Hi there, i have a wired problem with source adress selection of wireguard. Basicly i have asymetric routing where the connection comes in via one interface and has to leave from another. Now the router when that happens always chosses as source ip the ip on that interface instead of using the ad…

Coincidentally: [image] Trouble with wireguard and asymmetric routing General I am experimenting with the setup shown in the following diagram. I am running into some asymmetric routing issues. I am pretty sure I know exactly what the problem is (connections to…

Yeah it is a bit vague, I thought somone already had the issue. I made a complete testing setup in gns3 to reproduce the issue which is close to mine with the difference of no bgp only static, no igp and different adresses. I use a CCR as client in that exemple and one as provider. I only added t…

[image] mauricekleinaetherus: but as soon as in-interface != out-interface it will select the source adress of the outgoing interface Yes, as you can read from the link @jaclaz posted above to @lurker888 's post: What you see is not a new finding and has been explained by @lurker888 . He also p…

I read that already but as far as i understood that is a bit of a different case there. The wan connections are with masquarade rules changing the sorce ip. I can’t do any of that since i have connection tracking disabled and run completly stateless on that router with only some very simple firewall…

Selection of the pref src for the source address is correct (i.e. the intended) behavior for wireguard. It is specifically designed this way as a logical consequence of roaming being a feature and the symmetrical roles of the parties (foregoing the usual server-client arrangement.) The thread that …

By design, Wireguard itself does not use symmetric UDP flows. It treats each packet it sends individually in terms that it always finds the best route and thus also source address for it, ignoring any transport (UDP) level context. The reason for this is to make it possible to accommodate to address…

[image] sindy: Since there is no checkbox to tell the Wireguard implementation on Mikrotik to stick with the local socket at which it has received the initial handshake packet from the peer From 7.21 we can create WG instances (interfaces) per VRF and with that lock the outgoing UDP packets t…

Just placing the transport side of the WG interface into a dedicated VRF isn’t enough to pin it to a single address, you have to make sure that only a single address is available in that VRF. So if you want the router as a whole to connect to the world using multiple interfaces and non-elementary ro…

The idea with vrfs is to use @main routes and pref-src.

Put OSPF or another dynamic routing protocol into the mix and the beauty is lost again. The suggestion above just jails the transport side of the WG interface into the VRF and lets it talk to the rest of the world via a single uplink, the IPIP tunnel. What emerges from the main end of the tunnel get…

Wireguard source ip selection

RouterOS General

jaclaz December 31, 2025, 4:38pm 2

Coincidentally:

Maybe you can find in that thread and in the linked to post:
RouterOS blatantly ignores pref-src. Can this really be a bug? - #72 by lurker888
something useful to solve your problem.