R2
(1)Allowed IPs…
TO:
/interface wireguard peers
add allowed-address=10.0.0**.0**/24,192.168.1.0/24 endpoint-address=172.217.22.14
endpoint-port=13231 interface=WG_VPN_STS public-key=\
(2) Input chain, rule is only required for server device for connections can be removed… R2 is only a client…
add action=accept chain=input comment=VPN dst-port=13231 in-interface=lte1
protocol=udp
(3) Firewall input chain rules are lacking…to loose… add!! and in proper order…
TO:
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=
“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=accept chain=input src-address-list=Authorized
add action=accept chain=input in-interface-list=LAN dst-port=53 protocol=tcp
add action=accept chain=input in-interface-list=LAN dst-port=53 protocol=udp
add action=drop chain=input comment=“drop all else”
Note: I saw out of sequence after, in the rules some more input chain rules near the end, but they should be now removed except for the default rule invalid which I added to the top set of rules above.
Where firewall address list of authorized looks something like.
add IPaddress of local admin on R2 list=Authorized
add IPaddress of remote admin on R1 list=Authorized
add IPaddress of remote admin on wireguard (aka home pc or mobile laptop or iphone, you could have several to add here)
(4) On the forward chain firewall rules this is where you should define who can access the local subnet…
TO:
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related
add action=accept chain=forward comment=“defconf: accept established,related, untracked” connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=forward comment=“allow internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“allow port forwarding” connection-nat-state=dstnat
add action=drop chain=forward
That is the starting point, then we need to add rules for wireguard access.
So you have this…
add action=accept chain=forward comment=“defconf: accept in ipsec policy”
ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy”
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=“defconf: accept established,related, untracked” connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=forward comment=“allow internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward in-interface=WG_VPN_STS dst-address=192.168.10.0/24 { allows all road warriors and R1 users coming over WG to access the local LAN }
add action=accept chain=forward in-interface=bridge out-interface=WG_VPN_STS { enables pinging currently and future R2 to R1 traffic when permitted at the far side }
add action=accept chain=forward comment=“allow port forwarding” connection-nat-state=dstnat
add action=drop chain=forward
++++++++++++++++++++++++++++++++++++++++++++
R1
Firewall rules… Again this is what needs most work fixed below… ( note fastrack rule in forward chain comes before the accepted established rule )
/ip firewall filter
{ Input Chain }
(default rules)
add action=accept chain=input comment=
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=accept chain=input comment=“defconf: accept ICMP” disabled=yes
protocol=icmp
add action=accept chain=input comment=
“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
(user rules)
add action=accept chain=input comment=“Wireguard VPN S to C” dst-port=13231
in-interface=ether1 protocol=udp
add action=accept chain=input src-address-list=Management
add action=accept chain=input in-interface-list=LAN dst-port=53 protocol=tcp
add action=accept chain=input in-interface-list=LAN dst-port=53 protocol=udp
add action=drop chain=input comment=“drop all else”
{ Forward Chain }
(default rules)
add action=accept chain=forward comment=“defconf: accept out ipsec policy”
ipsec-policy=out,ipsec
add action=accept chain=forward comment=“defconf: accept in ipsec policy”
ipsec-policy=in,ipsec
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=
“defconf: accept established,related, untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid”
connection-state=invalid
(user rules)
add action=accept chain=forward in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“allow port forwarding” connection-nat-state=dstnat
add action=accept chain=forward in-interface=WG-VPN out-interface=WG-VPN { allows remote warriors to enter R1 (exit tunnel) and then head to R2 (re-enter tunnel)
add action=accept chain=forward in-interface=WG-VPN src-address-list=Permitted dst-address=192.168.1.0/24 { allow remote warriors users to access local subnet but not R2 users }
add action=drop chain=forward comment=“drop all else”
Note: where firewall address list of Management consists of
add ip address=local admin at R1 list=Management
add ip address=remote admin roadwarrior via WG list=Management
Note: where firewall address list Permitted consists of
add IPaddress 10.0.0.2 list=Permitted
add IPaddress 10.0.0.3 list=Permitted
add IPaddress 10.0.0.4 list=Permitted
add IPaddress 10.0.0.5 list=Permitted
Note: when you decide to allow R2 users to access R1 local subnet the you can modify the rule too ( and get rid of authorized list Permitted)
add action=accept chain=forward in-interface=WG-VPN dst-address=192.168.1.0/24
+++++++++++++++++++++++++++++++++++++++++++++++++++++
but i do have same router at home… and working data plan for it… If i upload configuration to it, maybe this router can serve for testing ? I could use same IP, i only need to change public keys in peers if im right ?