My bad, I didnt realize that BTH was NOT possible to connect two routers that do not have publicly reachable IPs etc.. Its only valid for a router without a public IP and a remote device like phone.

Supposedly fixed in 7.15beta6.
There is also a workaround if you modify the logging rules to numb down those messages but in my book these shouldn't even be displayed (it's debug, not info)

It's a while ago now. Can you guys confirm it will be fixed in the mentioned version, any news?

What specifically ?

I'd like just to have a confirmation about scheduled fixing because it's a while ago. Nothing special ;)

Fixing what specifically? Abundance of Wireguard logs? That was already fixed

FYI to the users, the WireGuard problem of trying to re-connect to a previously connected dynamic peer is not a MikroTik problem, it's part of the OG WireGuard codebase. Same issue on a plain Debian install as well.

@normis, does BTH allow me to specify which IPv6 /64 pool to use for the peers?

Fixing what specifically? Abundance of Wireguard logs? That was already fixed

still occuring BTH iOS and 7.14.3; checked 3d ago

@DarkNate: thx for explanation!

@Normis.

Okay so what I have learned recently.
1. BTH is not applicable to router to router connections.

2. It would appear that BTH configs certain things automatically please confirm.
a. sourcenat rule
b. wireguard ip address
c. input chain handshake rule
d. allowed ips.
e. wg blocked to LAN but allowed to WAN
f. anything else??

My concern is WHY are these settings:
1 NOT showing up on the export (as per normal wireguard settings ) *****
or
2 NOT showing up on the export on a specific config block maybe /ip BTH VPN etc......

Very frustrating to try and help customers when I dont have an understanding or proper expectations.

**** Allowed Ips does show up on regular export but the rest seem not to??

Okay understand I may be looking at a BTH setup incorrectly done on an Ops MT router and thus the missing export info?

How would you block acess to LAN only based on client config file? Client could then just change few lines in existing config file an gain acess to your lan.

Okay understand I may be looking at a BTH setup incorrectly done on an Ops MT router and thus the missing export info?

It's not in the `/wireguard/export` because it's "dynamic config" (i.e.configuration generated by another RouterOS option). And dynamic config is never in an export – think /ip/dhcp-client and /ip/address/export. So like elsewhere, "/wireguard/print detail" is what's needed to "see" BTH stuff. And /ip/firewall/.../print etc. too. Basically you'll see more "D" items from BTH in a few places.

@anav, you think "Back-to-Home" is more complex than it is. BTH is still just plain WireGuard, following all same rules, with fews tricks (that do not change WG protocol):

1. BTH adds "dynamic config" (e.g. items marked with a "D") to /wireguard and elsewhere.** And as such, are not in an export. Only "print", or winbox.

2. Biggest trick is the DDNS name <sn>.vpn.mynetname.net used. What that name resolves to is set by BTH internally & used in the WG config generated (instead of IPs). This allow floating between direct/proxy mode, since DDNS can change over time. So if proxied <sn>.vpn.mynetname.net resolves Mikrotik's IP & if direct, it's your own WAN IP.

3. The BTH apps just issue RouterOS commands, using your winbox/etc login, to enable BTH & get device keys/config from those commands. But this just avoid cut-and-paste - you can use WG client instead, all the proxy stuff work same (see #2, trick is WG config shown for BTH uses a DDNS name).

4. AFAIK, you can still add your own peer statically using winbox/etc using the BTH "dynamic" /wireguard interface. So while router-to-router is "not supported", BTH really does not care what OS the other peer is using, so that should work too (*only ONE needs to enable BTH, other is a peer of that, not both running BTH). Basically, BTH does not change that everything is a peer. It just automated config on router to enable WG (with encrypted WG traffic getting transparently proxied via another server if needed), Basically BTH client are still just normal WG peers – just the WG config file uses a special DDNS name.

5. /ip/address for WG interface, to this point, is always in same fixed subnet: 192.168.216.0/24

** I do think what "dynamic config" is added automatically with BTH should be described more specifically in the docs. _i.e._ get it is a home feature — but there folks that deploy things to customers that like to know how they work at greater detail.

Agree much better documentation will take out some mystery. BUT I SAY AGAIN, BTH needs to be more explicity shown on the export.
/ip cloud full full settings etc........

routerOS v7.12.1, BTH v1.3.33: "Tools/IP Scan" interface "bridge" no information

(checked because of a post in another topic)

HI

I hae a lof os this...
Why?

ROS 15.2 - 5009 routerboard fw upgraded

that is because something is not happy.How the ping looks like?

What ping?

e.g. from the Router to peer9

Quick question. I have BTH enabled, created from iOS app from iPhone. Working perfect. I want to add a peer for my Macbook using Wireguard app for Mac.

Trying to use the iPhone BTH app share option, but after pressing share button, it ask for router login, I enter login and pass and says connection refused.

Hi,
I´m using /testing the B2H, I´m running 7.16Beta7
I create 2 users from the Back to Home Users function all is good, but when I go to WireGuard Peers there is no way to Un-check the Responder Checkbox to avoid the Log being full of the message "back-to-home-vpn: [peer2] .....=: Handshake for peer did not complete after 20 attempts, giving up
Am I doing something wrong?
Thanks

@supermario Nothing wrong, just poorly constructed APP functionality. By the way, the company story, as always, is that its very easy to use and implement. :-(

@jfim Ensure the mac does not have some sort of firewall blocking the traffic.

@anav Thanks, then I guess better to config manually WG to have better control, maybe one day Mikrotik will do some improvements in the BTH, @normis are some improvements in the backlog?

I already have several working Wireguard connections, but I also wanted to try this function.
Since then, I have a dynamic entry that can no longer be deleted. How can I remove it?
Thank you,

v 7.15.3

-faxxe

I already have several working Wireguard connections, but I also wanted to try this function.
Since then, I have a dynamic entry that can no longer be deleted. How can I remove it?
Thank you,

v 7.15.3

-faxxe

You'll find the BTH users on the IP>Cloud window, from there you could delete the users

Very helpful, thank you NatePB14
-faxxe

Good afternoon,
I would like to send all traffic across the Back to Home. is it possible?
Best regards!

can they expire?

To help understand the functionality........

1. First setup Phone BTH app, when connected to router ???
2. Then one can, using the phone and the BTH app, while at remote locations (NO Need to be connected to router) create a WG instance for another device??
3. This assumes hole punching correct.
4. The other (third device) gets a separate wireguard IP on the wireguard network?? - but how does the router know or the Mikrotik hole-punch gateway??

+++++++++++++++++++++++++++++++++++++++++++++
HOW DO I CATEGORY
How do I create QR codes from a standard setup ( hole punch not required ), that I can whatsapp to remote devices for them to ingest??
If not possible.
What is the closest one can come to the above in current or planned functionality?

How do I create QR codes from a standard setup ( hole punch not required ), that I can whatsapp to remote devices for them to ingest??

Create screenshot from Winbox or Webfig.
Even from terminal is possible with /interface/wireguard/peers show-client-config if terminal window is expanded enough or has very small font size :)
It would be nice that Client Config text is selectable in Winbox without need to execute show-client-config from Terminal so to make it easy c/p it into .conf file for sharing as config file since desktop wg client doesn't support reading config from QR image. Also creating new peer in ROS from wg config file by reading config properties that are supported on ROS would be a nice feature for standard Wireguard configuration.

Sweet photo, gee I wonder why this is not in the MT Documents???

ROS wouldn't be fun without (hidden/undocumented) gems :)

The biggest benefit of Back to Home is the mobile app. It is super simple to use. If you want to configure wireguard manually, you don't really need BTH anymore. So by using the CLI, you are missing the point

Not sure I follow missing the point regarding CLI, my reply was a bit OT because it was not related to BTH WG, it was reply to @anav question regarding manual (standard) WG setup (also OT) - "How do I create QR codes from a standard setup..."

My answer was about why documentation is more concentrated on using the App, not CLI.

Still, it was about manual WG setup and possibilities of sharing peer configuration... Is it possible to share such manual WG peer configuration from MT mobile app (not BTH)?
From WG documentation:

iOS configuration
Download the WireGuard application from the App Store. Open it up and create a new configuration from scratch.

In documentation is stated "...create a new configuration from scratch" :), even it is possible to create peer QR code as in my screenshot example, that was why @anav is wondering why such possibility is not documented.

This is OT, maybe is better to create separate topic for such discussions regarding improvements for manual WG.

I agree, BTH documentation does not yet describe Share management.
This does not mean Winbox should be used at all. I still insist, if you use BTH without the app, you are missing the point of BTH.

BTH WG setup != manual WG setup.
Trying to explain that my comments are not related to BTH WG and that are OT :)
Forcing using BTH just because exists doesn't mean that one can choose different approach to use WG as it fits to its needs even as custom WG setup as BTH VPN (I have also OpenVPN for eg. as backup BTH VPN).

Check title of topic. Yes, manual WG setup should be discussed in another topic

Now you get it :)
I was just trying to help @anav...

Regarding the TOPIC
We have updated the manual with the Share function info (APP side) https://help.mikrotik.com/docs/display/ROS/Back+To+Home

Thanks Normis for updating the docs.
My question are mostly about the APP.
Specifically, the first questions are about the "Spread the wireguard love" ability of the phone app!

(1) How does the APP on the phone create more peer client instances ( such as for a windows laptop )? When both are no longer under the Routers NetworK, aka at a remote location.
More precisely, the new device (laptop) presumably gets assigned a wireguard IP address.
How does the APP decide which IP to give out?
How does the other end ( the router ) know to accept traffic from that new IP.
OR
How does the punch hole MT cloud server know to accept traffic from that new IP.
OR
Please fill in the missing gap of knowledge I have.
++++++++++++++++++++++++++++++
Secondly, I am trying to find "extra utility" of the BTH app in terms of the QR code generating capability.
Does the phone(app) generate QR codes
OR
Does the router generate QR codes.

GOAL: In manual wg mode setup, the ability to create QR codes for remote users to ingest ( via whats app, email etc.) to easily setup their device, be it generating those qr codes on the bth app on the phone, or via some other means on the router ( ip cloud?)

Regarding "GOAL", why mix manual WG setup with BTH app? Better to have ability to export/share configuration of such peers (from manual WG setup) in MT mobile app (not BTH) or in Winbox to have ability to save QR image without need to create screenshot, to use as configuration import into official WG client mobile app.

Regarding "GOAL", why mix manual WG setup with BTH app? Better to have ability to export/share configuration of such peers (from manual WG setup) in MT mobile app (not BTH) or in Winbox to have ability to save QR image without need to create screenshot, to use as configuration import into official WG client mobile app.

What?
I am simply trying to understand the functionality available and how to use/apply it, if possible.
Any monkey would rather have functionality available in the native menus, but not asking for MT to change anything just to explain the depth of the functionality available.
Its up to Normis and Co, whether they can adapt, modify or add additional functionality to either BTH app, MT APP, or routerOs.

Yes, but thread is for BTH, not manual for WG setup, that's why I mentioned BTH app in first place. Better to have separate topic for such discussions.

Hello Dear Friends.
Is there a way to use bth with rb750gr3?
May be some handmade setup available?
Thank you in advance.

@sas2k

there is no way to run BTH on MMIPS.

That is only available on ARM/ARM64/TILE

This morning my samsung phone was updated. Since then BTH is not working properly, i can barely connect to my Ip cams, to home server, but im unable to use the browsers and others apps getting my home ip and network. Samsung did smting which broke everything (not for the first time) anybody with same problem?

how the Share invite link works?

i can see the link, but it doesn't add on that BTH application (mob to mob)

send the link to a friend.
friend needs BTH app.
friend clicks on link, and setup opens.

@normis

I thing that I figured out.

i was trying with facebook messenger.

teams , whatsapp and messages - all working

i was trying with facebook messenger.

teams , whatsapp and messenger - all working

Well, the share link returns HTML that requires JavaScript. So if FB tries to "unfurl" (e.g. click the link, to summarize content for a message stream), the BTH link is only a redirect to the App Store with no HTML body - and FB may not like a link that leaves the app or needs JavaScript to render...

Whatever app you select for use with BTH share, when receiver clicks the link... that BTH link needs to run in a real browser, so that query parameters are provided to the BTH home app (i.e. market:// or http://app.apple.com/... which means navigate to an APP) on the shared user's phone. So if shared by email or SMS, then the URL is likely to go through without modification, and email or SMS will send http:// to a browser. So yeah FB processing URL, and blocking stuff to keep you in their ecosystem isn't surprising ;).

Regarding the TOPIC
We have updated the manual with the Share function info (APP side) https://help.mikrotik.com/docs/display/ROS/Back+To+Home

Much thanks for these efforts!

does anyone play with "Disable VPN when home"?

i'm not expecting to work properly as this is experimental features, but that is so useful.

one more thing i noticed today.

when login to back-to-home by using the local lan ip-add , and user and pas from the MT.

With that user you can create and share-users, but with the shared user u can only edit, you cant share