Community discussions

MikroTik App
just joined
Topic Author
Posts: 1
Joined: Sat Sep 26, 2020 6:46 pm

[BUG] Wireguard handshake causes kernel panic

Sat Sep 26, 2020 7:20 pm

Version number: RouterOS 7.1beta2
Router's model: CCR1009-8G-1S
Configuration export:
Kernel panic backtrace:
Steps to reproduce the issue:
Create a basic Wireguard tunnel between Linux kernel version 5.4.0-1018-aws (Ubuntu 20.04 LTS running on AWS Lightsail) and MikroTik CCR1009-8G-1S running RouterOS 7.1beta2.
Once tunnel is up and handshake OK, the important part which causes the kernel panic is to ping the remote end from a device behind the MikroTik on a bridge.

Detailed description / extra information:
You don't even need to add a firewall rule allowing the ping from the device to the remote end. Simply attempting to ping the remote end from a device causes a kernel panic.
In my case, I am pinging form (my computer) to (remote Wireguard server). The router has IP

When pinging remote end directly from router, there is no kernel panic, but the ping does not work in any direction. Traffic can only go from the MikroTik router to the remote end, from remote end to MikroTik.

"wg show" command from remote end:
tcpdump from remote end when pinging from MikroTik router to remote end:
tcpdump from remote end when pinging from remote end to MikroTik router:
Both tcpdump commands above were ran with all firewall filter rules disabled.

As is clear from the tcpdumps above, the MikroTik router receives no packets over the Wireguard tunnel from the remote end, but the remote end can receive all packets from the MikroTik router.

Can send latest autosupout.rif to any MikroTik employees, just ask.
Please also ask me for any further explanation or further information, I will be glad to help debug this issue in any way I can.

Thanks for releasing a beta version of RouterOS v7 for us to test and thanks so much for taking the time to add support for Wireguard :)

Who is online

Users browsing this forum: No registered users and 8 guests