Hi,
My ISP has blocked access to some websites and services and I have to use a wireguard VPN if I want to open them. Until now I’ve been establishing the VPN connection on my computer but I want to configure my router to route requests to these specific blocked addresses through wireguard VPN connection. I have done some configurations but sometimes it doesn’t work and other times it’s very slow and unusable. I don’t know what I did wrong. Please help me with this configuration.
I use TLS Host under mangle to detect target addresses to add them into a list of addresses and then another mangle rule to mark any connection to these addresses as a routing mark.
Fasttrack and mangle rules don’t go together. Simple solution is to disable fasttrack, but you may not want that, because it can be useful thing. Other solution is to not use fasttrack for connections over VPN. For that you need to first mark connections, instead of marking routing directly. Then you mark routing based on connection mark. And it will allow you to add condition to fasttrack rule, to only apply for connections that don’t have connection mark for VPN.
To be clear you want your PC behind the router which is behind the LIMITING ISP to reach some other location via Wireguard?
If so what are you connecting too? A third party VPN provider or your own MT Remote Router somewhere else ??
Okay…
So you want to establish a tunnel wit the originating end being the linux server somewhere on the internet.
The tunnel will connect to your router locally.
Then you want to be able from your PC behind the local router to enter the tunnel and go out the linux server internet to access web sites that your local ISP blocks.
+++++++++++++++++++++++++++++++++++++++++++
Stated on the first post would have been golden!
+++++++++++++++++++++++++++++++++++++++++++
You have some EASY options which all have to do with IP routes, which is the challenging part of this.
a. move ALL internet traffic from the subnet on the local router that your PC is on, through the tunnel for internet traffic
b. move your PC to a different subnet and then route only your PC through the tunnel for all internet traffic.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
A bit more work option
c. Make up enough dst-route rules to cover the IP address you want. Each address will probably require its own IP route.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Oh the Horror option
d. Mangle traffic from your PC and send that out the tunnel
Burns my gut that MIKROTIK will not include src-address-list OR dst-address-list in IP ROUTE RULES !!!
I would do it russki style, ply Normis with booze and prostitutes and then use the photos to ensure all the changes I wanted were implemented.
Seriously, there is probably a good reason why they don’t and I dont know enough about networking or RoS or both, to know better.
(Note: I am not quite vain enough to think, this is somehow a brilliant idea that they or nobody else has thought of and requested and assume if so, that it was subsequently rejected.)
