Wireguard VPN server on Mikrotic routerboard - ping between two stations does not work

RouterOS
1

Hello.

I've creted Wireguard VPN server on my RB951Ui-2HnD. The RB is hidden under another router Zyxel which has public IP address. On Zyxel is opened port for wireguard VPN and traffixe is directed to the RB WAN interface.

Wireguard VPN server has IP 192.168.77.1. I've two windows stations with wireguard clients (192.168.77.2 and 192.168.77.3). When i activate tunnel i can ping to the server 192.168.77.1 from both clients.

One windows client (LAN IP 192.168.88.227) is connected to the VPN from LAN. Routerboard has LAN ip 192.168.88.1. Wireguard client is set to the IP 192.168.77.3.

wireguard tunnel setting for LAN PC is:

[Interface]
PrivateKey = priv
Address = 192.168.77.3/32
DNS = 8.8.8.8

[Peer]
PublicKey = pub
AllowedIPs = 192.168.77.0/24, 0.0.0.0/1, 128.0.0.0/1
Endpoint = 192.168.88.1:opened port on zyxel router
PersistentKeepalive = 10

Second windows client is connected from WAN through Zyxel router to the WAN IP of the routerboard. WAN IP of RB is 10.0.0.12. Wireguard client on this pc is set 192.168.77.2.

wireguard tunnel setting for WAN PC is:
[Interface]
PrivateKey = priv
Address = 192.168.77.2/32
DNS = 8.8.8.8

[Peer]
PublicKey = pub
AllowedIPs = 192.168.77.0/24, 0.0.0.0/1, 128.0.0.0/1
Endpoint = public address of the zyxel:opened port on zyxel
PersistentKeepalive = 10

In peers on VPN server i've set allowed address 192.168.77.2/32 and 192.168.77.3/32

I can ping from 192.168.77.2 or 3 to the 192.168.77.1.

I cannot ping from 192.168.77.2 to 192.168.77.3. I tried many settings but nothing works.

I know that some setting is wrong but i cannot find problem.

Thanks for help.

2

I have a similar setup (RB5009 behind ISP router)

Without seeing your config:
Check firewall rules on RB951 to allow traffic from/to Wireguard interface to pass though router (forward).
Or add Wireguard interface to LAN interface list (that's the fastest option but I prefer separate FW rules).

But you also need to keep in mind most Windows computers do not accept incoming traffic.
So check FW there as well.

3

I have a step by step guide that you can use. I used this last year. Just discard the OSPF configuration and use a static route on both sides.
https://docs.google.com/presentation/d/1i0B-lUHDgFQZKpR82_G0tD12GcsUJ1Gnhk-yJ7LFQbs/edit?usp=sharing