Simple,default configuration for PC/MAC through Wireguard to LAN

daemons · Sat Oct 21, 2023 9:28 pm

Hi All,

Havent yet created the schematics, however for a basic settings following description should be enough.

Mikrotik router set to 192.168.11.1 ( C53UiG+5HPaxD2HPaxD )
pool set 192.168.11.2-192.168.11.99

I would like to use my pc/mac to reach the home LAN network remotely.

What are the most default settings for mikrotik and wireguard client.

A. Current cfg enclosed,

# 2023-10-21 06:10:37 by RouterOS 7.11.2
# software id = YXRR-3U0P
#
# model = C53UiG+5HPaxD2HPaxD
# serial number = xy
/interface bridge
add admin-mac=xy auto-mac=no comment=defconf name=bridge
/interface wifiwave2
set [ find default-name=wifi2 ] channel.band=2ghz-ax .width=20mhz \
    configuration.mode=ap .ssid=xy2.4G datapath.bridge=bridge \
    disabled=no name=xy2.4G security.authentication-types=\
    wpa2-psk,wpa3-psk
set [ find default-name=wifi1 ] channel.band=5ghz-ax .skip-dfs-channels=\
    10min-cac .width=20/40/80mhz configuration.mode=ap .ssid=\
    xy5g disabled=no name=xy \
    security.authentication-types=wpa2-psk,wpa3-psk
add configuration.mode=ap .ssid=IOT mac-address=4A:A9:8A:09:8A:26 \
    master-interface=xy2.4G name=w_IOT
/interface wireguard
add comment=vpn_wg1 listen-port=13231 mtu=1420 name=wg1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/iot lora servers
add address=eu.mikrotik.thethings.industries down-port=1700 name=TTN-EU \
    up-port=1700
add address=us.mikrotik.thethings.industries down-port=1700 name=TTN-US \
    up-port=1700
add address=eu1.cloud.thethings.industries down-port=1700 name=\
    "TTS Cloud (eu1)" up-port=1700
add address=nam1.cloud.thethings.industries down-port=1700 name=\
    "TTS Cloud (nam1)" up-port=1700
add address=au1.cloud.thethings.industries down-port=1700 name=\
    "TTS Cloud (au1)" up-port=1700
add address=eu1.cloud.thethings.network down-port=1700 name="TTN V3 (eu1)" \
    up-port=1700
add address=nam1.cloud.thethings.network down-port=1700 name="TTN V3 (nam1)" \
    up-port=1700
add address=au1.cloud.thethings.network down-port=1700 name="TTN V3 (au1)" \
    up-port=1700
/ip pool
add name=dhcp ranges=192.168.11.10-192.168.11.99
/ip dhcp-server
add add-arp=yes address-pool=dhcp interface=bridge lease-time=10m name=\
    defconf
/interface bridge filter
# no interface
add action=drop chain=forward in-interface=*9
# no interface
add action=drop chain=forward out-interface=*9
# no interface
add action=drop chain=forward in-interface=*A
# no interface
add action=drop chain=forward out-interface=*A
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=xy5g
add bridge=bridge comment=defconf interface=xy2.4G
add bridge=bridge interface=*9
add bridge=bridge interface=*A
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=wg1 list=LAN
/interface wireguard peers
add comment=xy interface=wg1 public-key=\
    "xy="
/ip address
add address=192.168.11.1/24 comment=defconf interface=bridge network=\
    192.168.11.0
add address=192.168.22.1/24 interface=wg1 network=192.168.22.0
/ip arp
add address=192.168.11.100 interface=bridge mac-address=xy
add address=192.168.11.2 interface=bridge mac-address=xyxy
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=192.168.11.2 client-id=1:xyxy mac-address=\
    xyxy server=defconf
add address=192.168.11.100 mac-address=xy
/ip dhcp-server network
add address=192.168.11.0/24 comment=defconf dns-server=192.168.11.1 gateway=\
    192.168.11.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.11.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat disabled=yes out-interface=wg1 \
    src-address=192.168.11.0/24
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set sip disabled=yes
set pptp disabled=yes
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=bridge type=internal
add interface=ether1 type=external
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/Budapest
/system note
set show-at-login=no
/system routerboard settings
set auto-upgrade=yes
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

B. Client settings enclosed.

[quote][Interface]
PrivateKey = xy
Address = 192.168.11.101/24

[Peer]
PublicKey = xy
AllowedIPs = 0.0.0.0/0
Endpoint = xy:13231
[/quote]

Help is very appreaciated as I have spent 2-3 days tryng several settings without success.

erlinden · Sat Oct 21, 2023 11:50 pm

If you follow the example, you will probably do just fine:
https://help.mikrotik.com/docs/display/ ... uardtunnel

daemons · Sun Oct 22, 2023 8:03 am

tried, did - no success.
Obviously im doing "something" wrong, cannot find yet.
dyndns - seems ok
port forward - questioned..
ip selections - questioned

Sun Oct 22, 2023 8:12 am

You’re missing several key settings. You haven’t got the public key in the local peer config, you’re leaving DNS unset, and you haven’t got allowed IP assignments on the router side. There may be more I’m missing besides; I quit looking when I hit three.

EDIT: nope, four things missing: there’s no “accept” rule in the firewall for the WG port!

Try my tutorial, but without the double-NAT bit that you don’t need.

daemons · Mon Oct 23, 2023 8:55 am

well, thank for hints, but as stated before, I have tried several howtos....
here lost again.

Partially seems ok, my routeros sitting as main router in my home: 192.168.11.1, with some.dyndns address.
Intention is to get connected from anywhere ( hotel, remote, mobile etc) and send all traffic through wireguard, and get acces to my home lan.
I do not mind getting random ports.

tried:

/interface wireguard
action=accept - how?

/interface wireguard peers
add allowed-address=192.168.77.2/32 interface=wg1 public-key="xy="

/ip address
add address=192.168.77.1/24 interface=wg1

/ip firewall nat
add action=src-nat chain=srcnat src-address=192.168.77.0/24 to-addresses=192.168.11.1

[Interface]
PrivateKey = xy/xy=
Address = 192.168.77.2/32

[Peer]
PublicKey = xy=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = some.dyndns.pro:12345

Mon Oct 23, 2023 10:11 am

action=accept - how?

Aside from reading the relevant docs, you could've gotten that from mducharme's tutorial, linked from the top of mine:

/ip firewall filter add action=accept chain=input comment="Allow Wireguard" dst-port=12345 protocol=udp

Without this, your gateway router will drop all inbound WG packets from the Internet.

(My tutorial doesn't include this because the port-forward from the gateway router takes care of that part of the problem, and my internal WG endpoint switch doesn't have a firewall.)

/interface wireguard peers
add allowed-address=192.168.77.2/32 interface=wg1 public-key="xy="

Better.

[Peer]
PublicKey = xy=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = some.dyndns.pro:12345

You don't show a PresharedKey setting. It's supposed to be optional, but if you applied it on the RouterOS side, you need it here, too.

daemons · Mon Oct 23, 2023 11:01 am

I do appreciate the hints..
however the request been to get a simplified solution/example to setup a simple tunel settings for wireguard , LAN - remote access.

With all the hints, and days of tries i did not succeded, hence requested a simple example.
so far still something is wrong, if i could get a clue what, i whould have fixed that.
Bit of frustration as I though a simple tunel settings would be simpe...

help is appreciated, though.

routeros:
# 2023-10-23 09:53:04 by RouterOS 7.12rc2
# software id = YXRR-3U0P
#
# model = C53UiG+5HPaxD2HPaxD
# serial number = xy
/interface bridge
add admin-mac=xy auto-mac=no comment=defconf name=bridge
/interface wifiwave2
set [ find default-name=wifi2 ] channel.band=2ghz-ax .width=20mhz \
    configuration.mode=ap .ssid=xy2.4G datapath.bridge=bridge \
    disabled=no name=xy2.4G security.authentication-types=\
    wpa2-psk,wpa3-psk
set [ find default-name=wifi1 ] channel.band=5ghz-ax .skip-dfs-channels=\
    10min-cac .width=20/40/80mhz configuration.mode=ap .ssid=\
    xy disabled=no name=xy \
    security.authentication-types=wpa2-psk,wpa3-psk
add configuration.mode=ap .ssid=dmsIOT mac-address=4A:A9:8A:09:8A:26 \
    master-interface=xy2.4G name=w_dmsIOT
/interface wireguard
add listen-port=12345 mtu=1420 name=wg1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/iot lora servers
add address=eu.mikrotik.thethings.industries name=TTN-EU protocol=UDP
add address=us.mikrotik.thethings.industries name=TTN-US protocol=UDP
add address=eu1.cloud.thethings.industries name="TTS Cloud (eu1)" protocol=\
    UDP
add address=nam1.cloud.thethings.industries name="TTS Cloud (nam1)" protocol=\
    UDP
add address=au1.cloud.thethings.industries name="TTS Cloud (au1)" protocol=\
    UDP
add address=eu1.cloud.thethings.network name="TTN V3 (eu1)" protocol=UDP
add address=nam1.cloud.thethings.network name="TTN V3 (nam1)" protocol=UDP
add address=au1.cloud.thethings.network name="TTN V3 (au1)" protocol=UDP
/ip pool
add name=dhcp ranges=192.168.11.10-192.168.11.99
/ip dhcp-server
add add-arp=yes address-pool=dhcp interface=bridge lease-time=10m name=\
    defconf
/interface bridge filter
# no interface
add action=drop chain=forward in-interface=*9
# no interface
add action=drop chain=forward out-interface=*9
# no interface
add action=drop chain=forward in-interface=*A
# no interface
add action=drop chain=forward out-interface=*A
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=xy5g
add bridge=bridge comment=defconf interface=xy2.4G
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface wireguard peers
add allowed-address=192.168.77.2/32 client-listen-port=12345 interface=wg1 \
    private-key="xy=" public-key=\
    "xy="
/ip address
add address=192.168.11.1/24 comment=defconf interface=bridge network=\
    192.168.11.0
add address=192.168.77.1/24 interface=wg1 network=192.168.77.0
/ip arp
add address=192.168.11.100 interface=bridge mac-address=xy
add address=192.168.11.2 interface=bridge mac-address=xy
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=192.168.11.2 client-id=xy mac-address=\
    F0:79:59:D2:AD:BC server=defconf
add address=192.168.11.100 mac-address=xy
add address=192.168.11.200 client-id=xy mac-address=\
    xy server=defconf
/ip dhcp-server network
add address=192.168.11.0/24 comment=defconf dns-server=192.168.11.1 gateway=\
    192.168.11.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.11.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
add action=accept chain=input comment="Allow Wireguard" dst-port=12345 \
    protocol=udp
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=src-nat chain=srcnat src-address=192.168.77.0/24 to-addresses=\
    192.168.11.1
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set sip disabled=yes
set pptp disabled=yes
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=bridge type=internal
add interface=ether1 type=external
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/Budapest
/system note
set show-at-login=no
/system package update
set channel=testing
/system routerboard settings
set auto-upgrade=yes
/system scheduler
add comment=dyndns_update interval=6h name=dyndns_update on-event="xy" policy=reboot start-time=startup
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Client:

[Interface]
PrivateKey = xy
Address = 192.168.77.2/32

[Peer]
PublicKey = xy
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = xy.dyndns:12345

Mon Oct 23, 2023 11:10 am

hence requested a simple example.

You don't want "simple," you want me to write your configuration for you, and I simply am not going to do that. I expect you to interpose your brain between my "hints" and your local configuration, applying those hints intelligently. I don't think it's too much to ask that you do some of the thinking here. Am I wrong?

A quick scan of your posted configuration shows an obvious problem: you've put the new firewall "allow" rule after the "defconf: drop all not coming from LAN" rule, causing it to not apply. I didn't think I needed to tell you that the order of firewall rules matters, and that you must to put the new rule above any relevant "drop" rules if you want it to have any useful effect.

anav · Mon Oct 23, 2023 12:12 pm

viewtopic.php?t=182340

daemons · Mon Oct 23, 2023 10:24 pm

well, literally yes, I would appreciate if someone could "write" the simple configuration - then I would be able to implement for my needs.
Morally this may disturb someone, but thats been the main querie " simple settings for remote access LAN".

Obvioulsy, If i would be able/could have figure out how to setup, I wouldnt rise the "simple setting" question.

So appreciate the help, but didnt have properly working solution, yet.

Simple,default configuration for PC/MAC through Wireguard to LAN

Simple,default configuration for PC/MAC through Wireguard to LAN

Re: Simple,default configuration for PC/MAC through Wireguard to LAN

Re: Simple,default configuration for PC/MAC through Wireguard to LAN

Re: Simple,default configuration for PC/MAC through Wireguard to LAN

Re: Simple,default configuration for PC/MAC through Wireguard to LAN

Re: Simple,default configuration for PC/MAC through Wireguard to LAN

Re: Simple,default configuration for PC/MAC through Wireguard to LAN

Re: Simple,default configuration for PC/MAC through Wireguard to LAN

Re: Simple,default configuration for PC/MAC through Wireguard to LAN

Re: Simple,default configuration for PC/MAC through Wireguard to LAN

Who is online