Community discussions

MikroTik App
 
mawebi
just joined
Topic Author
Posts: 2
Joined: Wed Oct 28, 2020 11:50 pm

MT Router as Wireguard Client & Benchmarks

Thu Oct 29, 2020 12:02 am

Hi,

today I tried to use the MT router as wireguard client (peer) and worked really easy. I had problems with MTU (I guess), but with the mangle entry (see #fix MTU) it worked like a charm:
# add interface
/interface wireguard
add listen-port=5555 mtu=1420 name=wireguard1 private-key=\
    "<private key MT peer>"
 
# add peer
/interface wireguard peers
add allowed-address=0.0.0.0/0,::/0 endpoint=<ip of wireguard server>:5555 interface=\
    wireguard1 public-key="<pub key wireguard server>"
 
# add ip to interface
/ip address
add address=10.200.200.2/24 interface=wireguard1 network=10.200.200.0
 
# nat
/ip firewall nat
add action=masquerade chain=srcnat out-interface=wireguard1
 
# fix MTU
/ip firewall mangle
add action=change-mss chain=forward new-mss=clamp-to-pmtu out-interface=wireguard1 protocol=tcp tcp-flags=syn
Afterwards I changed the default route to the IP 10.200.200.1 (wireguard server) and added a static router to reach the server itself without the tunnel (see viewtopic.php?t=73775). Now the whole traffic is tunneled.

For the benchmark, I used my internet connection (100mbit), with the following results:
* RB951G-2HnD - max. 65mbit/s at 99% CPU
* hEX (RB750Gr3) - max. 95mbit/s at 50-60% CPU
 
cascom
just joined
Posts: 7
Joined: Wed Oct 24, 2018 5:22 am
Location: Texas
Contact:

Re: MT Router as Wireguard Client & Benchmarks

Thu Nov 19, 2020 4:20 pm

I have a Wireguard subsciption vis OVPN.net and trying to use their config file to enter my info into my SXT LTE6 running 7.1
I'm using Winbox, have not mastered CLI yet.
I can see wireguard in my interfaces list.
Do I now need to add it to the interface list?
Sorry, I'm real new.
 
verbylab
newbie
Posts: 31
Joined: Sat Jun 26, 2021 4:30 pm

Re: MT Router as Wireguard Client & Benchmarks

Wed Jul 07, 2021 2:16 pm

Thanks for sharing your config and experience, mawebi. My wg connection was also spotty but adding the MSS mangle rule fixed it (thanks to your post).

I am using a MikroTik hAP ac2 and am currently seeing 30% of the throughput that a Raspberry Pi with the same Wireguard configuration delivers. I will go through my setup again to make sure the delta is not caused by a misconfiguration, but for what it's worth, I am also seeing 50-60% CPU usage during a speedtest.
 
User avatar
IPANetEngineer
Trainer
Trainer
Posts: 1470
Joined: Fri Aug 10, 2012 6:46 am
Location: Jackson, MS, USA
Contact:

Re: MT Router as Wireguard Client & Benchmarks

Wed Jul 07, 2021 3:53 pm

Thanks for the info on MTU!

I'm curious now to see if I can get it to 1Gbps reliably over wireguard. May have to do some tests into our DC with CCRs
Global - MikroTik Support & Consulting - English | Español | Serbian | Danish +1 855-645-7684
https://iparchitechs.com/ecosystem/mikr ... consulting mikrotiksupport@iparchitechs.com
 
verbylab
newbie
Posts: 31
Joined: Sat Jun 26, 2021 4:30 pm

Re: MT Router as Wireguard Client & Benchmarks

Wed Jul 07, 2021 9:11 pm

Would love to hear about your results if you end up running the tests.

Also looking forward to see the Wireguard support on RouterOS mature, but it's been performing very reliably on my little setup so far.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 8787
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: MT Router as Wireguard Client & Benchmarks

Wed Jul 07, 2021 10:14 pm

With two MT routers (one as client the other as server) one behind another MT and the other behind an ISP modem/router (both on same gig fiber network approx 15km apart) getting 300Mbps up and down. Very stable, had to play with MTU go enable some specific internet sites. Mangling is not required to adjust MTU
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
MTUNA Certified, by the Ascerbic Llama!
 
verbylab
newbie
Posts: 31
Joined: Sat Jun 26, 2021 4:30 pm

Re: MT Router as Wireguard Client & Benchmarks

Thu Jul 08, 2021 2:04 am

At which points in chain did you end up adjusting the MTU? I currently have a mangle rule in place but that probably slows things down. The MTU on the wg interface alone (1420) wasn't enough.
 
User avatar
Znevna
Member
Member
Posts: 345
Joined: Mon Sep 23, 2019 1:04 pm

Re: MT Router as Wireguard Client & Benchmarks

Thu Jul 08, 2021 9:23 am

If changing MSS fixes things for you, you're doing something wrong. Or.. atleast don't say that MSS fixes MTU. Setting the proper MTU "fixes" MTU.
MTKEK Certified by IRC
 
verbylab
newbie
Posts: 31
Joined: Sat Jun 26, 2021 4:30 pm

Re: MT Router as Wireguard Client & Benchmarks

Thu Jul 08, 2021 9:02 pm

Well yes and no, cause the MSS determines how large a packet is going to be when it reaches the data link layer.

If adjusting the MSS fixes the problem related to MTU, I think the OP framed it accurately enough with the understanding of the problem that was available at the time.

The MikroTik documentation (https://help.mikrotik.com/docs/display/ROS/WireGuard) suggests the Wireguard interface's MTU is set to 1420 by default. But many people's setup doesn't work with that setting. So the question is at which point(s) does the MTU need to be set to avoid having to clamp the MSS through a mangle rule? Does one orientate at the MTU of the PPPoE interface for example, or the lowest value in the chain?

Also see my questions from above:
At which points in chain did you end up adjusting the MTU? I currently have a mangle rule in place but that probably slows things down. The MTU on the wg interface alone (1420) wasn't enough.
Last edited by verbylab on Fri Jul 09, 2021 12:35 am, edited 1 time in total.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 8787
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: MT Router as Wireguard Client & Benchmarks

Thu Jul 08, 2021 10:37 pm

When the MTU was set to 1420 on both Wireguard interfaces (the MTU setting on the Wireguard MENU), the client computer started an application that brings up a program that allows access to websites etc, but first takes the user to a verification website. The process was not completed so we started messing with MTU settings. I understand about fragmentation so the first attempt was to reduce MTU.
I went from 1420 seemingly the default to 1400 and no joy. I went as low as 1320 and then went the other way.
I went in the opposite direction and tried 1480, and 1492 with no joy.
When I next attempted 1500 mtu, the client application worked great. Doing a test it shows fragmentation occurs but the user does not care as a challenging connection works flawlessly as do all other applications needed and general internet performance.
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
MTUNA Certified, by the Ascerbic Llama!
 
verbylab
newbie
Posts: 31
Joined: Sat Jun 26, 2021 4:30 pm

Re: MT Router as Wireguard Client & Benchmarks

Fri Jul 09, 2021 12:43 am

Thanks for sharing these data points!

I don't have a lot of experience with MTU settings, so will spend some time learning more about it beyond the basic definitions, particularly how it needs to be configured across interfaces in a network setup.

Who is online

Users browsing this forum: raimondsp and 11 guests