WireGuard VPN from Android, no internet, no Winbox

RouterOS General
1

Greetings,
I've been working on getting a Wireguard connection set up between my Android phone and my hAPac2 router. I've created the connection and confirmed that the keys are correct, but when connected the client cannot connect to the internet, nor can it connect to the router interface using the Mikrotik App (Winbox). I have an internal Pi-Hole server set up and am using FW rules to force all DNS traffic to that box as a way of preventing (as much as possible) the LAN clients from going to external DNS providers, but outside of that there's nothing special about my setup. I've tried adding Filter input rules to allow all traffic from the wg1 interface, and I have the Wireguard subnet as well as the specific IP address of the peer added to the Winbox service availability settings, but I cant get Winbox to connect either. Once the WG connection is established, I can see from the counters that there is no traffic flowing out to the client, it's all inbound. Included are my current settings, I'm happy to supply more information if needed.. Any help is appreciated.

/interface bridge
add admin-mac=EE:4D:28:45:51:32 auto-mac=no name=LAN-Bridge
/interface ethernet
set [ find default-name=ether1 ] name=ether1-WAN-Modem
set [ find default-name=ether2 ] arp=proxy-arp name=ether2-LAN-Switch
/interface wireguard
add comment="Wireguard" listen-port=13231 mtu=1420 name=wg1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=MGMT
/ip smb users
set [ find default=yes ] disabled=yes
/interface bridge port
add bridge=LAN-Bridge interface=ether2-LAN-Switch
add bridge=LAN-Bridge interface=ether3
/ipv6 settings
set disable-ipv6=yes forward=no
/interface list member
add interface=ether1-WAN-Modem list=WAN
add interface=ether2-LAN-Switch list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=MGMT
add interface=LAN-Bridge list=LAN
add interface=wg1 list=LAN 
/interface wireguard peers
add allowed-address=10.10.100.2/32 client-dns=192.168.200.202 endpoint-port=\
    13231 interface=wg1 name="John's Phone" public-key=\
    "Public Key"
add address=192.168.200.1/24 comment="Static Ip for Bridge" interface=\
    LAN-Bridge network=192.168.200.0
add address=10.10.100.1/24 comment="Wireguard Inbound Interface" interface=wg1 \
    network=10.10.100.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=10m
/ip dhcp-client
add comment=defconf interface=ether1-WAN-Modem name=ether1-WAN-Modem
/ip dns
set allow-remote-requests=yes servers=192.168.200.202,10.10.100.1
/ip firewall address-list
add address=0.0.0.0/8 comment="defconf: RFC6890" list=no_forward_ipv4
add address=169.254.0.0/16 comment="defconf: RFC6890" list=no_forward_ipv4
add address=224.0.0.0/4 comment="defconf: multicast" list=no_forward_ipv4
add address=255.255.255.255 comment="defconf: RFC6890" list=no_forward_ipv4
add address=127.0.0.0/8 comment="defconf: RFC6890" list=bad_ipv4
add address=192.0.0.0/24 comment="defconf: RFC6890" list=bad_ipv4
add address=192.0.2.0/24 comment="defconf: RFC6890 documentation" list=\
    bad_ipv4
add address=198.51.100.0/24 comment="defconf: RFC6890 documentation" list=\
    bad_ipv4
add address=203.0.113.0/24 comment="defconf: RFC6890 documentation" list=\
    bad_ipv4
add address=240.0.0.0/4 comment="defconf: RFC6890 reserved" list=bad_ipv4
add address=0.0.0.0/8 comment="defconf: RFC6890" list=not_global_ipv4
add address=10.0.0.0/8 comment="defconf: RFC6890" list=not_global_ipv4
add address=100.64.0.0/10 comment="defconf: RFC6890" list=not_global_ipv4
add address=169.254.0.0/16 comment="defconf: RFC6890" list=not_global_ipv4
add address=172.16.0.0/12 comment="defconf: RFC6890" list=not_global_ipv4
add address=192.0.0.0/29 comment="defconf: RFC6890" list=not_global_ipv4
add address=192.168.0.0/16 comment="defconf: RFC6890" list=not_global_ipv4
add address=198.18.0.0/15 comment="defconf: RFC6890 benchmark" list=\
    not_global_ipv4
add address=255.255.255.255 comment="defconf: RFC6890" list=not_global_ipv4
add address=224.0.0.0/4 comment="defconf: multicast" list=bad_src_ipv4
add address=255.255.255.255 comment="defconf: RFC6890" list=bad_src_ipv4
add address=0.0.0.0/8 comment="defconf: RFC6890" list=bad_dst_ipv4
add address=224.0.0.0/4 comment="defconf: RFC6890" list=bad_dst_ipv4
add address=192.168.200.0/24 list=HomeLAN
add address=192.168.200.1 comment="Router LAN IP" list=DNS_Redirect_Exclude
add address=192.168.200.202 comment="Pi-hole - Secondary" list=\
    DNS_Redirect_Exclude
add address=192.168.200.224 comment="PI-Hole - Primary" list=\
    DNS_Redirect_Exclude
add address=192.168.200.1 comment="BTH Local Addresses" list=\
    "All Local Addresses"
add address=10.10.100.0/24 comment="WireGuard Subnet" list=HomeLAN
/ip firewall filter
add action=accept chain=input comment="allow Wireguard" dst-port=13231 \
    protocol=udp
add action=drop chain=input comment="pwlgrzs-blacklist Drop" \
    connection-state=new disabled=yes in-interface=ether1-WAN-Modem \
    src-address-list=pwlgrzs-blacklist
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=accept chain=input comment="defconf: accept ICMP after RAW" \
    protocol=icmp
add action=accept chain=input comment="Custom-Allow WireGuard Traffic" \
    in-interface=wg1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN log-prefix=NotLan-Dropped
add action=accept chain=forward comment=\
    "defconf: accept all that matches IPSec policy" disabled=yes \
    ipsec-policy=in,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=accept chain=forward comment="Custom - Allow WG to Internet" \
    in-interface=wg1 out-interface-list=WAN
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid log=yes log-prefix="Drop Invalid forward"
add action=drop chain=forward comment=\
    "defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
add action=drop chain=forward comment="defconf: drop bad forward IPs" \
    src-address-list=no_forward_ipv4
add action=drop chain=forward comment="defconf: drop bad forward IPs" \
    dst-address-list=no_forward_ipv4
/ip firewall nat
add action=accept chain=srcnat comment=\
    "defconf: accept all that matches IPSec policy" disabled=yes \
    ipsec-policy=out,ipsec
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment=\
    "Force DNS to Primary Pi-hole UDP - LAN only" dst-address=\
    !192.168.200.202 dst-port=53 in-interface-list=LAN log=yes log-prefix=\
    "Force DNS fromn LAN only UDP" protocol=udp src-address-list=\
    !DNS_Redirect_Exclude to-addresses=192.168.200.202
add action=dst-nat chain=dstnat comment=\
    "Force DNS to Primary Pi-hole TCP - LAN only" dst-address=\
    !192.168.200.202 dst-port=53 in-interface-list=LAN log=yes log-prefix=\
    "Force DNS from LAN only TCP" protocol=tcp src-address-list=\
    !DNS_Redirect_Exclude to-addresses=192.168.200.202
add action=dst-nat chain=dstnat comment="Force DNS to Secondary Pi-hole UDP" \
    disabled=yes dst-address=!192.168.200.202 dst-port=53 in-interface-list=\
    LAN protocol=udp src-address-list=!DNS_Redirect_Exclude to-addresses=\
    192.168.200.224
add action=dst-nat chain=dstnat comment="Force DNS to Secondary Pi-hole TCP" \
    disabled=yes dst-address=!192.168.200.202 dst-port=53 in-interface-list=\
    LAN protocol=tcp src-address-list=!DNS_Redirect_Exclude to-addresses=\
    192.168.200.224
add action=dst-nat chain=dstnat disabled=yes dst-address=!192.168.200.202 \
    dst-port=53 log=yes log-prefix="DNS-Redirect UDP" protocol=udp \
    src-address-list=!DNS_Redirect_Exclude to-addresses=192.168.200.202
add action=dst-nat chain=dstnat disabled=yes dst-address=!192.168.200.202 \
    dst-port=53 log=yes log-prefix="DNS-Redirect TCP" protocol=tcp \
    src-address-list=!DNS_Redirect_Exclude to-addresses=192.168.200.202
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.200.202 \
    dst-port=53 log-prefix="DNS SRCNAT Rule 9" protocol=udp src-address=\
    192.168.200.0/24
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.200.202 \
    dst-port=53 log-prefix="DNS SRCNAT Rule 10" protocol=tcp src-address=\
    192.168.200.0/24
/ip firewall raw
add action=accept chain=prerouting comment=\
    "defconf: enable for transparent firewall" disabled=yes
add action=accept chain=prerouting comment="defconf: accept DHCP discover" \
    dst-address=255.255.255.255 dst-port=67 in-interface-list=LAN protocol=\
    udp src-address=0.0.0.0 src-port=68
add action=drop chain=prerouting comment="defconf: drop bogon IP's" \
    src-address-list=bad_ipv4
add action=drop chain=prerouting comment="defconf: drop bogon IP's" \
    dst-address-list=bad_ipv4 log-prefix="Dst=BadIP-"
add action=drop chain=prerouting comment="defconf: drop bogon IP's" \
    src-address-list=bad_src_ipv4
add action=drop chain=prerouting comment="defconf: drop bogon IP's" \
    dst-address-list=bad_dst_ipv4 log-prefix=raw6-
add action=drop chain=prerouting comment="Drop known bad IPs (pwlgrzs)" \
    disabled=yes in-interface-list=WAN src-address-list=pwlgrzs-blacklist
add action=drop chain=prerouting comment="defconf: drop non global from WAN" \
    in-interface-list=WAN src-address-list=not_global_ipv4
add action=drop chain=prerouting comment=\
    "defconf: drop forward to local lan from WAN" dst-address=\
    192.168.200.0/24 in-interface-list=WAN
add action=drop chain=prerouting comment=\
    "defconf: drop local if not from default IP range" in-interface-list=LAN \
    src-address=!192.168.200.0/24
add action=drop chain=prerouting comment="defconf: drop bad UDP" port=0 \
    protocol=udp
add action=jump chain=prerouting comment="defconf: jump to ICMP chain" \
    jump-target=icmp4 protocol=icmp
add action=jump chain=prerouting comment="defconf: jump to TCP chain" \
    jump-target=bad_tcp protocol=tcp
add action=accept chain=prerouting comment=\
    "defconf: accept everything else from LAN" in-interface-list=LAN
add action=accept chain=prerouting comment=\
    "defconf: accept everything else from WAN" in-interface-list=WAN
add action=drop chain=prerouting comment="defconf: drop the rest"
add action=drop chain=bad_tcp comment="defconf: TCP flag filter" protocol=tcp \
    tcp-flags=!fin,!syn,!rst,!ack
add action=drop chain=bad_tcp comment=defconf protocol=tcp tcp-flags=fin,syn
add action=drop chain=bad_tcp comment=defconf protocol=tcp tcp-flags=fin,rst
add action=drop chain=bad_tcp comment=defconf protocol=tcp tcp-flags=fin,!ack
add action=drop chain=bad_tcp comment=defconf protocol=tcp tcp-flags=fin,urg
add action=drop chain=bad_tcp comment=defconf protocol=tcp tcp-flags=syn,rst
add action=drop chain=bad_tcp comment=defconf protocol=tcp tcp-flags=rst,urg
add action=drop chain=bad_tcp comment="defconf: TCP port 0 drop" port=0 \
    protocol=tcp
add action=accept chain=icmp4 comment="defconf: echo reply" icmp-options=0:0 \
    limit=5,10:packet protocol=icmp
add action=accept chain=icmp4 comment="defconf: net unreachable" \
    icmp-options=3:0 protocol=icmp
add action=accept chain=icmp4 comment="defconf: host unreachable" \
    icmp-options=3:1 protocol=icmp
add action=accept chain=icmp4 comment="defconf: protocol unreachable" \
    icmp-options=3:2 protocol=icmp
add action=accept chain=icmp4 comment="defconf: port unreachable" \
    icmp-options=3:3 protocol=icmp
add action=accept chain=icmp4 comment="defconf: fragmentation needed" \
    icmp-options=3:4 protocol=icmp
add action=accept chain=icmp4 comment="defconf: echo" icmp-options=8:0 limit=\
    5,10:packet protocol=icmp
add action=accept chain=icmp4 comment="defconf: time exceeded " icmp-options=\
    11:0-255 protocol=icmp
add action=drop chain=icmp4 comment="defconf: drop other icmp" protocol=icmp
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip service
set ftp disabled=yes
set telnet disabled=yes
set www available-from=192.168.200.0/24,10.10.100.0/24
set reverse-proxy disabled=yes
set ssh available-from=192.168.200.0/24,192.168.88.0/24 \
    disabled=yes
set winbox available-from=\
    192.168.200.0/24,10.52.52.1/32,10.10.100.0/24,10.10.100.2/32
/ipv6 firewall filter
add action=drop chain=input
add action=drop chain=forward
/tool netwatch
add comment="Pi-hole primary  secondary failover" down-script=":log warning \"\
    Primary Pi-hole DOWN - switching redirect to secondary\";/ip firewall nat \
    disable [find comment~\"Force DNS to Primary\"];/ip firewall nat enable [f\
    ind comment~\"Force DNS to Secondary\"]" host=192.168.200.202 interval=\
    15s timeout=2s type=simple up-script=":log info \"Primary Pi-hole UP - swi\
    tching redirect to primary\";/ip firewall nat enable [find comment~\"Force\
    \_DNS to Primary\"];/ip firewall nat disable [find comment~\"Force DNS to \
    Secondary\"]"
2

It's probably due to:

in combination with:

So of course, with wg1 being part of the LAN list, packets coming from the WG client, that have 10.10.100.2 as source, will be dropped by this RAW rule

I would simply remove all the RAW rules you added. I know that you've copied them from the MIkroTik examples in the documentation, but for normal home internet (with ISPs that are not incompetent), they are unnecessary and the normal filter rules are already enough.

3

Thank you! I changed the rule so that the src-address is now a list that includes the Wireguard subnet and I can connect to the router using WInbox and to local addresses as well. I still was unable to get web access through the tunnel but that turned out to be a setting on my Pi-Hole server.

I've had the advice to simplify my firewall setup from others as well, and I am planning on doing that, I just need to find time to take everything offline for as long as it takes to make the change then bring it back up and test. I'm justifiably cautious when it comes to making my router secure so I want to make sure it's done right. Thanks again for your help!
EDIT: I know that at one point there was a default Firewall config that was posted here by some experienced members, but that seems to have been deleted, is there a new thread for that I can refer to?
*EDIT 2: I found the relevant posts, it seems the general wisdom is to use the OOB firewall and modify it as needed, so I'll start from there.

4

The usual advice is to leave "as is" the default OR build upon it.

The default is here:
Buying - RB1100AHx4 Dude Edition - Questions about Firewall - #4 by rextended

The possible debate only revolves around trusting the way the good Mikrotik guys drop things or being more explicit, see:
Review of PPPoE and Firewall rules for improvements - #9 by jaclaz
Ready to start my custom firewall rules journey

5

What is the point of dropping traffic from a blacklist when it’s directed at an input on your own network?
Especially when that drop happens only after you’ve left the door wide open to the rest of the world...
The entire firewall concept is flawed.
The default configuration is fine as it is...
This is the part that needs to be addressed to meet the requirements...
For instance, the IPv6 section, which was simply deleted rather than properly configured,
instead, a couple of rules were foolishly thrown in that don't actually do what they claim to do...
Because even when the IPv6 component is set to disabled=yes, IPv6 traffic still gets through...

6

Sorry, I'm not sure I understand. The Wireguard entry is only for the initial connection on that port, it's from the Mikrotik guidance here and the placement is as they instructed:

/ip firewall filter
add action=accept chain=input comment="allow WireGuard" dst-port=13231 protocol=udp place-before=1

Also, the blacklist entry is disabled, it's a legacy entry that I had just as a place holder, but the interface it's configured on is my WAN connection.

For IPV6, I neglected to add the relevant Firewall section, sorry about that:

/ipv6 firewall filter
add action=drop chain=input
add action=drop chain=forward

I'm happy to make any necessary changes but I thought that other than the WG issue, it was otherwise fundamentally sound (other than the bloat from the advanced firewall rules). Please let me know if I'm wrong.

7

This is in relation to the default rules,
after all,
how would they know whether or not you might have added a "pwlgrzs-blacklist"?
(regardless of whether it’s active or not)

And regardless of how things turn out, they made a mistake too,
I would place that rule somewhere else...
(example: place-before=[find where comment="defconf: drop all not coming from LAN"])

These are the same people who recommend using "detect internet" and "quickset"...
So, there will always be someone giving bad advice...

8

No, they do exist, and it is precisely those rules that I was referring to.

a couple of rules were foolishly thrown in that don't actually do what they claim to do

That is just an illusion. Or rather, two illusions:

  1. That removing the default rules makes any sense,
  2. That, somehow, IPv6 traffic magically stops passing through the RouterBOARD.
9

Thanks for the responses. So the WG rule should be placed immediately above the "defconf: drop all not coming from LAN" FW entry:

add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=accept chain=input comment="defconf: accept ICMP after RAW" \
    protocol=icmp
add action=accept chain=input comment="Custom-Allow Wireguard Connect" dst-port=13231 \
    protocol=udp
add action=accept chain=input comment="Custom-Allow WireGuard Traffic" \
    in-interface=wg1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN log-prefix=NotLan-Dropped

I get that the MT docs assume that the rest of the rules are in thier original order, but for my config, I'm not clear on how this is more secure.

For the IPV6 part, whether to shut it off and put in basic disallow rules or allow it and put in a complete IPV6 firewall is a topic of some very heated discussion. I'm going to spend some time reading up on that.