Hello, recently we’ve decided to set up the Wireguard on our Mikrotik router. Everything went great and connection was successful, sites were loading, etc. but we were unable to either ping or connect to addresses in LAN (Bridge1). What may be the reason of this?
Our Configuration:
/interface bridge
add name=bridge1
/interface ethernet
set [ find default-name=sfp-sfpplus2 ] auto-negotiation=no
/interface wireguard
add listen-port=4216 mtu=1420 name=wireguard
/interface list
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=192.168.1.2-192.168.1.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=bridge1 name=dhcp1
/port
set 0 name=serial0
set 1 name=serial1
/interface bridge port
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=ether6
add bridge=bridge1 interface=ether7
add bridge=bridge1 interface=ether8
add bridge=bridge1 interface=ether9
add bridge=bridge1 interface=ether10
add bridge=bridge1 interface=ether11
add bridge=bridge1 interface=ether12
add bridge=bridge1 interface=ether13
add bridge=bridge1 interface=ether14
add bridge=bridge1 interface=ether15
add bridge=bridge1 interface=ether16
add bridge=bridge1 interface=sfp-sfpplus2
/interface list member
add interface=wireguard list=LAN
add interface=bridge1 list=LAN
/interface wireguard peers
add allowed-address=192.168.100.2/32 interface=wireguard public-key="REDACTED"
add allowed-address=192.168.100.3/32 interface=wireguard public-key="REDACTED"
/ip address
add address=x.x.x.15/24 interface=sfp-sfpplus1 network=x.x.x.0
add address=192.168.1.1/24 interface=bridge1 network=192.168.1.0
add address=192.168.100.1/24 interface=wireguard network=192.168.100.0
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=y.y.y.18,y.y.y.20,8.8.8.8 gateway=192.168.1.1
/ip dns
set servers=y.y.y.18,y.y.y.20,8.8.8.8
/ip firewall filter
add action=accept chain=input comment="allow WireGuard traffic" src-address=192.168.100.0/24
add action=accept chain=input comment="allow WireGuard" dst-port=4216 protocol=udp
add action=accept chain=forward connection-nat-state=dstnat
add action=accept chain=input dst-port=9999 log=yes log-prefix=filter-tcp-gossip protocol=tcp
add action=accept chain=input dst-port=9999 log=yes log-prefix=filter-udp-gossip protocol=udp
add action=accept chain=input dst-port=8800-8820 log=yes log-prefix=tcp-rpcports protocol=tcp
add action=accept chain=output dst-port=8800-8820 log=yes log-prefix=tcp-rpcports protocol=tcp
add action=accept chain=output dst-port=8800-8820 log=yes log-prefix=udp-rpcports protocol=udp
add action=accept chain=input dst-port=8800-8820 log=yes log-prefix=udp-rpcports protocol=udp
/ip firewall nat
add action=masquerade chain=srcnat
add action=dst-nat chain=dstnat dst-port=2201 protocol=tcp to-addresses=192.168.1.252 to-ports=22
add action=dst-nat chain=dstnat dst-port=2202 protocol=tcp to-addresses=192.168.1.253 to-ports=22
add action=dst-nat chain=dstnat dst-port=8800-8820 log=yes log-prefix=tcp-z protocol=tcp to-addresses=192.168.1.253 to-ports=8800-8820
add action=dst-nat chain=dstnat dst-port=8800-8820 log=yes log-prefix=udp-z protocol=udp to-addresses=192.168.1.253 to-ports=8800-8820
add action=dst-nat chain=dstnat dst-port=9999 log=yes log-prefix=tcp-gossip protocol=tcp to-addresses=192.168.1.253 to-ports=9999
add action=dst-nat chain=dstnat dst-port=9999 log=yes log-prefix=udp-gossip protocol=udp to-addresses=192.168.1.253 to-ports=9999
add action=dst-nat chain=dstnat dst-port=7299 log=yes log-prefix=rpc-via-vpn protocol=tcp to-addresses=192.168.1.253 to-ports=80
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=x.x.x.1 routing-table=main suppress-hw-offload=no
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip ssh
set strong-crypto=yes
/system clock
set time-zone-name=UTC
/system note
set show-at-login=no
/system routerboard settings
set enter-setup-on=delete-key