrotik (and devices connected to it . PC, TV) is connected to the internet through optical modem. It has default exit IP from country B.

  3. Mikrotik is also connected to Wireguard server. Its management interface is accessible through VPN - peers on left side can access Mikrotik through VPN.

  4. The bottom left laptop is mine. Currently my default gateway to the internet is Wireguard server, so my exit IP is from country A.

  5. However, I would like to have exit IP in country B - this situation is described with arrows of red color.

So the final result would be:

  • Mikrotik stays connected to Wireguard server
  • Mikrotik management interface is accessible through VPN network
  • My laptop stays connected to Wireguard server
    **- BUT, Wireguard server will not be my default gateway, my default gateway will be Mikrotik peer
  • This means my exit IP would be from country B (and I would be able to access web sites accessible in this country only)**

I hope this is more understandable now.

12

Oh wow, just saw the diagram after posting the post below.

Sindy exorcised my misunderstandings so that its clear…


Okay so rereading your requirements…
Laptop is never directly connected to MT router.
You use debian server to make the central connecting point between laptop and MT router ( both connect to Debian as client peers for handshake)
You want to use the MT router as a source internet for your laptop, but all other MT users should not access wireguard etc…

However, here is the obstacle that needs to be overcome,
Your laptop need to be able to access 0.0.0.0/ the internet and this is no problem in terms of the laptop settings to the debian.
However, the debian has a connection to both laptop and MT Router, via two allowed IP config lines with SAME INTERFACE.
10.10.7.155/32 ( laptop ) and
10.10.7.150/32 ( MT router ).

Clearly to get internet from the MT router ( as needed by incoming laptop traffic ) the allowed IPs need to be 0.0.0.0/0 to the MT Router , on the debian server
Here is where it gets “dirty” For any outbound traffic the 0.0.0.0/0 matches everything and thus there will be conflict…
We can get around this if the debian was an MT CHR, by simply putting the laptop first on the list of allowed IPs, but debian is probably not the same.
Thus we need a second wireguard interface for starters
This is all transparent to the MT ROUTER, it will still have only one wireguard interface and tunnel.
However the debian will require two tunnels.
In programming terms… you will need.
a. a firewall rule allowing laptop traffic into the debian device via the wireguard tunnel with the laptop.
b. a firewall rule allowing that traffic to enter the tunnel to the MT Router with destination 0.0.0.0/0
c. A route for any traffic with source address of laptop wireguard address that points to the tunnel
d. Ensure any routes created or existing to allow laptop wireguard traffic to go out debian wan t (wrong outbound direction ) to be disabled/removed.
(keeping a route for debian traffic to its wan though )

So on MT router, which is really all I can help with
is

Input chain
add chain=input action=accept in-interface=wireguard-interface src-address=WIREGUARD-IP of LAPTOP From other tunnel

That way you can reach the mikrotik router for config purposes.

Forward chain
add chain=forward action=accept in-interface=wireguard-interface out-interface-list=WAN

Allows laptop to use mikrotik WAN.

as previous… for MT router.
/ip allowed ips
add address=0.0.0.0/0 interface=wireguard-MT endpoint-address=ServerPublicIP endpoint-port=Server-WG-Port persistent-keep-alive=35s public-key=“xxxxxx”

/ip route
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP-gateway-IP routing-table=main
all traffic will go out this WAN , including the wireguard traffic.

/routing rule
add src-address= OTHER WIREGUARD SUBNET .0/24 action=lookup-only-in table table=use-WG

As the MT knows nothing about the other SUBNET.
Alternatively if possible you could sourcnat all the traffic heading into the wireguard tunnel for the MT router…
If you could do that it would also change the input chain rule… to the wireguard interface alone.