Hello MT community,
i’ve been through a lot of yt and other videos of how to setup a WG roadwarrior setup in order to access the local subnet. I would like to ask for an additional ‘how to’ of the present code as i did not get the wg connectivity working.
The schematic is very simple: i have a mt (ltap lte6) and would like to access my local subet wia WG. I am using instead of a fix public IP cloud IP address of MT.
# 2024-05-05 11:48:30 by RouterOS 7.11
# software id = 180R-71Q6
#
# model = RBLtAP-2HnD
/interface bridge
add name=bridge1
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface list
add name=InternetOut
add name=WAN
add name=LAN
/interface lte
set [ find default-name=lte1 ] allow-roaming=no apn-profiles=A1 band="" \
network-mode=lte
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys name=profile1 \
supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-g/n channel-width=20/40mhz-eC \
disabled=no frequency=2432 installation=outdoor max-station-count=15 \
mode=ap-bridge radio-name="MT LtaP" security-profile=profile1 ssid=\
"WIFI" wireless-protocol=802.11
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip ipsec profile
set [ find default=yes ] dh-group=ecp256,modp2048,modp1024 enc-algorithm=\
aes-256,aes-128,3des
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=\
aes-256-cbc,aes-192-cbc,aes-128-cbc,3des
/ip pool
add name=dhcp ranges=192.168.1.2-192.168.1.253
/ip dhcp-server
add address-pool=dhcp interface=bridge1 lease-time=4h10m name=dhcp1
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge1 ingress-filtering=no interface=ether1
add bridge=bridge1 ingress-filtering=no interface=wlan1
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add interface=lte1 list=WAN
add interface=bridge1 list=LAN
add interface=wireguard1 list=LAN
/interface ovpn-server server
set auth=sha1,md5
/interface wireguard peers
add allowed-address=172.16.0.2/32 interface=wireguard1 public-key=\
"123123123123123123="
/ip address
add address=192.168.1.1/24 interface=bridge1 network=192.168.1.0
add address=172.16.0.254/24 interface=wireguard1 network=172.16.0.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=10m
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1 \
netmask=24
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip firewall filter
add action=fasttrack-connection chain=forward connection-state="" hw-offload=\
yes
add action=accept chain=input connection-state=established,related
add action=drop chain=input connection-state=invalid
add action=accept chain=input comment="Wireguard allow" dst-port=13231 \
protocol=udp
add action=accept chain=input comment="Wireguard allow traffic" src-address=\
172.16.0.0/24
add action=accept chain=input comment=\
"Allow DHCP, DNS, NTP from internal networks only" dst-port=\
5678,123,53,67,68 in-interface=!lte1 protocol=udp
add action=accept chain=input comment="Allow access to FW except internet" \
in-interface=!lte1
add action=accept chain=input comment="Allow ICMP" in-interface=!lte1
add action=reject chain=input comment=\
"Global DENY !!! Don't move or change !!" log-prefix=Global_ reject-with=\
icmp-net-prohibited
add action=accept chain=forward connection-state=established,related
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward in-interface=LAN \
out-interface=WAN
add action=accept chain=forward in-interface=wireguard1 out-interface=LAN
add action=drop chain=forward disabled=yes
/ip firewall nat
add action=masquerade chain=srcnat comment=internet
add action=masquerade chain=srcnat comment="Wireguard masqurade - internet" \
out-interface=wireguard1
/ip route
add disabled=yes distance=1 dst-address=192.168.1.0/24 gateway=wireguard1 \
pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
target-scope=10
/ip service
set telnet disabled=yes
set ftp disabled=yes
set api disabled=yes
set api-ssl disabled=yes
add disabled=no interfaces=all min-rx=200us min-tx=200us multiplier=5
/system clock
set time-zone-name=Europe/Zagreb
/system gps
set port=gps
/system leds
set 0 type=wireless-signal-strength
/system note
set show-at-login=no
Win10 config
[Interface]
PrivateKey = 123123123123213213213
Address = 172.16.0.2/32
DNS = 8.8.8.8
[Peer]
PublicKey = 123123123213123213123
AllowedIPs = 192.168.1.0/0
Endpoint = publicIP:13231
Few things:
.i can connect to the MT, can ping 172.16.0.2 but can not ping local subnet 192.168.1.0/24
if i do ipconfig of a wg1 interface on my win10 machine i get this
what is my config missing?
Tx for any help!
korg
