Wireguard Client - Handshake for peer did not complete

dima1002 · Tue Dec 12, 2023 10:11 pm

Hi,

I have an Opsense with a Wireguard server on it and a Mikrotik with a Wireguard client. Unfortunately I always get a timeout with the Wirguard Client.

However, if I take the QR code and connect my cell phone to it on the same network, I am online. So the configuration actually has to be correct. What could be wrong here?

I changed the keys, they are not the real ones.

WIREGUARD: wireguard-client: XXXXXXXX=: Handshake for peer did not complete after 5 seconds, retrying (try 16)

# 2023-12-12 21:04:41 by RouterOS 7.12.1
# software id = MVD7-Y3UP
#
# model = RB962UiGS-5HacT2HnT
/interface bridge
add fast-forward=no name=BRIDGE
/interface ethernet
set [ find default-name=ether1 ] name=WAN1
/interface wireguard
add listen-port=13233 mtu=1420 name=wireguard-client
/interface list
add name=WAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk mode=dynamic-keys name=WlanCompany \
    supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] disabled=no mode=ap-bridge security-profile=\
    WlanCompany ssid=WLAN_Company
set [ find default-name=wlan2 ] disabled=no mode=ap-bridge security-profile=\
    WlanCompany ssid=WLAN_Company
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=COMPANY ranges=10.248.1.50-10.248.1.150
/ip dhcp-server
add address-pool=COMPANY interface=BRIDGE lease-time=10m name=COMPANY
/system logging action
add disk-file-count=1 disk-file-name=auth.log disk-lines-per-file=5000 name=\
    auth target=disk
/user group
add name=dude
/interface bridge port
add bridge=BRIDGE ingress-filtering=no interface=ether2
add bridge=BRIDGE ingress-filtering=no interface=ether3
add bridge=BRIDGE ingress-filtering=no interface=ether4
add bridge=BRIDGE ingress-filtering=no interface=ether5
add bridge=BRIDGE interface=wlan1
add bridge=BRIDGE interface=wlan2
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add interface=WAN1 list=WAN
/interface ovpn-server server
set auth=sha1,md5
/interface wireguard peers
add allowed-address=10.10.150.0/24 client-address=10.10.140.63/32 \
    client-endpoint=191.6.209.212 interface=wireguard-client \
    persistent-keepalive=25s private-key=\
    "kOoHLfgEJ1gRqQlxVONRF3eQ1eFRflXOkHpLkFuNx0M=" public-key=\
    "1cp2GkWEw2bZtsizc0p1/m29AWTrVTMGW6oLQIPTxSg="
/ip address
add address=10.248.1.254/24 interface=BRIDGE network=10.248.1.0
add address=10.10.140.63/24 interface=wireguard-client network=10.10.140.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=10m
/ip dhcp-client
add interface=WAN1
/ip dhcp-server network
add address=10.248.1.0/24 dns-server=10.248.1.254 gateway=10.248.1.254
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip firewall address-list
add address=10.248.1.0/24 list=local
add address=192.168.181.0/24 list=local
add address=192.168.152.0/24 list=local
add address=8.8.8.8 list=DNS
add comment="Black List (SSH)" list="Black List (SSH)"
add comment="Black List (Winbox)" list="Black List (Winbox)"
add comment="Black List (Port Scanner WAN)" list=\
    "Black List (Port Scanner WAN)"
add comment="Black List (Port Scanner LAN)" list=\
    "Black List (Port Scanner LAN)"
add address=192.168.254.0/24 list=local
add address=10.16.0.0/16 list=local
add address=10.1.0.0/24 list=local
add address=192.168.155.0/24 list=local
add address=192.168.249.0/24 list=local
add address=10.10.140.0/24 list=local
add address=10.10.150.0/24 list=local
add address=10.10.141.0/24 list=local
/ip firewall filter
add action=drop chain=input comment="Drop invalid connections" \
    connection-state=invalid
add action=drop chain=input comment="Drop Netbios" connection-state="" \
    dst-port=137,138 protocol=udp
add action=jump chain=forward connection-state=new jump-target=detect-ddos
add action=return chain=detect-ddos dst-limit=32,32,src-and-dst-addresses/10s
add action=return chain=detect-ddos src-address-list=DNS
add action=add-dst-to-address-list address-list=ddosed address-list-timeout=\
    10m chain=detect-ddos
add action=add-src-to-address-list address-list=ddoser address-list-timeout=\
    10m chain=detect-ddos
add action=drop chain=forward comment="Drop DDOS" connection-state=new \
    dst-address-list=ddosed src-address-list=ddoser
add action=drop chain=input comment=\
    "Drop anyone in the Port Scanner (WAN) list." in-interface-list=WAN log=\
    yes log-prefix="BL_Black List (Port Scanner WAN)" src-address-list=\
    "Black List (Port Scanner WAN)"
add action=drop chain=forward comment=\
    "Drop anyone in the Port Scanner (WAN) list." in-interface-list=WAN log=\
    yes log-prefix="BL_Black List (Port Scanner WAN)" src-address-list=\
    "Black List (Port Scanner WAN)"
add action=add-src-to-address-list address-list=\
    "Black List (Port Scanner WAN)" address-list-timeout=4w2d chain=input \
    comment="Add TCP port scanner to Port Scanner (WAN) list." \
    in-interface-list=WAN log=yes log-prefix=\
    "Add_Black List (Port Scanner WAN)" protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment=\
    "Drop anyone in the Port Scanner (LAN) list." in-interface-list=WAN log=\
    yes log-prefix="BL_Black List (Port Scanner LAN)" src-address-list=\
    "Black List (Port Scanner LAN)"
add action=drop chain=forward comment=\
    "Drop anyone in the Port Scanner (LAN) list." in-interface-list=WAN log=\
    yes log-prefix="BL_Black List (Port Scanner LAN)" src-address-list=\
    "Black List (Port Scanner LAN)"
add action=add-src-to-address-list address-list=\
    "Black List (Port Scanner LAN)" address-list-timeout=4w2d chain=forward \
    comment="Add TCP port scanner to Port Scanner (LAN) list." \
    in-interface-list=WAN log=yes log-prefix=\
    "Add_Black List (Port Scanner LAN)" protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment="Drop anyone in Black List (Winbox)." \
    in-interface-list=WAN log=yes log-prefix="BL_Black List (Winbox)" \
    src-address-list="Black List (Winbox)"
add action=jump chain=input comment="Jump to Black List (Winbox) chain." \
    dst-port=8291 in-interface-list=WAN jump-target=\
    "Black List (Winbox) Chain" protocol=tcp
add action=add-src-to-address-list address-list="Black List (Winbox)" \
    address-list-timeout=4w2d chain="Black List (Winbox) Chain" comment="Trans\
    fer repeated attempts from Black List (Winbox) Stage 6 to Black List (Winb\
    ox)." connection-state=new in-interface-list=WAN log=yes log-prefix=\
    "Add_Black List (Winbox)" src-address-list="Black List (Winbox) Stage 6"
add action=add-src-to-address-list address-list="Black List (Winbox) Stage 6" \
    address-list-timeout=1m chain="Black List (Winbox) Chain" comment=\
    "Add succesive attempts to Black List (Winbox) Stage 6." \
    connection-state=new in-interface-list=WAN log=yes log-prefix=\
    "Add_Black List (Winbox) S6" src-address-list=\
    "Black List (Winbox) Stage 5"
add action=add-src-to-address-list address-list="Black List (Winbox) Stage 5" \
    address-list-timeout=1m chain="Black List (Winbox) Chain" comment=\
    "Add succesive attempts to Black List (Winbox) Stage 5." \
    connection-state=new in-interface-list=WAN log=yes log-prefix=\
    "Add_Black List (Winbox) S5" src-address-list=\
    "Black List (Winbox) Stage 4"
add action=add-src-to-address-list address-list="Black List (Winbox) Stage 4" \
    address-list-timeout=1m chain="Black List (Winbox) Chain" comment=\
    "Add succesive attempts to Black List (Winbox) Stage 4." \
    connection-state=new in-interface-list=WAN log=yes log-prefix=\
    "Add_Black List (Winbox) S4" src-address-list=\
    "Black List (Winbox) Stage 3"
add action=add-src-to-address-list address-list="Black List (Winbox) Stage 3" \
    address-list-timeout=1m chain="Black List (Winbox) Chain" comment=\
    "Add succesive attempts to Black List (Winbox) Stage 3." \
    connection-state=new in-interface-list=WAN log=yes log-prefix=\
    "Add_Black List (Winbox) S3" src-address-list=\
    "Black List (Winbox) Stage 2"
add action=add-src-to-address-list address-list="Black List (Winbox) Stage 2" \
    address-list-timeout=1m chain="Black List (Winbox) Chain" comment=\
    "Add succesive attempts to Black List (Winbox) Stage 2." \
    connection-state=new in-interface-list=WAN log=yes log-prefix=\
    "Add_Black List (Winbox) S2" src-address-list=\
    "Black List (Winbox) Stage 1"
add action=add-src-to-address-list address-list="Black List (Winbox) Stage 1" \
    address-list-timeout=1m chain="Black List (Winbox) Chain" comment=\
    "Add initial attempt to Black List (Winbox) Stage 1." connection-state=\
    new in-interface-list=WAN log=yes log-prefix="Add_Black List (Winbox) S1"
add action=return chain="Black List (Winbox) Chain" comment=\
    "Return From Black List (Winbox) chain."
add action=drop chain=input comment="Drop anyone in Black List (SSH)." \
    in-interface-list=WAN log=yes log-prefix="BL_Black List (SSH)" \
    src-address-list="Black List (SSH)"
add action=jump chain=input comment="Jump to Black List (SSH) chain." \
    dst-port=45735 in-interface-list=WAN jump-target="Black List (SSH) Chain" \
    protocol=tcp
add action=add-src-to-address-list address-list="Black List (SSH)" \
    address-list-timeout=4w2d chain="Black List (SSH) Chain" comment="Transfer\
    _repeated attempts from Black List (SSH) Stage 3 to Black List (SSH)." \
    connection-state=new in-interface-list=WAN log=yes log-prefix=\
    "Add_Black List (SSH)" src-address-list="Black List (SSH) Stage 3"
add action=add-src-to-address-list address-list="Black List (SSH) Stage 3" \
    address-list-timeout=1m chain="Black List (SSH) Chain" comment=\
    "Add successive attempts to Black List (SSH) Stage 3." connection-state=\
    new in-interface-list=WAN log=yes log-prefix="Add_Black List (SSH) S3" \
    src-address-list="Black List (SSH) Stage 2"
add action=add-src-to-address-list address-list="Black List (SSH) Stage 2" \
    address-list-timeout=1m chain="Black List (SSH) Chain" comment=\
    "Add successive attempts to Black List (SSH) Stage 2." connection-state=\
    new in-interface-list=WAN log=yes log-prefix="Add_Black List (SSH) S2" \
    src-address-list="Black List (SSH) Stage 1"
add action=add-src-to-address-list address-list="Black List (SSH) Stage 1" \
    address-list-timeout=1m chain="Black List (SSH) Chain" comment=\
    "Add initial attempt to Black List (SSH) Stage 1." connection-state=new \
    in-interface-list=WAN log=yes log-prefix="Add_Black List (SSH) S1"
add action=return chain="Black List (SSH) Chain" comment=\
    "Return From Black List (SSH) chain."
add action=accept chain=input comment="Accept established connections" \
    connection-state=established
add action=accept chain=input comment="Accept related connections" \
    connection-state=related
add action=accept chain=input comment="Accept SSH for secure shell" dst-port=\
    45735 log=yes log-prefix=SSH_LOGIN protocol=tcp
add action=accept chain=input comment="Accept SSH for secure shell" dst-port=\
    13234 log=yes log-prefix=SSH_LOGIN protocol=tcp
add action=accept chain=input comment="Accept SSH for secure shell" dst-port=\
    13233 in-interface=WAN1 protocol=udp
add action=accept chain=input comment="Accept SSH for secure shell" dst-port=\
    51820 in-interface=WAN1 protocol=udp
add action=accept chain=input comment="Allow limited pings" limit=\
    50/5s,2:packet protocol=icmp
add action=drop chain=input comment="Drop excess pings" protocol=icmp
add action=accept chain=input comment="Accept VPN" protocol=ipsec-esp
add action=accept chain=input comment="Accept Winbox access" dst-port=8291 \
    protocol=tcp src-address-list=local
add action=accept chain=input comment="Accept VPN" dst-port=500,4500,1701 \
    protocol=udp
add action=accept chain=input comment="Accept Winbox MAC" dst-port=20561 \
    in-interface-list=!WAN protocol=udp src-address-list=local
add action=accept chain=input comment="Accept NDP" dst-port=5678 \
    in-interface-list=!WAN protocol=udp src-address-list=local
add action=accept chain=input comment="Accept DNS Querry" dst-port=53 \
    in-interface-list=!WAN protocol=udp src-address-list=local
add action=accept chain=input comment="Accept NTP Querry" dst-port=123 \
    in-interface-list=!WAN protocol=udp src-address-list=local
add action=accept chain=input comment="Accept DHCP Querry" dst-port=67 \
    in-interface-list=!WAN protocol=udp src-address-list=local src-port=68
add action=accept chain=input comment="Accept SNMP" dst-port=161 \
    in-interface-list=!WAN protocol=udp src-address-list=local
add action=accept chain=input comment="Accept Winbox http" dst-port=1455 \
    in-interface-list=!WAN protocol=tcp src-address-list=local
add action=accept chain=input comment="CAPsMAN accept all local traffic" \
    src-address-type=local
add action=drop chain=input comment="Drop everything else" log-prefix=\
    "IN DROP REST -> "
add action=accept chain=forward comment="PF Mailserver" dst-port=443 \
    protocol=tcp
add action=accept chain=forward comment="PF Mailserver" dst-port=80 protocol=\
    tcp
add action=accept chain=forward comment="Accept established connections" \
    connection-state=established
add action=accept chain=forward comment="Accept related connections" \
    connection-state=related
add action=accept chain=forward comment="Accept VPN" in-interface=\
    wireguard-client
add action=accept chain=forward comment="Accept VPN" out-interface=\
    wireguard-client
add action=accept chain=forward comment="Accept VPN" in-interface=\
    wireguard-client out-interface=BRIDGE
add action=accept chain=forward comment="Accept VPN" in-interface=BRIDGE \
    out-interface=wireguard-client
# l2tp-DM not ready
add action=accept chain=forward comment="Accept VPN" in-interface=*C
# l2tp-DM not ready
add action=accept chain=forward comment="Accept VPN" out-interface=*C
add action=accept chain=forward comment="Allow Forward to WAN1" \
    out-interface=WAN1
add action=drop chain=forward comment="Drop invalid connections" \
    connection-state=invalid
add action=log chain=forward comment="Log everything else" log-prefix=\
    "DROP FORWARD"
add action=drop chain=forward comment="Drop everything else"
/ip firewall nat
add action=dst-nat chain=dstnat disabled=yes dst-port=443 in-interface=WAN1 \
    log=yes protocol=tcp to-addresses=192.168.0.10 to-ports=443
add action=dst-nat chain=dstnat disabled=yes dst-port=80 in-interface=WAN1 \
    log=yes protocol=tcp to-addresses=192.168.0.10 to-ports=80
add action=masquerade chain=srcnat out-interface=WAN1
/ip firewall service-port
set sip disabled=yes
/ip ipsec identity
# Peer does not exist
add peer=*2 remote-id=ignore
/ip route
add disabled=yes distance=1 dst-address=192.168.254.0/24 gateway=*C pref-src=\
    10.16.248.4 routing-table=main scope=10 suppress-hw-offload=no \
    target-scope=10
add disabled=yes distance=1 dst-address=192.168.249.0/24 gateway=*C pref-src=\
    10.16.248.4 routing-table=main scope=10 suppress-hw-offload=no \
    target-scope=10
add disabled=yes distance=1 dst-address=192.168.155.0/24 gateway=*C pref-src=\
    10.16.248.4 routing-table=main scope=10 suppress-hw-offload=no \
    target-scope=10
add disabled=yes distance=1 dst-address=10.10.150.0/24 gateway=\
    wireguard-client pref-src="" routing-table=main scope=30 \
    suppress-hw-offload=no target-scope=10
add disabled=yes distance=1 dst-address=195.4.209.213/32 gateway=\
    wireguard-client pref-src="" routing-table=main scope=30 \
    suppress-hw-offload=no target-scope=10
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=45735
set api disabled=yes
/ip ssh
set strong-crypto=yes
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/system clock
set time-zone-name=Europe/Vienna
/system identity
set name=WBH10ROU03
/system leds settings
set all-leds-off=after-1min
/system logging
add action=auth disabled=yes topics=account
add prefix=WIREGUARD topics=wireguard
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.pool.ntp.org
add address=1.pool.ntp.org
add address=2.pool.ntp.org
add address=3.pool.ntp.org
/system routerboard settings
set auto-upgrade=yes silent-boot=yes

anav · Tue Dec 12, 2023 10:33 pm

(1) Peer settings are incorrect and missing the endpoint port
/interface wireguard peers
add allowed-address=10.10.150.0/24 client-address=10.10.140.63/32 \
client-endpoint=195.4.209.213 interface=wireguard-client \
persistent-keepalive=25s private-key=\
"kOoHLfgEJ1gRqQlxVONRF3eQ1eFRflXOkHpLkFuNx0M=" public-key=\
"1cp2GkWEw2bZtsizc0p1/m19AWTrVTMGW6oLQIPTxSg="

Should be:
/interface wireguard peers
add allowed-address=10.10.140.0/24 10.10.150.0/24
client-endpoint=195.4.209.213 endpoint port=??????? interface=wireguard-client \
persistent-keepalive=25s private-key=\
"kOoHLfgEJ1gRqQlxVONRF3eQ1eFRflXOkHpLkFuNx0M=" public-key=\
"1cp2GkWEw2bZtsizc0p1/m19AWTrVTMGW6oLQIPTxSg="

NOTE: Since I dont know the listening port on the server for handshake (OPsense) I didnt know what to put for ???????

(2) WHY IS THIS RULE DISABLED its a GOOD rule???
add disabled=yes distance=1 dst-address=10.10.150.0/24 gateway=\
wireguard-client pref-src="" routing-table=main scope=30 \
suppress-hw-offload=no target-scope=10

Clearly there is either a need for local users to visit this subnet at the OPsense, or this subnet exists on the OPsense and needs to visit your local subnets.
Either way, a route is needed on the MT to tell the router where to send packets to for this subnet as it is not local.

dima1002 · Tue Dec 12, 2023 11:20 pm

Is this a bug?
down in the client config is the port there?

Wireguard_11.JPG

I forgot to reactivate the route 10.10.150.0/24. I only deactivated it to test it. Sorry.

I got the allow address, both networks are now included. But it still doesn't work.
But the strange thing is, with the client config in the picture, I can access the network with my cell phone. Then it must be another error, right?

dima1002 · Tue Dec 12, 2023 11:24 pm

this is my new configuration and the same error. I have the port in the Client Config GUI, but not here.

# 2023-12-12 22:21:37 by RouterOS 7.12.1
# software id = MVD7-Y3UP
#
# model = RB962UiGS-5HacT2HnT
/interface bridge
add fast-forward=no name=BRIDGE
/interface ethernet
set [ find default-name=ether1 ] name=WAN1
/interface wireguard
add listen-port=13233 mtu=1420 name=wireguard-client
/interface list
add name=WAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk mode=dynamic-keys name=WlanFirma \
    supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] disabled=no mode=ap-bridge security-profile=\
    WlanFirma ssid=WLAN_FIRMA
set [ find default-name=wlan2 ] disabled=no mode=ap-bridge security-profile=\
    WlanFirma ssid=WLAN_FIRMA
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=COMPANY ranges=10.248.1.50-10.248.1.150
/ip dhcp-server
add address-pool=COMPANY interface=BRIDGE lease-time=10m name=COMPANY
/user group
add name=dude
/interface bridge port
add bridge=BRIDGE ingress-filtering=no interface=ether2
add bridge=BRIDGE ingress-filtering=no interface=ether3
add bridge=BRIDGE ingress-filtering=no interface=ether4
add bridge=BRIDGE ingress-filtering=no interface=ether5
add bridge=BRIDGE interface=wlan1
add bridge=BRIDGE interface=wlan2
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add interface=WAN1 list=WAN
/interface ovpn-server server
set auth=sha1,md5
/interface wireguard peers
add allowed-address=10.10.150.0/24,10.10.140.0/24 client-address=\
    10.10.140.63/32 client-endpoint=195.4.209.213 interface=wireguard-client \
    persistent-keepalive=25s private-key=\
    "XXXXXXXXX" public-key=\
    "XXXXXXXX"
/ip address
add address=10.248.1.254/24 interface=BRIDGE network=10.248.1.0
add address=10.10.140.63/24 interface=wireguard-client network=10.10.140.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=10m
/ip dhcp-client
add interface=WAN1
/ip dhcp-server network
add address=10.248.1.0/24 dns-server=10.248.1.254 gateway=10.248.1.254
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip firewall address-list
add address=10.248.1.0/24 list=local
add address=192.168.181.0/24 list=local
add address=192.168.152.0/24 list=local
add address=8.8.8.8 list=DNS
add comment="Black List (SSH)" list="Black List (SSH)"
add comment="Black List (Winbox)" list="Black List (Winbox)"
add comment="Black List (Port Scanner WAN)" list=\
    "Black List (Port Scanner WAN)"
add comment="Black List (Port Scanner LAN)" list=\
    "Black List (Port Scanner LAN)"
add address=192.168.254.0/24 list=local
add address=10.16.0.0/16 list=local
add address=10.1.0.0/24 list=local
add address=192.168.155.0/24 list=local
add address=192.168.249.0/24 list=local
add address=10.10.140.0/24 list=local
add address=10.10.150.0/24 list=local
add address=10.10.141.0/24 list=local
/ip firewall filter
add action=drop chain=input comment="Drop invalid connections" \
    connection-state=invalid
add action=drop chain=input comment="Drop Netbios" connection-state="" \
    dst-port=137,138 protocol=udp
add action=jump chain=forward connection-state=new jump-target=detect-ddos
add action=return chain=detect-ddos dst-limit=32,32,src-and-dst-addresses/10s
add action=return chain=detect-ddos src-address-list=DNS
add action=add-dst-to-address-list address-list=ddosed address-list-timeout=\
    10m chain=detect-ddos
add action=add-src-to-address-list address-list=ddoser address-list-timeout=\
    10m chain=detect-ddos
add action=drop chain=forward comment="Drop DDOS" connection-state=new \
    dst-address-list=ddosed src-address-list=ddoser
add action=drop chain=input comment=\
    "Drop anyone in the Port Scanner (WAN) list." in-interface-list=WAN log=\
    yes log-prefix="BL_Black List (Port Scanner WAN)" src-address-list=\
    "Black List (Port Scanner WAN)"
add action=drop chain=forward comment=\
    "Drop anyone in the Port Scanner (WAN) list." in-interface-list=WAN log=\
    yes log-prefix="BL_Black List (Port Scanner WAN)" src-address-list=\
    "Black List (Port Scanner WAN)"
add action=add-src-to-address-list address-list=\
    "Black List (Port Scanner WAN)" address-list-timeout=4w2d chain=input \
    comment="Add TCP port scanner to Port Scanner (WAN) list." \
    in-interface-list=WAN log=yes log-prefix=\
    "Add_Black List (Port Scanner WAN)" protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment=\
    "Drop anyone in the Port Scanner (LAN) list." in-interface-list=WAN log=\
    yes log-prefix="BL_Black List (Port Scanner LAN)" src-address-list=\
    "Black List (Port Scanner LAN)"
add action=drop chain=forward comment=\
    "Drop anyone in the Port Scanner (LAN) list." in-interface-list=WAN log=\
    yes log-prefix="BL_Black List (Port Scanner LAN)" src-address-list=\
    "Black List (Port Scanner LAN)"
add action=add-src-to-address-list address-list=\
    "Black List (Port Scanner LAN)" address-list-timeout=4w2d chain=forward \
    comment="Add TCP port scanner to Port Scanner (LAN) list." \
    in-interface-list=WAN log=yes log-prefix=\
    "Add_Black List (Port Scanner LAN)" protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment="Drop anyone in Black List (Winbox)." \
    in-interface-list=WAN log=yes log-prefix="BL_Black List (Winbox)" \
    src-address-list="Black List (Winbox)"
add action=jump chain=input comment="Jump to Black List (Winbox) chain." \
    dst-port=8291 in-interface-list=WAN jump-target=\
    "Black List (Winbox) Chain" protocol=tcp
add action=add-src-to-address-list address-list="Black List (Winbox)" \
    address-list-timeout=4w2d chain="Black List (Winbox) Chain" comment="Trans\
    fer repeated attempts from Black List (Winbox) Stage 6 to Black List (Winb\
    ox)." connection-state=new in-interface-list=WAN log=yes log-prefix=\
    "Add_Black List (Winbox)" src-address-list="Black List (Winbox) Stage 6"
add action=add-src-to-address-list address-list="Black List (Winbox) Stage 6" \
    address-list-timeout=1m chain="Black List (Winbox) Chain" comment=\
    "Add succesive attempts to Black List (Winbox) Stage 6." \
    connection-state=new in-interface-list=WAN log=yes log-prefix=\
    "Add_Black List (Winbox) S6" src-address-list=\
    "Black List (Winbox) Stage 5"
add action=add-src-to-address-list address-list="Black List (Winbox) Stage 5" \
    address-list-timeout=1m chain="Black List (Winbox) Chain" comment=\
    "Add succesive attempts to Black List (Winbox) Stage 5." \
    connection-state=new in-interface-list=WAN log=yes log-prefix=\
    "Add_Black List (Winbox) S5" src-address-list=\
    "Black List (Winbox) Stage 4"
add action=add-src-to-address-list address-list="Black List (Winbox) Stage 4" \
    address-list-timeout=1m chain="Black List (Winbox) Chain" comment=\
    "Add succesive attempts to Black List (Winbox) Stage 4." \
    connection-state=new in-interface-list=WAN log=yes log-prefix=\
    "Add_Black List (Winbox) S4" src-address-list=\
    "Black List (Winbox) Stage 3"
add action=add-src-to-address-list address-list="Black List (Winbox) Stage 3" \
    address-list-timeout=1m chain="Black List (Winbox) Chain" comment=\
    "Add succesive attempts to Black List (Winbox) Stage 3." \
    connection-state=new in-interface-list=WAN log=yes log-prefix=\
    "Add_Black List (Winbox) S3" src-address-list=\
    "Black List (Winbox) Stage 2"
add action=add-src-to-address-list address-list="Black List (Winbox) Stage 2" \
    address-list-timeout=1m chain="Black List (Winbox) Chain" comment=\
    "Add succesive attempts to Black List (Winbox) Stage 2." \
    connection-state=new in-interface-list=WAN log=yes log-prefix=\
    "Add_Black List (Winbox) S2" src-address-list=\
    "Black List (Winbox) Stage 1"
add action=add-src-to-address-list address-list="Black List (Winbox) Stage 1" \
    address-list-timeout=1m chain="Black List (Winbox) Chain" comment=\
    "Add initial attempt to Black List (Winbox) Stage 1." connection-state=\
    new in-interface-list=WAN log=yes log-prefix="Add_Black List (Winbox) S1"
add action=return chain="Black List (Winbox) Chain" comment=\
    "Return From Black List (Winbox) chain."
add action=drop chain=input comment="Drop anyone in Black List (SSH)." \
    in-interface-list=WAN log=yes log-prefix="BL_Black List (SSH)" \
    src-address-list="Black List (SSH)"
add action=jump chain=input comment="Jump to Black List (SSH) chain." \
    dst-port=45735 in-interface-list=WAN jump-target="Black List (SSH) Chain" \
    protocol=tcp
add action=add-src-to-address-list address-list="Black List (SSH)" \
    address-list-timeout=4w2d chain="Black List (SSH) Chain" comment="Transfer\
    _repeated attempts from Black List (SSH) Stage 3 to Black List (SSH)." \
    connection-state=new in-interface-list=WAN log=yes log-prefix=\
    "Add_Black List (SSH)" src-address-list="Black List (SSH) Stage 3"
add action=add-src-to-address-list address-list="Black List (SSH) Stage 3" \
    address-list-timeout=1m chain="Black List (SSH) Chain" comment=\
    "Add successive attempts to Black List (SSH) Stage 3." connection-state=\
    new in-interface-list=WAN log=yes log-prefix="Add_Black List (SSH) S3" \
    src-address-list="Black List (SSH) Stage 2"
add action=add-src-to-address-list address-list="Black List (SSH) Stage 2" \
    address-list-timeout=1m chain="Black List (SSH) Chain" comment=\
    "Add successive attempts to Black List (SSH) Stage 2." connection-state=\
    new in-interface-list=WAN log=yes log-prefix="Add_Black List (SSH) S2" \
    src-address-list="Black List (SSH) Stage 1"
add action=add-src-to-address-list address-list="Black List (SSH) Stage 1" \
    address-list-timeout=1m chain="Black List (SSH) Chain" comment=\
    "Add initial attempt to Black List (SSH) Stage 1." connection-state=new \
    in-interface-list=WAN log=yes log-prefix="Add_Black List (SSH) S1"
add action=return chain="Black List (SSH) Chain" comment=\
    "Return From Black List (SSH) chain."
add action=accept chain=input comment="Accept established connections" \
    connection-state=established
add action=accept chain=input comment="Accept related connections" \
    connection-state=related
add action=accept chain=input comment="Accept SSH for secure shell" dst-port=\
    45735 log=yes log-prefix=SSH_LOGIN protocol=tcp
add action=accept chain=input comment="Accept SSH for secure shell" dst-port=\
    13234 log=yes log-prefix=SSH_LOGIN protocol=tcp
add action=accept chain=input comment="Accept SSH for secure shell" dst-port=\
    13233 in-interface=WAN1 protocol=udp
add action=accept chain=input comment="Accept SSH for secure shell" dst-port=\
    51820 in-interface=WAN1 protocol=udp
add action=accept chain=input comment="Allow limited pings" limit=\
    50/5s,2:packet protocol=icmp
add action=drop chain=input comment="Drop excess pings" protocol=icmp
add action=accept chain=input comment="Accept VPN" protocol=ipsec-esp
add action=accept chain=input comment="Accept Winbox access" dst-port=8291 \
    protocol=tcp src-address-list=local
add action=accept chain=input comment="Accept VPN" dst-port=500,4500,1701 \
    protocol=udp
add action=accept chain=input comment="Accept Winbox MAC" dst-port=20561 \
    in-interface-list=!WAN protocol=udp src-address-list=local
add action=accept chain=input comment="Accept NDP" dst-port=5678 \
    in-interface-list=!WAN protocol=udp src-address-list=local
add action=accept chain=input comment="Accept DNS Querry" dst-port=53 \
    in-interface-list=!WAN protocol=udp src-address-list=local
add action=accept chain=input comment="Accept NTP Querry" dst-port=123 \
    in-interface-list=!WAN protocol=udp src-address-list=local
add action=accept chain=input comment="Accept DHCP Querry" dst-port=67 \
    in-interface-list=!WAN protocol=udp src-address-list=local src-port=68
add action=accept chain=input comment="Accept SNMP" dst-port=161 \
    in-interface-list=!WAN protocol=udp src-address-list=local
add action=accept chain=input comment="Accept Winbox http" dst-port=1455 \
    in-interface-list=!WAN protocol=tcp src-address-list=local
add action=accept chain=input comment="CAPsMAN accept all local traffic" \
    src-address-type=local
add action=drop chain=input comment="Drop everything else" log-prefix=\
    "IN DROP REST -> "
add action=accept chain=forward comment="PF Mailserver" dst-port=443 \
    protocol=tcp
add action=accept chain=forward comment="PF Mailserver" dst-port=80 protocol=\
    tcp
add action=accept chain=forward comment="Accept established connections" \
    connection-state=established
add action=accept chain=forward comment="Accept related connections" \
    connection-state=related
add action=accept chain=forward comment="Accept VPN" in-interface=\
    wireguard-client
add action=accept chain=forward comment="Accept VPN" out-interface=\
    wireguard-client
add action=accept chain=forward comment="Accept VPN" in-interface=\
    wireguard-client out-interface=BRIDGE
add action=accept chain=forward comment="Accept VPN" in-interface=BRIDGE \
    out-interface=wireguard-client
# l2tp-DM not ready
add action=accept chain=forward comment="Accept VPN" in-interface=*C
# l2tp-DM not ready
add action=accept chain=forward comment="Accept VPN" out-interface=*C
add action=accept chain=forward comment="Allow Forward to WAN1" \
    out-interface=WAN1
add action=drop chain=forward comment="Drop invalid connections" \
    connection-state=invalid
add action=log chain=forward comment="Log everything else" log-prefix=\
    "DROP FORWARD"
add action=drop chain=forward comment="Drop everything else"
/ip firewall nat
add action=dst-nat chain=dstnat disabled=yes dst-port=443 in-interface=WAN1 \
    log=yes protocol=tcp to-addresses=192.168.0.10 to-ports=443
add action=dst-nat chain=dstnat disabled=yes dst-port=80 in-interface=WAN1 \
    log=yes protocol=tcp to-addresses=192.168.0.10 to-ports=80
add action=masquerade chain=srcnat out-interface=WAN1
/ip firewall service-port
set sip disabled=yes
/ip ipsec identity
# Peer does not exist
add peer=*2 remote-id=ignore
/ip route
add disabled=yes distance=1 dst-address=192.168.254.0/24 gateway=*C pref-src=\
    10.16.248.4 routing-table=main scope=10 suppress-hw-offload=no \
    target-scope=10
add disabled=yes distance=1 dst-address=192.168.249.0/24 gateway=*C pref-src=\
    10.16.248.4 routing-table=main scope=10 suppress-hw-offload=no \
    target-scope=10
add disabled=yes distance=1 dst-address=192.168.155.0/24 gateway=*C pref-src=\
    10.16.248.4 routing-table=main scope=10 suppress-hw-offload=no \
    target-scope=10
add disabled=no distance=1 dst-address=10.10.150.0/24 gateway=\
    wireguard-client pref-src="" routing-table=main scope=30 \
    suppress-hw-offload=no target-scope=10
add disabled=yes distance=1 dst-address=195.4.209.213/32 gateway=\
    wireguard-client pref-src="" routing-table=main scope=30 \
    suppress-hw-offload=no target-scope=10
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=45735
set api disabled=yes
/ip ssh
set strong-crypto=yes
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/system clock
set time-zone-name=Europe/Vienna
/system identity
set name=Test
/system leds settings
set all-leds-off=after-1min
/system logging
add action=auth disabled=yes topics=account
add prefix=WIREGUARD topics=wireguard
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.pool.ntp.org
add address=1.pool.ntp.org
add address=2.pool.ntp.org
add address=3.pool.ntp.org
/system routerboard settings
set auto-upgrade=yes silent-boot=yes

anav · Tue Dec 12, 2023 11:45 pm

Remove this from the MT peer config DELETE, REMOVE, AMPUTATE
client-address=\
10.10.140.63/32 client-endpoint=195.4.209.213

dima1002 · Tue Dec 12, 2023 11:56 pm

without endpoint?

# model = RB962UiGS-5HacT2HnT
/interface wireguard
add listen-port=13233 mtu=1420 name=wireguard-client
/interface wireguard peers
add allowed-address=10.10.150.0/24,10.10.140.0/24 client-address=10.10.140.63/32 endpoint-port=13233 interface=wireguard-client persistent-keepalive=25s private-key="XXXXXXX=" public-key="XXXXX"

Unfortunately it doesn't work that way either

# serial number = HEN08W0N0WQ
/interface wireguard
add listen-port=13233 mtu=1420 name=wireguard-client
/interface wireguard peers
add allowed-address=10.10.150.0/24,10.10.140.0/24 client-address=10.10.140.63/32 endpoint-address=192.1.2.1 endpoint-port=13233 interface=wireguard-client persistent-keepalive=25s private-key="XXXXXXXXX" public-key="XXXXXXX"

Log:
WIREGUARD: wireguard-client: XXXXXXX: Handshake for peer did not complete after 5 seconds, retrying (try 2)

anav · Wed Dec 13, 2023 12:05 am

NO without client address , remove client address.
Good you added endpoint port

dima1002 · Wed Dec 13, 2023 12:16 am

Unfortunately it still doesn't work:

/interface wireguard
add listen-port=13233 mtu=1420 name=wireguard-client
/interface wireguard peers
add allowed-address=10.10.150.0/24,10.10.140.0/24 endpoint-address=195.4.209.211 endpoint-port=13233 interface=wireguard-client persistent-keepalive=25s private-key="XXXXXX" public-key=" XXXXXXX"

Log:
WIREGUARD: wireguard-client: XXXXXX: Handshake for peer did not complete after 5 seconds, retrying (try 2)

The GUI shows full garbage, is that normal? where does the IP address come from?

Wireguard_22.JPG

anav · Wed Dec 13, 2023 1:33 am

Yup it should be blank as shown in the gui...

dima1002 · Wed Dec 13, 2023 6:47 pm

The settings are correct now, right? Because I'm slowly having no idea what else I can do.
I downgraded to 7.11.2 and upgraded to 7.13 today. tried. Unfortunately nothing has changed. Another idea what it could be?
If I use this configuration, I will be online with my mobile phone.

anav · Wed Dec 13, 2023 8:03 pm

So your phone connects with no issues to the OPsense wireguard server. WHere is this server located (cloud)?
The MT router is unable to successfully link to OPsense wireguard server is the problem.

1. MT router has wireguard IP address --> add address=10.10.140.63/24 interface=wireguard-client network=10.10.140.0
and at the OPsense server, the allowed IPs for MT peer include ( 10.10.140.63/32 )
2. MT router has wireguard interface defined
3. MT router has forward chain rule to allow local traffic to enter wireguard tunnel
4. MT router has forward chain rule to allow remote traffic to exit wireguard tunnel and access bridge devices

Why you have two rules for this is unknown.......... The second rule is better as it is clearer and has both a source and destination communicated!!
add action=accept chain=forward comment="Accept VPN" in-interface=\
wireguard-client
add action=accept chain=forward comment="Accept VPN" in-interface=\
wireguard-client out-interface=BRIDGE
5. Assuming you have traffic visiting the MT router 10.10.150 or at least 10.10.150 is a destination for local traffic as both applicable rules exist in terms of ip route and allowed Ips, and of course the generic firewall rules.

I See nothing that is preventing connectivity..................... The only thing would be OPsense setup??

anav · Wed Dec 13, 2023 8:05 pm

Looking at that last diagram was that from your PHONE?? The GUI picture????
Reason is there is an address that doesnt fit on it what is........ 192.168.77.2/24
Which device is that?

To be clear ITS NOT EVEN THE WIREGUARD ADDRESS schema ??????????

dima1002 · Wed Dec 13, 2023 10:19 pm

Yes, Opnsense is in the cloud
The 2 firewall rule was just another test. Unfortunately, a lot is often changed during testing and troubleshooting.
I don't know the device 77.2.
The network doesn't exist on the network either.
That's why I suspected a bug.

Here are my screenshots

signal-2023-12-13-194013_002.jpeg

2023-12-13 19_35_27-[WG1] _ Interfaces _ WBH02OPN01.wbh.cloud – Mozilla Firefox.jpg

2023-12-13 19_35_06-WireGuard _ VPN _ WBH02OPN01.wbh.cloud – Mozilla Firefox.jpg

2023-12-13 19_34_54-WireGuard _ VPN _ WBH02OPN01.wbh.cloud – Mozilla Firefox.jpg

2023-12-13 19_34_43-WireGuard _ VPN _ WBH02OPN01.wbh.cloud – Mozilla Firefox.jpg

2023-12-13 19_34_20-Aliases _ Firewall _ WBH02OPN01.wbh.cloud – Mozilla Firefox.jpg

2023-12-13 19_31_17-WAN _ Rules _ Firewall _ WBH02OPN01.wbh.cloud – Mozilla Firefox.jpg

anav · Wed Dec 13, 2023 11:10 pm

Okay, one should label their pictures so one knows what one is looking at...but

a. the first one is an iphone or phone connection to the OPsense WG server.
WHY does your phone connection have the same IP as the MT router?

If this is your phone, then you have a conflict right there, each will have different public IP address so only one of them will be recognized by the OPsense.

+++++++++++++++++++++++++
As noted the only thing I see that may be occurring is a conflict between phone settings and Mikrotik settings.
They both cannot have the same IP address on the wireguard network and ensure that you have their correct public IPs,
on the OPsense settings for its peers...............

dima1002 · Thu Dec 14, 2023 12:01 am

Yes, ok, you're right, labeling would have been even better

I have a Mikrorik router with WiFi, my cell phone behind it and the Mikrotik 962 as a Wireguard client on another port.

The cell phone was just a test, it is not active on the internet. I just took a photo of the QR code from the Mikrotik to test whether it works.

That's why I think the cell phone and the Mikrotik 962 are on the same network, behind a Mikrotik router. The cell phone works, the Mikrotik doesn't and I just can't find anything wrong.

anav · Thu Dec 14, 2023 12:32 am

Sorry, but the only way you should test you phone via wireguard is via cellular and not through your MT router.
Based on what I see, the problem is your phone and the mikrotik router are interfering with each other.

They cannot have the same wireguard IP and should have proper keys set in both.

dima1002 · Thu Dec 14, 2023 10:23 am

My phone was just a test. It is also clear to me that my cell phone and the Mikrotik Wireguard Client are not allowed to run in parallel.

But my mobile phone connects to the Wireguard router in the Wifi, just like without Wifi.

anav · Thu Dec 14, 2023 3:59 pm

Not there to see what you are doing, just pointing out that
connecting to the router and then going out a ROUTER point to point tunnel to the WG servers is NOT the same as iphone going out cellular direct to Wireguard Server on a separate tunnel.

The only way your iphone would go to wireguard if on wifi, is if the router is setup to push the subnet your wifi is on into the tunnel, OR you forgot to turn off your wg connection via cellular and its how you are actually connecting.

dima1002 · Thu Dec 14, 2023 4:12 pm

OK, never mind about the mobile phone.

What information are you still missing so that you can possibly help me? or what else could I test?

anav · Thu Dec 14, 2023 5:02 pm

None, the config looks correct. Double check the public IP from OPSense, on the peer setting in the router is correct and the public IP from the MT, on the peer setting in OPsense is correct.

sebus46 · Fri Mar 29, 2024 12:40 pm

Looking at that last diagram was that from your PHONE?? The GUI picture????
Reason is there is an address that doesnt fit on it what is........ 192.168.77.2/24
Which device is that?

To be clear ITS NOT EVEN THE WIREGUARD ADDRESS schema ??????????

That address somehow is auto generated by RouterOS itself

add client-endpoint=endpoint.dns.name endpoint-port=15847 allowed-address=192.168.34.3 interface=int-wireguard private-key="MC4CAQAwBQYDK2VuBCIEIKgK/XB5nVWICe7sgyj2psIBBJPjBtnrDJHbDnf6yrhn" public-key="MCowBQYDK2VuAyEAx99o0n3hPfnEJAmYtaIyVufc2veV9CaHSKE8ubFOKQc="

The resulting config is:

[Interface]
ListenPort = 51820
PrivateKey = MC4CAQAwBQYDK2VuBCIEIKgK/XB5nVWICe7sgyj2psIBBJPjBtnrDJHbDnf6yrhn
Address = 192.168.177.2/24

[Peer]
PublicKey = MTl3/lv1yI9r4t/FsJufTrFQy1iyqs1etDxMqzRaODU=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = endpoint.dns.name:16321

Wireguard Client - Handshake for peer did not complete

Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Re: Wireguard Client - Handshake for peer did not complete

Who is online