I’m struggling configuring an MT router to allow access to local network through wireguard. At the moment I’ve setup an VPS with wireguard server and router connects to it sucessfully.
The ISP router is an LTE router with CGNAT, not possible to open ports or making routes. I’m attaching a diagram to make it clear.
The goal is to make Laptop1 reach ISP Router’s LAN subnet devices (192.168.90.5,192.168.90.10, etc.). I’ve tried to follow @anav posts here on the forum (really helpful) but I feel that there’s something I miss or not doing correctly.
Also as a side note, I’ve tested the new BTH feature and works okay (also I can access remote local subnet) and zerotier too, both working. The reason of make this myself is to use non ARM MT devices (I have many of them deployed and won’t be changed soon…)
Here’s the MT CAP config (removed wireless configs):
Okay… THe big error right off the bat is using the same IP structure on your LAN behind the CAP as the LAN structure of the ISP router. Which means you are missing an ip address, a pool, a dhcp-server and a dhcp-server network.
\
MT CAP wireguard Ip address is wrong, should be: add address=10.252.1****.2****/24 interface=wireguard1 network=10.252.1.0
MT CAP peer setttings for the VPS is wrong should be: /interface wireguard peers
add allowed-address=10.252.1**.0/24** endpoint-address=VPS_IP endpoint-port=51825 interface=wireguard1 persistent-keepalive=10s public-key=
“JgMJWdSc9y REDACTED=”
MT CAP missing address for your bridge etc!!
/ip address
add address=192.168.50.1/24 interface=bridge1 network=192.168.50.0
/ip pool
add name=dhcp_poolbridge ranges=192.168.50.2-192.168.50.254
/ip dhcp-server
add address-pool=dhcp_poolbridge interface=bridge name=dhcp1
/ip dhcp-server network
add address=192.168.50.0/24 dns-server=192.168.50.1 gateway=192.168.50.1
You have no route made..
/ip route
add dst-address=0.0.0.0/0 gateway=192.168.90.1 routing-table=main
Need a firewall rule on vps to allow incoming wireguard traffic and outgoing wireguard traffic (acting as a relay).
I dont know vps but in the MT it would look like. add chain=forward action=accept in-interface=wireguard1 out-interface=wireguard1
(traffic coming from a peer is allowed then to re-enter the tunnel for another peer etc.)
Thank you for taking your time to reply me, really appreciate it.
Corrected points #1 and #2 on my MT
As point #3, I have a quick question: The MT device (in this case a CAP), is just a dumb access point with an fixed IP address on local network (192.168.90.2) the DCHP server is located at ISP Router with IP (192.168.90.1). It’s still necessary to create another DHCP server? I believe CAP is technically acting as a bridge instead of a router. I’m correct?
Point #4
Sorry for that, appears that the command used
export
didn’t export routes content, maybe exists another command, pasting an screenshot here:
No firewall rules, and NAT rule corrected
At the moment I can ping CAP ip 10.252.1.2 from laptop wireguard client 10.252.1.5, still trying to ping 192.168.90.x equipment from laptop but no joy… will try some changes.
Well thats a completely different kettle of fish.
Because you had a WAN interface list, I assumed you wanted the capac to act as a router not an AP/switch.
Also I dont use capsman, why bother if you only have the one device, aka not required???
What I have to think about is whether or not a capac in the ap/switch setup can be an effective wireguard client.
We can experiment LOL.
Regarding the interfaces list I’ve started from Mikrotiks default configuration, the only thing that I’ve done is to change to CAP via quickset with Static Ip address.
The reason to use CAP AC XL for this wireguard thing, is because is a device that I have more or less at hand at a remote location with CGNAT. (In reality I can access the remote network and lan devices via Zerotier installed on remote lan computer).
Basically I’ve tried this same device with the new back to home feature and it’s working good (to access lan side of CAP AC XL), basically I want to do the same but manually with my own VPS, the reason to do that is to add non ARM devices that I have on remote clients (I don’t need so much speed).
