Wireguard Site to Site VPN

RouterOS Beginner Basics
1

Hi all,

I am trying to set up a WireGuard site-to-site VPN; however, I am having trouble correctly configuring static routes. I have done this before with L2TP/IPsec without any issues, but for some reason, a similar setup with WireGuard isn't working.

Here’s the setup:

Site A: Has a static public IP address.
Site B: Mikrotik is behind double NAT. It has a DHCP client configured on Ether1, and my goal is to push all traffic through the WireGuard tunnel so that all devices connected to Mikrotik at Site B use the public IP address of Site A.
The tunnel is up. From Site A, I can ping any device on the LAN at Site B, and vice versa.

The problem comes up when I try to configure a route with:
dst 0.0.0.0/0 gateway 172.16.0.1 distance=1.

As soon as I activate this route, the tunnel goes down, and I am no longer able to ping the other end of the tunnel.

I am attaching a network diagram.

Routes at SITE B

DST-ADDRESS GATEWAY DISTANCE

D d 0.0.0.0/0 192.168.0.1 2
0 As 0.0.0.0/0 172.16.0.1 1 ------- ONCE ACTIVATED THE TUNNEL GOES DOWN
DAc 172.16.0.0/30 wireguard1 0
DAc 192.168.0.0/24 ether1 0
1 As 192.168.1.0/24 172.16.0.1 1
DAc 192.168.88.0/24 bridge 0


Routes at Site A

DST-ADDRESS GATEWAY DISTANCE

;;; VPN-POLAND FOR IP .116 AND .5
DAd 0.0.0.0/0 1
DAc /22 ether1 0
DAc 172.16.0.0/30 wireguard1 0
DAc 192.168.1.0/24 bridge 0
2 As 192.168.88.0/24 172.16.0.2 1

wireguard.jpg
wireguard.jpg771×369 23.9 KB

2

You need to set on site B route to Site A public up via local gateway.

3

That's what I have done

Dst 0.0.0.0/0 gateway 172.16.0.1 which is the other end of the VPN tunnel. distance is 1.

I know it's reachable because I can ping everything on the other end.

However, once this route is activated, the tunnel goes down.

4

It dies as WAN traffic from router A to router B (that includes the tunnel) is send to the tunnel so it dies as WAN-A traffic does not reach WAN-B (and vice versa). When tunel dies then VPN is established/routed with an "old pointing to the <> " 0.0.0.0/0 and then it loops itself again to the tunnel … and so on.

5

Not the tunnel endpoint for route destination but WAN address

6

Thanks for your response! What changes are required to get this fixed?

7

So shall I replace in static routes 172.16.0.1 with the public IP of site A?

8

Post both configs
/export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc. )

9

Here is the full config. There is the config for other tunnels as well at site A so please ignore it.
Site B :

/interface bridge
add comment=defconf name=bridge port-cost-mode=short
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-g/n country="united kingdom"
distance=indoors frequency=auto installation=indoor mode=ap-bridge ssid=
wifi wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-n/ac channel-width=20/40/80mhz-XXXX
country="united kingdom" distance=indoors frequency=auto installation=
indoor mode=ap-bridge ssid=wifi wireless-protocol=802.11
/interface ethernet
set [ find default-name=ether2 ] disabled=yes
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk eap-methods="" mode=
dynamic-keys supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool3 ranges=192.168.88.2-192.168.88.254
/ip dhcp-server
add address-pool=dhcp_pool3 interface=bridge name=dhcp1
/routing table
add disabled=no fib name=VPN-POLAND
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether5
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=wlan1
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=wlan2
internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface ovpn-server server
set auth=sha1,md5
/interface wireguard peers
add allowed-address=172.16.0.1/30,192.168.1.0/24,::/0 endpoint-address=
145.40.185.118 endpoint-port=13231 interface=wireguard1 name=wireguard
persistent-keepalive=10s public-key=
""
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=
192.168.88.0
add address=172.16.0.2/30 interface=wireguard1 network=172.16.0.0
/ip dhcp-client
add default-route-distance=2 interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=192.168.1.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked disabled=yes
add action=accept chain=input disabled=yes
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid disabled=yes
add action=accept chain=input comment="defconf: accept ICMP" disabled=yes
protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" disabled=yes
dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN"
disabled=yes in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy"
disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related disabled=yes hw-offload=yes
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked disabled=yes
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid disabled=yes
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new disabled=yes in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade"
ipsec-policy=out,none out-interface-list=WAN
/ip firewall raw
add action=notrack chain=prerouting dst-address=192.168.1.0/24 src-address=
192.168.88.0/24
add action=notrack chain=prerouting dst-address=192.168.88.0/24 src-address=
192.168.1.0/24
/ip firewall service-port
set sip disabled=yes
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip route
add comment="ROUTE VPN TO POLAND" disabled=no distance=1 dst-address=
0.0.0.0/0 gateway=192.168.0.1 routing-table=VPN-POLAND
suppress-hw-offload=no
add disabled=no distance=1 dst-address=192.168.1.0/24 gateway=172.16.0.1
routing-table=main scope=30 suppress-hw-offload=no target-scope=10
add disabled=yes distance=1 dst-address=0.0.0.0/0 gateway=172.16.0.1
routing-table=main scope=30 suppress-hw-offload=no target-scope=10
/routing rule
add action=lookup-only-in-table disabled=no src-address=192.168.1.116/32
table=VPN-POLAND
/system clock
set time-zone-name=Europe/Warsaw
/system identity
set name=PARENTS-NEW
/system leds
add leds=user-led type=on
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN


SITE A:

/interface bridge
add admin-mac= arp=proxy-arp auto-mac=no comment=defconf
name=bridge
/interface wifi
set [ find default-name=wifi1 ] channel.band=5ghz-ax .skip-dfs-channels=all
.width=20/40/80mhz configuration.country="United Kingdom" .mode=ap .ssid=
surveillance disabled=no security.authentication-types=wpa2-psk,wpa3-psk
.ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel.band=2ghz-n .skip-dfs-channels=all
.width=20/40mhz-Ce configuration.country="United Kingdom" .mode=ap .ssid=
"Dom WiFi" security.authentication-types=wpa2-psk .ft=yes .ft-over-ds=yes
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=dhcp_pool ranges=
192.168.1.20-192.168.1.198,192.168.1.200-192.168.1.254
/ip dhcp-server
add address-pool=dhcp_pool interface=bridge lease-time=8h name=dhcp1
/ip smb users
set [ find default=yes ] disabled=yes
/ppp profile
set *FFFFFFFE interface-list=LAN use-encryption=default
/routing table
add disabled=no fib name=VPN-POLAND
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=all
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=15360
/interface l2tp-server server
set enabled=yes use-ipsec=required
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface pptp-server server

PPTP connections are considered unsafe, it is suggested to use a more modern VPN protocol instead

set default-profile=default
/interface wifi capsman
set package-path="" require-peer-certificate=no upgrade-policy=none
/interface wireguard peers
add allowed-address=172.16.0.2/30,192.168.88.0/24,::/0 interface=wireguard1
name=wireguard public-key=""
/ip address
add address=192.168.1.1/24 interface=bridge network=192.168.1.0
add address=172.16.0.1/30 interface=wireguard1 network=172.16.0.0

/ip dhcp-client
add interface=ether1

/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=192.168.1.1 comment=defconf name=router.lan type=A
/ip firewall address-list
add address=192.168.1.0/24 list=LAN-IP
/ip firewall filter
add action=drop chain=input comment="DROP PING" in-interface-list=WAN
protocol=icmp
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="L2TP VPN PORTS" dst-port=500,4500,1701
protocol=udp
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN"
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
/ip firewall raw
add action=notrack chain=prerouting comment="SITE-2-SITE VPN PARENTS"
dst-address=192.168.88.0/24 src-address=192.168.1.0/24
add action=notrack chain=prerouting comment="SITE-2-SITE VPN PARENTS"
dst-address=192.168.1.0/24 src-address=192.168.88.0/24
add action=notrack chain=prerouting comment="SITE-2-SITE VPN SITEC"
dst-address=192.168.188.0/24 src-address=192.168.1.0/24
add action=notrack chain=prerouting comment="SITE-2-SITE VPN SITEC"
dst-address=192.168.1.0/24 src-address=192.168.188.0/24
add action=notrack chain=prerouting comment="SITE-2-SITE VPN OLA"
dst-address=192.168.3.0/24 src-address=192.168.1.0/24
add action=notrack chain=prerouting comment="SITE-2-SITE VPN OLA"
dst-address=192.168.1.0/24 src-address=192.168.3.0/24
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip route
add comment="VPN-POLAND FOR IP .116 AND .5" disabled=yes distance=1
dst-address=0.0.0.0/0 gateway=10.10.10.2 routing-table=VPN-POLAND scope=
30 suppress-hw-offload=no target-scope=10
add comment=VPN disabled=no dst-address=192.168.3.0/24 gateway=10.10.3.2
routing-table=main suppress-hw-offload=no
add comment=SITEC disabled=no dst-address=192.168.188.0/24 gateway=10.10.4.2
routing-table=main suppress-hw-offload=no
add disabled=no dst-address=192.168.88.0/24 gateway=172.16.0.2 routing-table=
main suppress-hw-offload=no

/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=
33434-33534 protocol=udp
add action=accept chain=input comment=
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=input comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
add action=accept chain=forward comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1"
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=forward comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
/ppp secret
add local-address=192.168.1.1 name=adam remote-address=192.168.1.3 service=
l2tp
add disabled=yes local-address=10.10.10.1 name=parents profile=
default-encryption remote-address=10.10.10.2 service=l2tp
add local-address=10.10.3.1 name=ola profile=default-encryption
remote-address=10.10.3.2 service=l2tp
add local-address=192.168.1.1 name=Poland remote-address=192.168.1.5 service=
l2tp
add local-address=10.10.4.1 name=sitec remote-address=10.10.4.2 service=l2tp
add local-address=10.10.10.1 name=parents remote-address=10.10.10.2 service=
pptp

/routing rule
add action=lookup disabled=no src-address=192.168.1.116/32 table=VPN-POLAND
add action=lookup disabled=yes src-address=192.168.1.98/32 table=VPN-POLAND
add action=lookup comment="ANY REMOTE LAPTOP" disabled=no src-address=
192.168.1.5/32 table=VPN-POLAND
/system identity
set name="Default Gateway"
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool romon
set enabled=yes
/tool sniffer
set filter-dst-ip-address=192.168.88.1/32 filter-interface=*F00009
filter-src-ip-address=192.168.1.1/32