Community discussions

MikroTik App
 
sudoman
just joined
Topic Author
Posts: 6
Joined: Wed Jan 18, 2023 6:03 pm

Mikrotik Wireguard Client behind another router

Wed Jan 18, 2023 7:09 pm

Hello,

I am quite new to the forum and to the community, please excuse me if I make any mistakes, will make sure to correct the ASAP.
What is the problem:
- Unable to route all internet traffic through Wireguard VPN server.
Diagram of the setup:
Image
Short Explanation:
- Site A is the wireguard server, the goal is to tunnel all internet traffic from Site C through it. I didn't specified the external Ip address intentionally, only internal Ip network, pfsense internal address i 192.168.1.1
- Site B is my regular network it is 192.168.1.0, the router is TpLink located and 192.168.1.254.
Inside Site B I have the MikroTik router, connected to this TPLink and having it's external WAN assigned by the DHCP. Mikrotik WAN IP is 192.168.1.110/
MikroTik internal Lan network is 192.168.88.0, Mikrotik internal Lan address/gateway is 192.168.88.1
Wireguard client is set up and I see that the handshake and connection are successful Ip address for wireguard is 172.16.16.3

This is my Export config
# model = RB941-2nD
/interface bridge
add admin-mac=18:FD:74:1E:4F:E3 auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    disabled=no distance=indoors frequency=auto installation=indoor mode=\
    ap-bridge ssid=MikroTik-1E4FE7 wireless-protocol=802.11
/interface wireguard
add listen-port=13231 mtu=1420 name=wg-vpn
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp interface=bridge name=defconf
/routing table
add disabled=no fib name=wg
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4
add bridge=bridge comment=defconf ingress-filtering=no interface=pwr-line1
add bridge=bridge comment=defconf ingress-filtering=no interface=wlan1
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface ovpn-server server
set auth=sha1,md5
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=ExternalIp endpoint-port=\
    51820 interface=wg-vpn persistent-keepalive=5m public-key=\
    "H0g1gh54KX+uk77ATqjnw87FQ3BeAxFifUEvlHjdNDU="
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=172.16.16.3 interface=wg-vpn network=172.16.16.1
/ip dhcp-client
add comment=defconf default-route-distance=100 interface=ether1 use-peer-dns=\
    no use-peer-ntp=no
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=output dst-address=ExternalIp dst-port=51820 \
    protocol=udp
add action=accept chain=forward dst-address=172.16.16.0/24 src-address=\
    192.168.88.0/24
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=mark-routing chain=prerouting new-routing-mark=wg passthrough=yes \
    src-address=192.168.88.0/24
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat out-interface=wg-vpn
/ip route
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
    wg-vpn pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
    target-scope=10
add disabled=no distance=1 dst-address=ExternalIp/32 gateway=\
    192.168.1.254 pref-src="" routing-table=main scope=30 \
    suppress-hw-offload=no target-scope=10
/system clock
set time-zone-name=Europe/Vienna
/system identity
set name=RouterOS
I am unsure how to make so that the MikroTik can route the internet traffic on all devices that are connected to it's Lan (192.168.88.0) through the Wireguard VPN, and struggling a lot.
Thank you.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19125
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Mikrotik Wireguard Client behind another router

Wed Jan 18, 2023 11:45 pm

I wont touch this until you explain why the local subnet of site A and site B and wanip of site C have the same subnet. That is very confusing and makes life difficult at least for me to consider when making a config
 
sudoman
just joined
Topic Author
Posts: 6
Joined: Wed Jan 18, 2023 6:03 pm

Re: Mikrotik Wireguard Client behind another router

Thu Jan 19, 2023 12:15 pm

Yes I'm sorry about missing this piece of the information.
The reason why those 2 networks have the same subnet is due to the fact that the link between Site A and Site B is internet.
So basically those are 2 separate locations with 2 different ISPs, the connection between them is over the internet.
WAN IP of site C is in the same subnet as Site B because it is a mikrotik router inside the network of Site B. So Site C has a separate subnet for all devices connected to it.
What I want to achieve is to be able to connect to this MikroTik and VPN my traffic to Site A, while I would like to also be able to connect to Site B and to use internet without VPN and tunneling the traffic.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19125
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Mikrotik Wireguard Client behind another router

Thu Jan 19, 2023 12:48 pm

Can you change either of the subnets so they are not duplicated............... (either at site A, or site B)
 
sudoman
just joined
Topic Author
Posts: 6
Joined: Wed Jan 18, 2023 6:03 pm

Re: Mikrotik Wireguard Client behind another router

Thu Jan 19, 2023 1:05 pm

Yes I can do this for site B.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19125
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Mikrotik Wireguard Client behind another router

Thu Jan 19, 2023 2:23 pm

(1) Okay assuming site B has 192.168.10/0/24 subnet and the IP of the MT (WAN) on the TPLINK LAN is 192.168.10.110/
(2) Ip dhcp client stuff removed not needed, just set the IP address to the wanip........
(3) Rule removed the MT is not a server so no need for input chain rule.......... (format wrong anyway)
add action=accept chain=output dst-address=ExternalIp dst-port=51820 \
protocol=udp

(4) Rule incorrect and removed and out of proper order anyway and not needed in your rule setup.
add action=accept chain=forward dst-address=172.16.16.0/24 src-address=\
192.168.88.0/24

(5) mangling removed not required.
(6) where are your input chain rules ??? although in this case, since its an internal router perhaps none is needed... ?????
(7) ip routes are wrong..............
(8) Missing routing rule.
(9) Ip address fixed for wireguard
(10) changed keep alive to something reasonable 35s

# model = RB941-2nD
/interface bridge
add admin-mac=18:FD:74:1E:4F:E3 auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
disabled=no distance=indoors frequency=auto installation=indoor mode=\
ap-bridge ssid=MikroTik-1E4FE7 wireless-protocol=802.11
/interface wireguard
add listen-port=13231 mtu=1420 name=wg-vpn
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp interface=bridge name=defconf
/routing table
add disabled=no fib name=wg
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4
add bridge=bridge comment=defconf ingress-filtering=no interface=pwr-line1
add bridge=bridge comment=defconf ingress-filtering=no interface=wlan1
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface ovpn-server server
set auth=sha1,md5

/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=ExternalIp endpoint-port=\

51820 interface=wg-vpn persistent-keepalive=35 public-key=\
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0

add address=172.16.16.3/24 interface=wg-vpn network=172.16.16.0
add address=192.168.10.110/24 interface=ether1 network=192.168.10.0
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan

/ip firewall filter
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat out-interface=wg-vpn

/ip route
add dst-address=0.0.0.0/0 gwy=192.168.10.1 table=main { the "WAN" gateway IP of the MT }
add dst-address=0.0.0.0/0 gwy=wg-vpn table=wg
/routing rule add src-address=192.168.88.0/24 action=lookup table=wg ******
/system clock
set time-zone-name=Europe/Vienna
/system identity
set name=RouterOS


******* If you never want site C users to use the internet through the TP link, even if the wireguard tunnel is not working for some reason, then
change to action=lookup-only-in-table

++++++++++++++++++++++++++++++++++++++++

With this setup all users at site C will be forced out the tunnel. Since you sourcenat the traffic out wg, then the traffic will hit the pfsense with source address of 172.16.16.3
Last edited by anav on Fri Jan 20, 2023 3:41 pm, edited 3 times in total.
 
sudoman
just joined
Topic Author
Posts: 6
Joined: Wed Jan 18, 2023 6:03 pm

Re: Mikrotik Wireguard Client behind another router

Thu Jan 19, 2023 2:39 pm

Thanks a lot , I will test and report back!
 
sudoman
just joined
Topic Author
Posts: 6
Joined: Wed Jan 18, 2023 6:03 pm

Re: Mikrotik Wireguard Client behind another router

Fri Jan 20, 2023 10:47 am

Hi,

could you explain about this entry:
/ip route
add dst-address=0.0.0.0/0 gwy=192.168.110.1 table=main

I mean there is no such network 192.168.110.1 I guess you wanted to write 192.168.10.110 or the Wan Ip of Mikrotik?
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19125
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Mikrotik Wireguard Client behind another router  [SOLVED]

Fri Jan 20, 2023 3:37 pm

Thanks for pointing out that error, you are correct

At the top of the post I replaced the Subnet on Router'/Site B the TPlink because you said you could do so.
Thus I changed the LAN subnet provided by the TPLINK from 192.168.1.0/24 to 192.168.10.0/24

I simply modified the lan IP given to the mikrotik router from 192.168.1.110 to 192.168.10.110

Therefore on the MIkrotik, the "wan" gateway IP is 192.168.10.1

Thus the ip routes should be......
/ip route
add dst-address=0.0.0.0/0 gwy=192.168.10.1 table=main
add dst-address=0.0.0.0/0 gwy=wg-vpn table=wg
/routing rule add src-address=192.168.88.0/24 action=lookup table=wg ******

I will edit the error.
 
sudoman
just joined
Topic Author
Posts: 6
Joined: Wed Jan 18, 2023 6:03 pm

Re: Mikrotik Wireguard Client behind another router

Fri Jan 20, 2023 4:01 pm

I would like to thank you once more, your configuration works like a charm!
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19125
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Mikrotik Wireguard Client behind another router

Fri Jan 20, 2023 7:12 pm

Excellent if there is anything you dont understand please ask, as the knowledge is important moving forward.

Who is online

Users browsing this forum: Bing [Bot], GoogleOther [Bot] and 20 guests