WireGuard site-to-site VPN problem

hm123 · September 10, 2025, 6:27am

I have read many posts about WireGuard VPN, but I still haven’t managed to succeed. I have two MikroTik routers with a WireGuard tunnel between them. From the local network of Router B, I have access to the local network of Router A. However, the reverse does not work. From the local network of A, I cannot access B. Router A is the server, and Router B is the client for WireGuard.

Site A

# 2025-09-09 22:31:38 by RouterOS 7.19.3
# software id = LA5Z-APGI
#
# model = C52iG-5HaxD2HaxD
# serial number = ******
/interface bridge
add admin-mac=F4:1E:57:B2:E0:7E auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] name=ether1-WAN
set [ find default-name=ether2 ] name="ether2-LAN TV"
set [ find default-name=ether3 ] name="ether3-LAN Server"
set [ find default-name=ether4 ] name="ether4-LAN Desk"
set [ find default-name=ether5 ] name=ether5-LAN
/interface wifi
set [ find default-name=wifi1 ] channel.band=5ghz-ax .skip-dfs-channels=\
    10min-cac .width=20mhz configuration.mode=ap .ssid=hm55 disabled=no \
    security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel.band=2ghz-ax .skip-dfs-channels=\
    10min-cac .width=20/40mhz configuration.mode=ap .ssid=hm222 disabled=no \
    security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1-WAN name=pppoe-out1 \
    use-peer-dns=yes user=*********
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=Wireguard
/ip pool
add name=default-dhcp ranges=192.168.0.100-192.168.0.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=1h name=defconf
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface="ether2-LAN TV"
add bridge=bridge comment=defconf interface="ether3-LAN Server"
add bridge=bridge comment=defconf interface="ether4-LAN Desk"
add bridge=bridge comment=defconf interface=ether5-LAN
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=WAN interface=pppoe-out1 list=WAN
add comment=wireguard interface=wireguard1 list=Wireguard
/interface wireguard peers
add allowed-address=192.168.100.2/32 client-address=192.168.100.2/32 \
    client-endpoint=*** comment=j-phone interface=wireguard1 name=\
    j-phone private-key="*********" \
    public-key="***********"
add allowed-address=192.168.100.3/32 client-address=192.168.100.3/32 \
    client-endpoint=*** comment=t-phone interface=wireguard1 name=\
    t-phone private-key="************" \
    public-key="************"
add allowed-address=192.168.100.4/32 client-address=192.168.100.4/32 \
    client-endpoint=*** comment=comp-work interface=wireguard1 \
    name=comp-work private-key="************" \
    public-key="*************"
add allowed-address=192.168.100.5/32,192.168.1.0/24 client-address=\
    192.168.100.5/32 client-endpoint=*** comment=krushevec \
    interface=wireguard1 name=krushevec public-key=\
    "*******************"
/ip address
add address=192.168.0.1/24 comment=LAN interface=bridge network=192.168.0.0
add address=192.168.100.1/24 comment=Wireguard interface=wireguard1 network=\
    192.168.100.0
/ip dhcp-client
add comment=defconf interface=ether1-WAN
/ip dhcp-server network
add address=192.168.0.0/24 comment=defconf dns-server=192.168.0.1 gateway=\
    192.168.0.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment=wireguard dst-port=13231 protocol=udp
add action=accept chain=input comment="wireguard access" in-interface=\
    wireguard1 protocol=tcp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat out-interface=wireguard1
/ip route
add disabled=no distance=1 dst-address=192.168.1.0/24 gateway=wireguard1 \
    routing-table=main scope=30 suppress-hw-offload=no target-scope=10
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/Sofia
/system identity
set name=MR-Router
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Site B

# 2025-09-09 22:26:53 by RouterOS 7.18
# software id = AVTH-E7CW
#
# model = LHGGM
# serial number = *********
/interface lte
set [ find default-name=lte1 ] allow-roaming=no band=""
/interface wireguard
add listen-port=51820 mtu=1420 name=wg1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.1.100-192.168.1.254
/ip dhcp-server
add address-pool=default-dhcp interface=ether1 name=defconf
/port
set 0 name=serial0
/queue type
add fq-codel-ecn=no kind=fq-codel name=fq-codel-ethernet-default
/queue interface
set ether1 queue=fq-codel-ethernet-default
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=ether1 list=LAN
add comment=defconf interface=lte1 list=WAN
/interface ovpn-server server
add mac-address=FE:98:CB:A0:E2:45 name=ovpn-server1
/interface wireguard peers
add allowed-address=192.168.0.1/24,192.168.100.0/24 endpoint-address=\
    ********** endpoint-port=13231 interface=wg1 name=peer1 \
    persistent-keepalive=25m public-key=\
    "***************"
/ip address
add address=192.168.1.1/24 comment=defconf interface=ether1 network=\
    192.168.1.0
add address=192.168.100.5 comment=wireguard interface=wg1 network=\
    192.168.100.5
/ip dhcp-server network
add address=192.168.1.0/24 comment=defconf dns-server=192.168.1.1 gateway=\
    192.168.1.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.1.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat out-interface=wg1
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip route
add dst-address=192.168.0.0/24 gateway=wg1 routing-table=main \
    suppress-hw-offload=no
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Sofia
/system logging
add prefix=WG topics=wireguard,error,warning
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.bg.pool.ntp.org
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool sniffer
set file-name=eee.log filter-interface=wg1

erlinden · September 10, 2025, 6:52am

Have you seen (and followed) this great explanation:

From your config I think you are missing the /ip firewall filter rules on the forward chain.

dobryhrac · September 10, 2025, 10:02am

Hello hm123,

after reviewing your configuration, I would suggest making adjustments on site B:

/ip address remove [find interface=wg1]
/ip address add address=192.168.100.5/24 interface=wg1 comment="wireguard"
/interface wireguard peers set peer1 allowed-address=192.168.0.0/24,192.168.100.0/24 persistent-keepalive=25

Try it out, and if it works for you, you can remove the src NAT for WireGuard on both MikroTiks A and B, because it's unnecessary as long as the routes are set up correctly. I would also add persistent-keepalive=25 on site A.

anav · September 10, 2025, 12:47pm

Site B (CLIENT for handshake).

address structure for wireguard needs /24 and proper network setting.
add address=192.168.100.5/24 comment=wireguard interface=wg1 network=
192.168.100.0
you have queueing and fastrack enabled, suggest you turn one of them off.
I would turn the queuing off (disabled) as for a single subnet it makes no sense to me.
there is no point in masquerading that I can see for the wireguard interface.
YOu have control of both ends and can properly setup firewall rules and routes for the needed traffic.

-add wireguard to interface list lan
/interface list member
add comment=defconf interface=ether1 list=LAN
add interface=wg1 list=LAN
add comment=defconf interface=lte1 list=WAN

-remove this firewall rule
/interface list member
add comment=defconf interface=ether1 list=LAN
add comment=defconf interface=lte1 list=WAN

and replace with

add chain=forward action=accept comment="internet traffic" in-interface-list=LAN \
out-interface-list=WAN
add chain=forward action=accept comment="local users out wireguard" \
src-address=192.168.1.0/24 out-interface=wg1
add chain=forward action=accept comment="remote users inbound"  in-interface=wg1 dst-address=192.168.1.0/24
add chain=forward action=drop comment="drop all else"

SITE A ( SERVER for handshake )

remove wireguard from list and list members and simply make wireguard member of LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=WAN interface=pppoe-out1 list=WAN
add comment=wireguard interface=wireguard1 list=LAN

I personally find putting all the client noise in wireguard settings as NOT helpful so a clean view would be as follows:

/interface wireguard peers
add allowed-address=192.168.100.2/32 comment=j-phone interface=wireguard1 \
    public-key="***********"
add allowed-address=192.168.100.3/32 comment=t-phone interface=wireguard1 \
    public-key="************"
add allowed-address=192.168.100.4/32 comment=comp-work interface=wireguard1 \
    public-key="*************"
add allowed-address=192.168.100.5/32,192.168.1.0/24 comment=krushevec \
    interface=wireguard1 public-key=\"*******************"

AN error is the config is having pppoe for wan termination but then having IP DHCP Client active.
DISABLE ip dhcp client.
remove the forward chain rule.
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN

and replace with:

add chain=forward action=accept comment="internet traffic" in-interface-list=LAN \
out-interface-list=WAN
add chain=forward action=accept comment="local users to wireguard" \
src-address=192.168.0.0/24 out-interface=wireguard1 
add chain=forward action=accept comment="remote users to wireguard" \
in-interface=wireguard1 dst-address=192.168.00/24 
add chain=forward action=accept comment="relay in from device thru RA to RB"
in-interface=wireguard1 out-interface=wireguard1
add chain=forward action=drop comment="drop all else"

REMOVE masquerade rule for wireguard interface it is not helpful here.

hm123 · September 11, 2025, 5:34am

Thank you everyone. After all recommended changes now everything looks good. I still have to do complete test but will do it in few days.