MikroTik

Community discussions
https://forum.mikrotik.com/

Wireguard no handshake on iOS

https://forum.mikrotik.com/viewtopic.php?t=209262

Page 1 of 1

Wireguard no handshake on iOS

Posted: Sat Jul 13, 2024 8:35 pm
by Mordraug
I created a simple wireguard configuration for 2 peers (Android phone and iPad) the Android phone works without an issue but the iPad doesn't even handshake. I used qr code to transfer configuration to both and they have same configuration other than ip and keys, I even added ipads configuration to my phone and it worked fine. Below is my config, it's mostly stock, I'm not sure if it can be an issue on the router side, sounds more like an ios problem but maybe I missed something.
Code: Select all
/interface bridge
add admin-mac=D4:01:C3:72:DA:8B auto-mac=no comment=defconf name=bridge \
    port-cost-mode=short
/interface wifi
set [ find default-name=wifi2 ] channel.skip-dfs-channels=10min-cac \
    configuration.mode=ap .ssid="The Promised LAN" disabled=no name=2ghz \
    security.authentication-types=wpa2-psk,wpa3-psk
set [ find default-name=wifi1 ] channel.skip-dfs-channels=10min-cac \
    configuration.mode=ap .ssid="The Promised LAN" disabled=no name=5ghz \
    security.authentication-types=wpa2-psk,wpa3-psk
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=lan-pool ranges=192.168.1.100-192.168.1.200
/ip dhcp-server
add address-pool=lan-pool interface=bridge lease-time=1d name=lan-dhcp
/queue simple
add disabled=yes max-limit=40M/750M name=queue1 target=192.168.1.0/24
/queue type
add cake-diffserv=diffserv4 cake-flowmode=dual-srchost cake-nat=yes kind=cake \
    name=cake-upload
add cake-flowmode=dual-dsthost cake-nat=yes kind=cake name=cake-download
/queue tree
add bucket-size=0.01 max-limit=650M name=download packet-mark=no-mark parent=\
    bridge queue=cake-download
add bucket-size=0.01 max-limit=38M name=upload packet-mark=no-mark parent=\
    ether1 queue=cake-upload
/interface bridge port
add bridge=bridge comment=defconf interface=ether2 internal-path-cost=10 \
    path-cost=10
add bridge=bridge comment=defconf interface=ether3 internal-path-cost=10 \
    path-cost=10
add bridge=bridge comment=defconf interface=ether4 internal-path-cost=10 \
    path-cost=10
add bridge=bridge comment=defconf interface=ether5 internal-path-cost=10 \
    path-cost=10
add bridge=bridge comment=defconf interface=5ghz internal-path-cost=10 \
    path-cost=10
add bridge=bridge comment=defconf interface=2ghz internal-path-cost=10 \
    path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface wireguard peers
add allowed-address=192.168.100.4/32 client-address=192.168.100.4/32 \
    client-endpoint=mord.dev interface=wireguard name=KrzysPixel private-key=\
    "<redacted>" public-key=\
    "6xJIhMljwYHM3VCe8qyvMd/HRFXROd7K8oTaZqe2xHc="
add allowed-address=192.168.100.3/32 client-address=192.168.100.3/32 \
    client-endpoint=mord.dev interface=wireguard name=iPad private-key=\
    "<redacted>" public-key=\
    "lixpcroM8JmU+LUo2MBqQLG5/QFdAfoPG5yZHWPU0Q4="
/ip address
add address=192.168.1.1/24 interface=bridge network=192.168.1.0
add address=192.168.100.1/24 interface=wireguard network=192.168.100.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=10m
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=192.168.1.10 client-id=1:4:92:26:d9:4d:c0 mac-address=\
    04:92:26:D9:4D:C0 server=lan-dhcp
add address=192.168.1.2 client-id=\
    ff:dd:a9:fc:7:0:1:0:1:2d:6e:68:a:d8:3a:dd:a9:fc:7 mac-address=\
    D8:3A:DD:A9:FC:07 server=lan-dhcp
add address=192.168.1.3 client-id=1:e4:5f:1:1c:8c:9e mac-address=\
    E4:5F:01:1C:8C:9E server=lan-dhcp
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=192.168.1.1 comment=defconf name=router.lan
/ip firewall address-list
add address=hgb09magzq5.sn.mynetname.net list="External ip"
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat dst-address=192.168.1.2 out-interface=\
    bridge protocol=tcp src-address=192.168.1.0/24
add action=dst-nat chain=dstnat comment=HTTP,HTTPS dst-address-list=\
    "External ip" dst-port=80,443 protocol=tcp to-addresses=192.168.1.2
/ip service
set www disabled=yes
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=bridge type=internal
add interface=ether1 type=external
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/Warsaw
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Here's the client configuration that I exported:
Code: Select all
[Interface]
PrivateKey = <redacted>
ListenPort = 51820
Address = 192.168.100.3/32
DNS = 8.8.8.8

[Peer]
PublicKey = D6u6AcSXwtppse/lc/JUzEp7aKATJvSacjHUAy3xLlA=
AllowedIPs = 192.168.1.0/24 <I tried with the default 0.0.0.0 too, no dice>
Endpoint = <public ip, I had my domain here and thought it might be the cause but apparently not>:13231

Re: Wireguard no handshake on iOS

Posted: Sat Jul 13, 2024 9:20 pm
by teleport
where is your input firewall rule that accepts udp requests on wireguard port 13231?
also include wireguard interface in LAN interface list for seamless firewall navigation

Re: Wireguard no handshake on iOS

Posted: Sat Jul 13, 2024 10:37 pm
by Mordraug
I assume the
Code: Select all
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
rule must be accepting it, since Android phone connects just fine from the internet.
Also I ran the sniffer to see what's going on and with phone there is a traffic on 13231 udp as expected, however for some reason iPad seems to only talk to google dns (8.8.8.8 ) and sends nothing on the 13231

Re: Wireguard no handshake on iOS

Posted: Sun Jul 14, 2024 7:01 am
by MTNick
Greetings. You're missing the wireguard interface from the interface member list. Missing the biggest part, the firewall rule in the input chain. Wireguard peers might need to be adjusted. Start with the first 2. Lastly, if you can't connect, adjust peers. Hope this helps

Code: Select all
/interface list member
add interface=wireguard list=LAN

## Place after the input chain rule: "defconf: accept to local loopback (for CAPsMAN)"
/ip firewall filter
add action=accept chain=input comment="allow wireguard handshake" dst-port=13231 protocol=udp

## Might need to adjust your peers.
/interface wireguard peers
add allowed-address=192.168.100.4/32 interface=wireguard name=KrzysPixel public-key="6xJIhMljwYHM3VCe8qyvMd/HRFXROd7K8oTaZqe2xHc="

Re: Wireguard no handshake on iOS

Posted: Tue Jul 16, 2024 5:23 pm
by llamajaja
Concur with previous posters.
If your android is connecting its using BTH not regular wireguard setting Which is only required if you dont have a public IP.

For client devices allowed IPs, you need either,
BOTH the subnet of wireguard and the subnet(s) you need to access { 192.168.100.0/24,192.168.1.0/24 }
OR
If you required internet then 0.0.0.0/0 which includes both items above! { 0.0.0.0/0 }

Recommend NOT to use BTH and as recommended
a. put in the input chain rule.
b. add wireguard to the LAN interface
c. change your NAT RULE TO:
add action=masquerade chain=srcnat comment=hairpin dst-address=192.168.1.0/24 src-address=192.168.1.0/24

As noted your Router wireguard allowed IPs should look like.
/interface wireguard peers
add allowed-address=192.168.100.4/32 interface=wireguard name=KrzysPixel public-key="#####"
add allowed-address=192.168.100.3/32 interface=wireguard name=ipad public-key="***"

DISABLE UPNP, it should NOT be required.
REMOVE All IPV6 firewall rules and lists if the IPV6 is disable.

Set to NONE:
/tool mac-server
set allowed-interface-list=NONE

Finally change your forward chain rules as follows:
REMOVE DEFAULT RULE AND REPLACE
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN

With:
add action=accept chain=forward comment="internet traffic" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="port forwarding" connection-nat-state=dstnat
add action=drop chain=forward comment="drop all else"
All times are UTC+03:00
Page 1 of 1
Powered by phpBB® Forum Software © phpBB Limited
https://www.phpbb.com/