Folks,
I am a new MikroTik user and Wireguard. I have a VPS with with WG installed and forward all traffics to MikroTik at home. After all of the basic configurations are done.
I have a laptop connected to a MikroTik, received an IP address 192.168.88.xxx
I could use the laptop to browse “some” web site, some failed to load or timed out. Went on speed test and on download speed I’ve got anywhere from 150-210Mbps, I am not so worried about the download speed. However upload speed had failed, I am showing 0Mpbs.
As a new user, I am not sure what I am missing. Could someone please kindly look at my export file and see what am I missing?
I do not know what more information to provide but let me know what else I could provide to troubleshooting this issue.
Kit
# 2024-07-31 17:16:46 by RouterOS 7.15.3
# software id = K233-CG7J
#
# model = RBD52G-5HacD2HnD
# serial number = XXXXXXXXXX
/disk
set usb1 media-interface=none media-sharing=no
/interface bridge
add admin-mac=XX:XX:XX:XX:XX:XX auto-mac=no comment=defconf name=bridge \
port-cost-mode=short
/interface wireguard
add listen-port=13231 mtu=1420 name=wg0
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=10m name=defconf
/routing table
add disabled=no fib name=wg-vps1
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether5 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=*1 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=*2 \
internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface ovpn-server server
set auth=sha1,md5
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=XXX.XX.XX.XX endpoint-port=\
51820 interface=wg0 name=doomed-1 persistent-keepalive=25s public-key=\
"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=10.10.10.8/24 interface=wg0 network=10.10.10.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=\
1.1.1.1,8.8.8.8,1.0.0.1,8.8.4.4 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8,1.0.0.1
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input dst-port=XXX protocol=tcp src-address=\
192.168.80.0/20
add action=accept chain=input dst-port=XXX protocol=tcp
add action=accept chain=input dst-port=XXX protocol=tcp src-address=\
192.168.80.0/20
/ip firewall mangle
add action=change-mss chain=forward new-mss=clamp-to-pmtu out-interface=wg0 \
passthrough=yes protocol=tcp tcp-flags=syn
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat out-interface=wg0
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=10.10.10.1 routing-table=\
wg-vps1 suppress-hw-offload=no
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www port=XXX
set ssh port=XXX
set api disabled=yes
set winbox port=XXX
set api-ssl disabled=yes
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/routing rule
add action=lookup disabled=no src-address=192.168.88.0/24 table=wg-vps1
/system clock
set time-zone-name=America/New_York
/system identity
set name=MikroTik-hAP-AC2
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN