Taking a mental step back, I’m not sure how much the active connection status of my wireguard client really says. If I omit specifying the endpoint I can still activate the tunnel and the client will say it’s active. I guess I’m not yet familiar enough with how WireGuard works. Apparently it doesn’t take much to get the green “active” status.
Moreover, if I do enter an endpoint but use a wrong port number it also says it’s active and that a few bytes (like 444 bytes or 1.01 KiB) are sent. Seems to be the same low amount of bytes as when I use the “correct” port number. So it’s probably best to look for the (remaining) problem there.
Here’s my client config: ²
[Interface]
PrivateKey = asdfasdfasdfasdfasdfasdf=
Address = 192.168.66.2/24
DNS = 192.168.66.1
[Peer]
PublicKey = QshdhpmPjzYhKtajMjkhRK02nPTqj45Kbo0RQTT1Mic=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = somethingsomething.myfritz.net:13232
Here the current config of the wireguard server: ¹
# sep/28/2021 12:50:42 by RouterOS 7.1rc4
# software id = 2QED-STSN
#
# model = RBD25G-5HPacQD2HPnD
/interface bridge
add admin-mac=08:55:31:CC:11:BD auto-mac=no comment=defconf name=lan-bridge
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=yes interface=lan-bridge name=defconf
/user group
add name=prometheus policy="read,test,winbox,api,!local,!telnet,!ssh,!ftp,!reb\
oot,!write,!policy,!password,!web,!sniff,!sensitive,!romon,!dude,!tikapp,!\
rest-api"
/interface bridge port
add bridge=lan-bridge comment=defconf ingress-filtering=no interface=ether2
add bridge=lan-bridge ingress-filtering=no interface=wlan3
/ipv6 settings
set accept-router-advertisements=yes
/interface list member
add comment=defconf interface=lan-bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface wireguard peers
add allowed-address=192.168.66.2/32 comment=Umbra interface=wireguard1 \
public-key="eRQk9vsJKT7mY2rdH8g7OaX5FhWt/Haqy4ZAl9qBmWI="
/ip address
add address=192.168.1.6/24 comment=defconf disabled=yes interface=lan-bridge \
network=192.168.1.0
add address=192.168.66.1/24 interface=wireguard1 network=192.168.66.0
/ip dhcp-client
add comment=defconf interface=lan-bridge
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.88.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip firewall nat
add action=masquerade chain=srcnat out-interface=lan-bridge src-address=\
192.168.66.0/24
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/snmp
set enabled=yes
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=Audience
/system ntp client
set enabled=yes
/system ntp client servers
add address=192.168.1.1
/system package update
set channel=development
/system routerboard settings
set cpu-frequency=auto
/system scheduler
add interval=1d name="auto upgrade" on-event="/system package update\r\
\ncheck-for-updates once\r\
\n:delay 3s;\r\
\n:if ( [get status] = \"New version is available\") do={ install }" \
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=sep/21/2021 start-time=03:00:00
/tool graphing interface
add store-on-disk=no
Screenshot of what it looks like in action: ²
¹ Again with CAPsMAN and maybe some more unrelated things removed
² + changes to remove publicly identifiable information
