Hello guys,
I’ve been playing with wireguard the recent days and something really strange is happening. I have no problems at all to establish a connection and to get acess to the main router on which the wireguard is set. Also I’m getting access to the home server and all services that are running on it without any problesms, the smart swithch is also accessed. The problem comes when I try to access the second MT that I’m using as an AP/Switch and mostly the NVR with the access to all cameras.
The current setup is the following:
MT Main Router with dual ISP → SFP port connected to PoE switch feeding the cammeras and Eth connected to another internal switch. The rest of the devices including the MT AP are connected to this internal switch. he Camera switch is also directly connected to the NVR to reduce the points of failure.The communication between the NVR and the main network is going in direction NVR->PoE Switch->MT SFP. I do have some filtering done in the bridge which is restricting the access to the NVR through the SFP port to only certain devices and everything else is droped (probably this is not the best secure measure so I’m open to proposals here).
The wireguard is set pretty much as it is in the MT documentation page and for the test I’ve done 1:1 implementation but the problem still remained.
/interface wireguard
add listen-port=13231 name=wireguard1
/ip address
add address=192.168.100.1/24 interface=wireguard1
/interface wireguard peers
add allowed-address=192.168.100.2/32 interface=wireguard1 public-key="<paste public key from remote device here>"
/ip firewall filter
add action=accept chain=input comment="allow WireGuard" dst-port=13231 protocol=udp place-before=1
/interface list member
add interface=wireguard1 list=LAN
The firewall rules are pretty basic and ot top of the defconf I’m only droping TCP and UTP from outside as I’m using “Allow Remote Request”
add action=drop chain=input comment="Drop DNS from outside UDP" dst-port=53 \
in-interface-list=WAN protocol=udp
add action=drop chain=input comment="Drop DNS from outside TCP" dst-port=53 \
in-interface-list=WAN protocol=tcp
On the AP the only configuration is one Address for the device and one dynamic route. I’ve found that adding a route with the remote device IP and a GW the main router I’m getting access to the device, don’t know why this is needed as it is perfectly accessable from the local network. For the NVR however I could not get any access at all. I’ve tried to remove all the filtering rules, even tried to disable the firewall rules but withotu any success. It’s really strange to me that once I’m connected through wireguard, I’m getting access to pretty much everything except the second MT device and the NVR. Do you guys have any ideas what may the problem be?