Wireguard Setup Assistance

kyled27 · Fri Oct 21, 2022 11:27 pm

Good day Mikrotik Community,

Hope you are all doing well,

I had this setup in the past and trying to do it again on a new mikrotik router but I seem to not be winning.

I have wireguard setup on a mikrotik router and using the windows client on a laptop to connect, It looks like it completes the handshake and I can see in the wireguard app and on the mikrotik that traffic is being sent and received.

However I cannot seem to ping or access anything through the tunnel.

My wireguard interface is 10.1.0.1/24
The Peer Allowed Address is 10.1.0.2/32

When I connect my windows client I cannot ping 10.1.0.1

[admin@MikroTik] > export
# oct/21/2022 22:13:23 by RouterOS 7.3.1
# software id = KCSW-U7CS
#
# model = RouterBOARD 3011UiAS
# serial number = 780E06967849
/interface bridge
add admin-mac=6C:3B:6B:EC:B2:C0 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=ether2 ] comment="HP 48-Port PoE Switch"
set [ find default-name=ether4 ] comment="Milestone Server"
set [ find default-name=ether6 ] comment="T8516 16-Port PoE Switch"
set [ find default-name=ether7 ] comment="T8516 16-Port PoE Switch"
set [ find default-name=ether8 ] comment="Viewing Station"
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool1 ranges=10.0.0.20-10.0.0.254
/ip dhcp-server
add address-pool=dhcp_pool1 interface=bridge name=dhcp1
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4
add bridge=bridge comment=defconf ingress-filtering=no interface=ether5
add bridge=bridge comment=defconf ingress-filtering=no interface=ether6
add bridge=bridge comment=defconf ingress-filtering=no interface=ether7
add bridge=bridge comment=defconf ingress-filtering=no interface=ether8
add bridge=bridge comment=defconf ingress-filtering=no interface=ether9
add bridge=bridge comment=defconf ingress-filtering=no interface=ether10
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp1
/interface bridge settings
set use-ip-firewall=yes
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set max-neighbor-entries=8192
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface ovpn-server server
set auth=sha1,md5
/interface wireguard peers
add allowed-address=10.1.0.2/32 interface=wireguard1 public-key=\
    "MmfYnKBKpBTvUHAe2qqRW+4vpisFzanw6YESeCu38wU="
/ip address
add address=10.0.0.1/24 comment=defconf interface=bridge network=10.0.0.0
add address=161.120.227.206/29 interface=ether1 network=161.120.227.200
add address=10.1.0.1/24 interface=wireguard1 network=10.1.0.0
/ip dhcp-server network
add address=10.0.0.0/24 dns-server=10.0.0.1 gateway=10.0.0.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static
add address=10.0.0.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input dst-port=13231 protocol=udp
add action=accept chain=input protocol=udp src-address=10.1.0.0/24
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" \
    connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=\
    out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment="ACS Mobile" dst-address=\
    161.120.227.206 dst-port=55756 in-interface=ether1 protocol=tcp \
    to-addresses=10.0.0.2 to-ports=55756
add action=dst-nat chain=dstnat comment="ACS PC" dst-address=161.120.227.206 \
    dst-port=55752 in-interface=ether1 protocol=tcp to-addresses=10.0.0.2 \
    to-ports=55752
add action=dst-nat chain=dstnat comment=Node-Red dst-address=161.120.227.206 \
    dst-port=3005 in-interface=ether1 protocol=tcp to-addresses=10.0.0.102 \
    to-ports=1880
add action=dst-nat chain=dstnat comment="P8815-2 3D People Counter" \
    dst-address=161.120.227.206 dst-port=4100 in-interface=ether1 protocol=tcp \
    to-addresses=10.0.0.223 to-ports=80
add action=dst-nat chain=dstnat comment="P3375-LV for MatLab" dst-address=\
    161.120.227.206 dst-port=4200 in-interface=ether1 protocol=tcp \
    to-addresses=10.0.0.215 to-ports=554
add action=dst-nat chain=dstnat dst-address=161.120.227.206 dst-port=3006 \
    in-interface=ether1 protocol=tcp to-addresses=10.0.0.102 to-ports=80
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=161.120.227.201
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" \
    src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" \
    dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/system clock
set time-zone-name=Africa/Johannesburg
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
[admin@MikroTik] >

smyers119 · Sat Oct 22, 2022 1:02 am

AllowedIPs= 0.0.0.0/24

This means the only allowed ips are 0.0.0.0-0.0.0.255

I doubt that's what you actually meant to restrict it to, as that will not match anything

Sat Oct 22, 2022 10:39 am

Why not provide the solution ?

Kyled27
Change that to 0.0.0.0/0
All traffic will be allowed to go over tunnel then.

kyled27 · Mon Oct 24, 2022 11:18 am

Thank you!

I have changed it but it doesn't seem to work, I have installed wireguard on another laptop and setup seems to be working from that one,
I will try reinstalling wireguard on the laptop im having issues with and see if that solves the issue without making any mistakes in the config

Another question now im hoping I dont need to start a new thread is how do I get my wireguard IP range to communicate to the other IP range that has the devices I need to communicate with

Wireguard IP and Gateway: 10.1.0.2 GW: 10.1.0.1

LAN IP I need to communicate with: 10.0.0.1/24

Mon Oct 24, 2022 11:37 am

If on the laptop client you specify 0.0.0.0/0, all will be accepted.
If you narrow it down to certain subnets, make sure the ones you want are included in allowed addresses.

anav · Tue Oct 25, 2022 12:17 am

To be clear.
Typically if one wants the client (laptop) to connect to the router one puts, in ALLOWED ADDRESSES (peer settings)
a. the IP address of the wireguard network,
b. the IP address of any subnets on the router or elsewhere that will be the destination addresses of local users.

So for example if the wg iP networks is 192.168.45.1/24

One could put
allowed addresses=192.168.45.0/24,192.168.10.0/24,192.168.20.0/24

Where the two subnets that need to be reached on the server outer are 192.168.10.0/24 and 192.168.20.0/24
However if your local users are also expecting to go out the internet on the server router one needs to ONLY put
allowed addresses=0.0.0.0/0

+++++++++++++++++

Its safe for the DNS entry to put the interface IP, in my example it would be 192.168.45.1

As the all addresses are covered by the above including the specific ones if internet is not required.

The key here is to use firwall rules on the server to allow specific access to subnets and internet as appropriate.
(could have a subset of client only allowed to go to certain devices on the subnets for example).

+++++++++++++++++++++++++++

Since one laptop works and the other doesnt, it sounds like a problem with the key swap was not done correctly or a firewall setting on the laptop...........

Wireguard Setup Assistance

Wireguard Setup Assistance

Re: Wireguard Setup Assistance

Re: Wireguard Setup Assistance

Re: Wireguard Setup Assistance

Re: Wireguard Setup Assistance

Re: Wireguard Setup Assistance

Who is online