Wireguard doesn't work and no logs

GiovanniG · Wed Feb 07, 2024 12:14 am

Hi, one week ago I configured it and was working, I deactivated it and today enabled back but doesn't work, and I have any log of connections.
Port is configured, opened, I torch the interface and the packet is coming, anything is firewalled, Wireguard is enabled, the keys are configured too, no reason for this.

When mikrotik doesn't log wireguard? If the key is not corrected it doesn't log anything? How can I debug the trouble? I really don't know how to come out from this
Thanks for help

Mesquite · Wed Feb 07, 2024 1:54 am

post the complete config.
is the router client or server for handshake, if client what is it connecting to.

gabacho4 · Wed Feb 07, 2024 2:41 am

He's had Wireguard problems for some time now. I asked him for configs a week ago and never got them. He later declared that he had solved the problem. Looks like not so much. Maybe we'll get configs this time...

GiovanniG · Wed Feb 07, 2024 11:26 am

Thanks for help mates,
yes I try to figure out myself if I can not load you, in the end I was succeed so there were no reason to post config file with sensible datas inside.
Now I post it, I really hope you see what I can't (

# 2024-02-07 12:10:20 by RouterOS 7.12.1
# software id = YH2P-AUKZ
#
# model = RBD53iG-5HacD2HnD
# serial number = <edit>
/caps-man channel
add band=2ghz-b/g/n extension-channel=Ce frequency=2427 name=channel3
add band=2ghz-b/g/n extension-channel=Ce frequency=2412 name=channel1 tx-power=\
    0
add band=5ghz-a/n/ac frequency=5320 name=channel64
/interface bridge
add admin-mac=18:FD:74:64:B7:B6 auto-mac=no comment=defconf name=bridge
add name=bridge-Denrozhdeniya
add name=bridge-public
/interface wireless
# managed by CAPsMAN
# channel: 2427/20-Ce/gn(27dBm), SSID: Vino di Vino, local forwarding
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    disabled=no distance=indoors frequency=auto installation=indoor mode=\
    ap-bridge ssid=MikroTik-64B7BA wireless-protocol=802.11
# managed by CAPsMAN
# channel: 5320/20-eeCe/ac/P(14dBm), SSID: Vino di Vino, local forwarding
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX \
    country=russia4 disabled=no distance=indoors frequency=auto installation=\
    indoor mode=ap-bridge ssid=TEST wireless-protocol=802.11
/interface wireguard
add listen-port=57981 mtu=1420 name=VPN-Wireguard
/interface vlan
add interface=ether1 name=vlan2-Public vlan-id=2
add interface=ether1 name=vlan4-Denrozhdeniya vlan-id=4
/caps-man datapath
add bridge=bridge client-to-client-forwarding=yes local-forwarding=yes name=\
    Bridge
add bridge=bridge-public name=Bridge-public
add bridge=bridge-Denrozhdeniya client-to-client-forwarding=yes \
    local-forwarding=no name=bridge-Denrozhdeniya
/caps-man configuration
add datapath=Bridge-public name="2.4Ghz Sala-Public" ssid="VinoDiVino FreeWiFi"
add datapath=Bridge-public name="5Ghz Sala-Public" ssid="VinoDiVino FreeWiFi"
/caps-man security
add authentication-types=wpa2-psk encryption=aes-ccm group-encryption=aes-ccm \
    group-key-update=1h name=Vinodivino
add name=Free
add authentication-types=wpa2-psk encryption=aes-ccm group-encryption=aes-ccm \
    group-key-update=1h name=vdv
/caps-man configuration
add channel=channel3 country=canada datapath=Bridge mode=ap name="2.4Ghz Sala" \
    security=Vinodivino ssid="Vino di Vino"
add channel=channel1 channel.tx-power=14 country=russia4 datapath=Bridge \
    installation=any mode=ap name="2.4GHz Ufficio" security=Vinodivino ssid=\
    "Vino di Vino"
add channel=channel64 country=russia4 datapath=Bridge mode=ap name="5Ghz Sala" \
    security=Vinodivino ssid="Vino di Vino"
add datapath=Bridge name="2.4Ghz Ufficio-vdv" security=vdv ssid=vdv
add datapath=bridge-Denrozhdeniya datapath.bridge=bridge-Denrozhdeniya name=\
    "2.4Ghz Sala-Denrozhdeniya" security=Free ssid="S Dnem Rozhdeniya!"
add datapath=bridge-Denrozhdeniya datapath.bridge=bridge-Denrozhdeniya name=\
    "5Ghz Sala-Denrozhdeniya" security=Free ssid="S Dnem Rozhdeniya!"
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ppp profile
add dns-server=8.8.8.8,1.1.1.1 local-address=192.168.2.1 name=OVPN2 \
    remote-address=192.168.2.2 use-compression=no use-encryption=yes use-ipv6=\
    no
add dns-server=8.8.8.8,1.1.1.1 local-address=192.168.2.1 name=OVPN3 \
    remote-address=192.168.2.3 use-compression=no use-encryption=yes use-ipv6=\
    no
add dns-server=8.8.8.8,1.1.1.1 local-address=192.168.2.1 name=OVPN4 \
    remote-address=192.168.2.4 use-compression=no use-encryption=yes use-ipv6=\
    no
add dns-server=8.8.8.8,1.1.1.1 local-address=192.168.2.1 name=OVPN5 \
    remote-address=192.168.2.5 use-compression=no use-encryption=yes use-ipv6=\
    no
add dns-server=8.8.8.8,1.1.1.1 local-address=192.168.2.1 name=OVPN \
    remote-address=192.168.2.2 use-compression=no use-encryption=yes use-ipv6=\
    no
add dns-server=8.8.8.8,1.1.1.1 local-address=192.168.2.1 name=OVPN6 \
    remote-address=192.168.2.6 use-compression=no use-encryption=yes use-ipv6=\
    no
/routing table
add disabled=no fib name=Bibione
/caps-man manager
set enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled master-configuration="2.4Ghz Sala" \
    name-format=identity radio-mac=18:FD:74:64:B7:BA slave-configurations=\
    "2.4Ghz Sala-Public"
add action=create-dynamic-enabled master-configuration="5Ghz Sala" name-format=\
    identity radio-mac=18:FD:74:64:B7:BB slave-configurations=\
    "5Ghz Sala-Public"
add action=create-dynamic-enabled master-configuration="2.4GHz Ufficio" \
    name-format=identity radio-mac=08:55:31:1A:0F:94
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
add bridge=bridge interface=ether1
add bridge=bridge-public interface=vlan2-Public
add bridge=bridge-Denrozhdeniya interface=vlan4-Denrozhdeniya
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf disabled=yes interface=ether1 list=WAN
add interface=VPN-Wireguard list=LAN
/interface ovpn-server server
set auth=sha1 certificate=certificato cipher=aes256-cbc default-profile=OVPN2 \
    enabled=yes max-mtu=1400 port=44301
/interface wireguard peers
add allowed-address=192.168.97.2/24 client-address=192.168.97.2/24 client-dns=\
    8.8.8.8 interface=VPN-Wireguard private-key=\
    "aJAtji26KI/N9nQhmEOJ25o5vr8an3FhdMNBUBzRvHg=" public-key=\
    "USIWUhywN9gORE1dTsTtABhNPRtLT068tiVnXXdc/Uc="
/interface wireless cap
# 
set bridge=bridge caps-man-addresses=127.0.0.1 enabled=yes interfaces=\
    wlan1,wlan2
/ip address
add address=192.168.1.254/24 comment=defconf interface=bridge network=\
    192.168.1.0
add address=192.168.97.1/24 interface=VPN-Wireguard network=192.168.97.0
/ip dhcp-client
add disabled=yes interface=bridge-Denrozhdeniya
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,1.1.1.1
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
add address=192.168.0.2 match-subdomain=yes name=vdv
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid disabled=yes
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input dst-address=192.168.1.254 dst-port=57981 \
    protocol=udp
add action=accept chain=forward dst-port=8291 protocol=tcp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    disabled=yes in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid disabled=yes
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" \
    connection-nat-state=!dstnat connection-state=new disabled=yes \
    in-interface-list=WAN
/ip firewall mangle
add action=mark-routing chain=prerouting dst-address=!192.168.0.0/16 \
    new-routing-mark=Bibione passthrough=yes src-address=192.168.101.100
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" disabled=yes \
    ipsec-policy=out,none src-address=192.168.97.0/24
add action=src-nat chain=srcnat comment=Wireguard disabled=yes src-address=\
    192.168.97.2 to-addresses=192.168.1.254
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=main \
    suppress-hw-offload=no
add disabled=no dst-address=192.168.101.0/24 gateway=192.168.2.3 routing-table=\
    main suppress-hw-offload=no
add disabled=no dst-address=192.168.88.0/24 gateway=192.168.2.2 routing-table=\
    main suppress-hw-offload=no
add disabled=yes distance=5 dst-address=0.0.0.0/0 gateway=192.168.2.2 pref-src=\
    "" routing-table=Bibione scope=30 suppress-hw-offload=no target-scope=10
add disabled=no dst-address=192.168.23.0/24 gateway=192.168.2.4 routing-table=\
    main suppress-hw-offload=no
/ip service
set winbox address=0.0.0.0/0
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" \
    src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" \
    dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/ppp secret
add name=OVPN2 profile=OVPN2 service=ovpn
add name=OVPN3 profile=OVPN3 service=ovpn
add name=OVPN4 profile=OVPN4 service=ovpn
add name=OVPN5 profile=OVPN5 service=ovpn
add name=OVPN profile=OVPN
add name=OVPN6 profile=OVPN6 service=ovpn
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name="WiFi Sala"
/system logging
add topics=caps
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=193.204.114.232
/system scheduler
add interval=1w name="Reboot monday" on-event="/system reboot" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=2023-02-20 start-time=06:00:00
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
[admin@WiFi Sala] >

erlinden · Wed Feb 07, 2024 12:24 pm

Zou je dit:

/ip firewall filter
add action=accept chain=input dst-address=192.168.1.254 dst-port=57981 protocol=udp

/interface list member
add comment=defconf disabled=yes interface=ether1 list=WAN

kunnen veranderen naar:

/ip firewall filter
add action=accept chain=input in-interface-list=WAN dst-port=57981 protocol=udp

/interface list member
add comment=defconf interface=ether1 list=WAN

GiovanniG · Wed Feb 07, 2024 1:59 pm

But this is an inside router, not a gateway, more.. it is the capsman, I can't define the uplink-capsman interface as WAN.
I added that roule as a desperate attempt, it is not necessary, on this internal router there are no blocking rules (all is disabled)

Wireguard was working, with almost the same settings, for sure the basic settings are the same (gateway, defaut route, etc.). THe router access internet, if for example I check for new OS versions it shows me the latest 7.13.3

My simply questions are:
when the wiredguard UDP packet coming fo the client (and it comes), should wireguard log it? Or it logs only when some connection is established? (even if not sucessfully).
How can I debug/troubleshoot the wireguard server?
Thank you

erlinden · Wed Feb 07, 2024 2:02 pm

Just add log=yes to the filter rule on the input chain.

At least, when you see the counter increasing.

GiovanniG · Wed Feb 07, 2024 2:10 pm

nput: in:bridge out:(unknown 0), connection-state:new src-mac 08:55:31:1a:0f:90, proto UDP, 95.29.43.66:57560->192.168.1.254:57981, len 176

packet is coming, I0've then created another filter allowing an logging specific and also tried with all UDP outgoing, ther eis no answer from WIreguard.

Question: Wireguard shoudl reply somehow to the first packet? Why it isn't?
On wireguard interface all counters are to 0, it's like it is not enabled, but I have a R next to it

erlinden · Wed Feb 07, 2024 2:37 pm

Then it is probably the Wireguard settings.
At least I see the allowed-address in the peer is set to /24, this should be /32.
The client-address can be left empty.

Did you follow this guide?
https://help.mikrotik.com/docs/display/ ... uardtunnel

Can you also share the client settings?

Please remove private key, as that is of no use!

GiovanniG · Wed Feb 07, 2024 3:19 pm

Wireward doesn't send *any* UDP packet as reply from the first packet, is this normal?
If this point is not overcomed how the client address matters?
I can tell yoi /24 works, worked, and I was able to access all that subnet, that is really cool

rplant · Thu Feb 08, 2024 12:28 am

I would generally look at the wireguard peer tx, rx and last handshake information.
If they aren't changing with incoming it would normally mean the public key you have is wrong.
Or the clock has the wrong time at one (or both) ends.

You have the private key for the peer, so you can make another wireguard client using it in the
office, and see if you can get it to connect, (and make sure the public key does match)

GiovanniG · Fri Feb 09, 2024 12:09 pm

I?ve checked deep and they public key on mikrotik was slighly changed, now it works bu I have no logs of wireguard, one week ago I saw there that peer connects and so on, I can't find any setting to re-enable log on wireguard, tha'ts really strange. That drove me out of path, thank you for telling me to check keys, I couldn't imagine they change so fast. So, if the wireguard interface will be turned off/or internet become unavailable for that mikrotik, is the key renovating so fast? That's a problem.. clients need to be reconfigured.
As well as clients.. if long time not connecting to wireguard they will get a new key? That's also a problem, need then to update mikrotik peers's list.
On the other side clients tell "connected" even if not connected at all, that's also an handicap.

Anyway I set the private key of peer to "none", and I updated to the latest OS7.13.4, if this can help.

rplant · Sat Feb 10, 2024 11:09 am

The keys are not supposed to change, however now I think about it,
I have seen other posts where it didn't work, so they changed one character in the key, then changed the key back
to what it was, and it started working.

Hopefully newer versions of RouterOS are better.

GiovanniG · Mon Feb 12, 2024 8:55 pm

I've discovered a bug, that for shure made my things complicates, on the second attempt or on the second day (I haven't counted how many attempts I did) it doesn't transfer anything, to make it work I need to forse the private ey of peer (on Mikrotik) as none, it creates a new one (why? none should be none) and after this works again.
No logs at all, the wireguard app says connected even if not, not necessary private keys (what for? public should not be enough?) that needed to be "updated" somehow..

thsi happened also with android client

seams they need to optimize a lot here

wiretik · Tue Feb 13, 2024 10:06 am

Anyway I set the private key of peer to "none", and I updated to the latest OS7.13.4, if this can help.

I would say that this certainly does not help since Wireguard is more or less broken in the newer versions. We have had many issues with the new versions and have downgraded all of our routers. Then it works perfectly.

The keys are not supposed to change, however now I think about it.

In the newer versions they have introduced another key setting in the peer settings. Maybe he mixed them up. You can now autogenerate 2 pub/priv-pairs for some unknown reason.

Mesquite · Tue Feb 13, 2024 3:21 pm

The initial back to home renditions, not sure about the latest ones, have certainly muddied the picture, however wirequard works well if you apply the rules as they have always been applied.
Remove any extra stuff not required etc.

GiovanniG · Sat Feb 17, 2024 7:34 pm

I've discovered what is happening,
Wireguard works fine with the first peer defined on the Peer's list, if I connect with the second one Wireguard doesn't work for it, so I need to devine the second's private key as none, as I press apply button the second starts working fine, but the first doesn't ore work. The second works till I define the first's private key to none, at this point the second id not more working, the first does.

Mesquite · Sun Feb 18, 2024 5:15 am

You only have one peer in the config above, when did you add others....
Please post your latest complete config for review.

GiovanniG · Sun Feb 18, 2024 12:50 pm

Hi, I've already posted the config and that wasnt useful,
the Peers are defined in the poper space called "Peers", means more than one, I don't understand what can be wrong there

GiovanniG · Sun Mar 03, 2024 2:05 pm

The log problem has been solved on latest 7.14,
now I still have sometimes problems with keys, all is written good but it doesn't work, I need to activate wireguard on my phone and paste again it public key on the Peers, apply, and then it works back.
Very strange

anav · Sun Mar 03, 2024 2:53 pm

Annoyingly you have two running wireguard at the same time.......... keeping it in one spot is usually better ......
Keys dont change so the alternative is a bug in the software which should be reported.

GiovanniG · Sun Mar 03, 2024 7:56 pm

I'm testing 7.14, in my opinion they made some fixes here, for now it works ok, so in this case this topic will be closed
if with "ou have two running wireguard at the same time" you mean two simultaniusly peers yes I've tried, and I suppose it should work also with others connected. On the router I have only one istance of Wireguard active

anav · Mon Mar 04, 2024 2:41 am

Haha, no I meant threads, all good. Glad its working for you.

Wireguard doesn't work and no logs

Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Re: Wireguard doesn't work and no logs

Who is online