Wireguard connected but not able to access internal resources

binarydoom · Sun Jun 01, 2025 12:19 pm

I have a home network setup that goes like this:
[ISP Modem connected to Mikrotik Router]
For the MT router, ether1 is WAN. ether2 and ether3 form a bridge. The remaining ports are unused.

[ether2] 192.168.86.0/24
This interface connects to ASUS ROG router where devices are accessing internet via WiFi.

[ether3] 192.168.88.0/24
This interface is where main desktop PC is situated at, together with a simple mikrotik RB260GS switch.
I use the switch as a plug-and-play and no further configuration is made on the switch and it simply works.
Desktop PC and Synology NAS are connected to switch and back to ether3.

I have been trying to configure my NAS and setting things up but I encountered a few problems:

1. I have issue with NAT Hairpin
I have set up DDNS on my Synology NAS successfully, with a wildcard certificate.
Using the domain name, it can resolve to my ISP public IP address assigned to my MT router.
From my mobile line, I could access my Synology DSM Login Portal page after setting up DNAT on MT router.
But when i try to access it from my desktop PC via the domain name, the connection was refused.
I then read that for local users to access an internal resource using external domain name, NAT hairpin needs to be setup.
I tried setting it up but it didn't work.

2. Wireguard connected but not able to access the apps
I wanted to setup Wireguard so that me and my family members could just connect via Wireguard to use the Synology applications.
Right now, we are connecting back via QuickConnect. While it works, it might not be the most ideal in terms of security.
I setup Wireguard client on my android mobile and added wireguard interface and wireguard peer on my MT router.
The Wireguard tunnel seem to be established successfully. I checked my mobile phone and it was assigned the IP address for the Wireguard subnet.
To allow wireguard connected peer to access the NAS resources, I added a firewall rule to allow that.
However, I was not able to connect. From the logging, i was able to see the SYN packets but the connection failed.
I even tried disabling firewall on Synology NAS and it didn't work as well.

I am out of ideas of what could be the issue and I need some guidance.

Please have a look at the configuration export below.

# 2025-06-01 17:08:04 by RouterOS 7.15.3
# software id = 7YZP-38T4
#
# model = C53UiG+5HPaxD2HPaxD
# serial number = <removed>
/interface bridge
add admin-mac=<removed> auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=ether2 ] comment="TV Port"
set [ find default-name=ether3 ] comment="Study Room Port"
/interface wifi
set [ find default-name=wifi1 ] channel.skip-dfs-channels=10min-cac \
    configuration.country=Singapore .mode=ap .ssid=MikroTik-62F531 disabled=\
    no security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=\
    yes
set [ find default-name=wifi2 ] channel.skip-dfs-channels=10min-cac \
    configuration.country=Singapore .mode=ap .ssid=MikroTik-62F531 disabled=\
    no security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=\
    yes
/interface wireguard
add listen-port=18281 mtu=1420 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=10m name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface wireguard peers
add allowed-address=192.168.100.7/32 comment=GPix7 interface=wireguard1 name=\
    GPix7 public-key="<removed>"
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=192.168.86.1/24 comment=asus interface=bridge network=\
    192.168.86.0
add address=192.168.100.1 comment="IP of Wireguard Interface" interface=\
    wireguard1 network=192.168.100.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="For wireguard" dst-port=18281 \
    protocol=udp
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="Wireguard To NAS" dst-address=\
    192.168.88.250 in-interface=wireguard1 log=yes out-interface-list=LAN
add action=accept chain=forward comment="From Asus ROG WiFi LAN to NAS" \
    dst-address=192.168.88.250 src-address=192.168.86.0/24
add action=accept chain=forward comment="To Asus ROG mgmt" dst-address=\
    192.168.86.1 dst-address-type="" layer7-protocol="" src-address=\
    192.168.88.0/24 src-address-type=""
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment="DNAT Port Forwarding to NAS HTTP" \
    dst-port=80 in-interface=ether1 protocol=tcp to-addresses=192.168.88.250 \
    to-ports=80
add action=dst-nat chain=dstnat comment="DNAT Port Forwarding to NAS HTTPS" \
    dst-port=443 in-interface=ether1 protocol=tcp to-addresses=192.168.88.250 \
    to-ports=443
add action=dst-nat chain=dstnat comment="DNAT Port Forwarding to NAS PORTAL" \
    dst-port=18888 in-interface=ether1 protocol=tcp to-addresses=\
    192.168.88.250 to-ports=5001
add action=masquerade chain=srcnat dst-address=192.168.88.250 out-interface=\
    bridge protocol=tcp src-address=192.168.88.0/24
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Asia/Singapore
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool sniffer
set filter-dst-ip-address=192.168.88.250/32 filter-operator-between-entries=\
    and filter-port=5001

binarydoom · Sun Jun 01, 2025 12:23 pm

Forgot to add the wireguard settings:

If there's anything I can do to capture more information to help the troubleshooting, please direct me. Thank you.

admin@MikroTik] /interface> wireguard/ 
[admin@MikroTik] /interface/wireguard> print 
Flags: X - disabled; R - running 
 0  R name="wireguard1" mtu=1420 listen-port=18281 private-key="<Removed>" public-key="<Removed>" 
[admin@MikroTik] /interface/wireguard> peers/ 
[admin@MikroTik] /interface/wireguard/peers> print 
Columns: INTERFACE, PUBLIC-KEY, ENDPOINT-PORT, ALLOWED-ADDRESS
# INTERFACE   PUBLIC-KEY                                    ENDPOINT-PORT  ALLOWED-ADDRESS 
;;; GPix7
0 wireguard1  <Removed>              0  192.168.100.7/32

Njumaen · Sun Jun 01, 2025 1:24 pm

Did you forget to you add wireguard1 to interface list LAN?

Same happens to me some times

Ralf.

jaclaz · Sun Jun 01, 2025 1:32 pm

2.
Normally the wireguard interface is added to /interface list member (as either LAN or WAN, or in some cases even BOTH

, usually LAN ):
viewtopic.php?t=212219
, as there may be other default configuration firewall filter rules blocking the connection.
You should check what happens in your configuration (which firewall rule, if any, drops the wireguard traffic) and correct the setting as needed.

MTNick · Sun Jun 01, 2025 1:44 pm

1. I have issue with NAT Hairpin
I have set up DDNS on my Synology NAS successfully, with a wildcard certificate.
Using the domain name, it can resolve to my ISP public IP address assigned to my MT router.
From my mobile line, I could access my Synology DSM Login Portal page after setting up DNAT on MT router.
But when i try to access it from my desktop PC via the domain name, the connection was refused.
I then read that for local users to access an internal resource using external domain name, NAT hairpin needs to be setup.
I tried setting it up but it didn't work.

Edit hairpin NAT rule to match:

/ip firewall nat
add action=masquerade chain=srcnat comment="Hairpin NAT" dst-address=192.168.88.250 in-interface-list=LAN out-interface-list=LAN protocol=tcp src-address=192.168.88.0/24

anav · Sun Jun 01, 2025 7:51 pm

You are very confused.
You want a single bridge and no vlans and yet you have a second subnet for the asus rogue on ether2, but but ether2 is on your bridge, so there is conflict.
It would seem you are using your asus rogue as a router and in that case its wanIP will be on the 192.168.88.0/24 network as assigned by the bridge.
I also see you decided to assign the bridge a second IP address which again is not conducive to success.
Also you state ether2 as your TV port, another discrepancy revealed.

If you want anything else then you will need to provide more details on requirements.
For example I would put the ASUS on its own vlan
OR
Alternatively run the ASUS device as an AP only and create another separate subnet on the MT router with iP pool etc but only for ether2.

Firewall rule order is important, so all rules you added should come generally after the default rules in place..........
In the forward chain, a slight change will enhance both port forwarding and make it clearer what the rules are doing and a bit more secure.
(this rule removed and replaced --> add action=drop chain=forward connection-nat-state=!dstnat connection-state=new in-interface-list=WAN)

ASSUMING ASUS router has nat applied, any 192.168.86.x user traffic will get sourcenatted to the WANP of the ASUS 192.168.88.XX and thus
being part of the LAN will have access to all users. Any layer 3 firewall rules would be useless. There is no way in your plan to limit asus users at all.
Any return traffic will work as well.
The only path not possible is any 192.168.88 user trying to reach 192.168.86.0 subnet.
For this one would have to create a static route on the MT to point to the right LANIP (the wanip of the asus) and thats best done by making the asus wanip a static setting.

Not sure of the purpose of this rule so it was removed.
add action=masquerade chain=srcnat dst-address=192.168.88.250 out-interface=\
bridge protocol=tcp src-address=192.168.88.0/24

In terms of port forwarding, one has to slightly modify the dstnat rule to adapt to the fact that one has a dynamic WANIP. The port foward rule was already adjusted in firewall rules, but we need to add a firewall address list for the WANP and apply it in dstnat rules along with the already noted hairpin nat rule. ANother advantage of vlans is that you could put the server in its own vlan and then not need the hairpin source nat rule.

# model = C53UiG+5HPaxD2HPaxD
# serial number = <removed>
/interface ethernet
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=ether2 ] comment="to ASUS"
set [ find default-name=ether3 ] comment="Study Room Port"

/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=wireguard1 list=LAN

/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=192.168.100.1/24 comment="IP of Wireguard Interface" interface=\
wireguard1 network=192.168.100.0

/ip firewall address-list
add address=mynetname list=MYWAN { use your IP cloud available dyndns name, or any free dyndns service }

/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="For wireguard" dst-port=18281 protocol=udp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
++++++++++++++++++++++++++++++++++++++++++
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=accept chain=forward comment="internet traffic" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="port forwarding" connection-nat-state=dstnat
add action=accept chain=forward comment="Wireguard To NAS" dst-address=\
192.168.88.250 in-interface=wireguard1 log=yes out-interface-list=LAN
add action=drop chain=forward comment="drop all else"

/ip firewall nat
add action=masquerade chain=srcnat src-address=192.168.88.0/24 dst-address=192.168.88.0/24
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment="DNAT Port Forwarding to NAS HTTP" \
dst-port=80 dst-address-list=MYWAN protocol=tcp to-addresses=192.168.88.250 \
to-ports=80
add action=dst-nat chain=dstnat comment="DNAT Port Forwarding to NAS HTTPS" \
dst-port=443 dst-address-list=MYWAN protocol=tcp to-addresses=192.168.88.250 \
to-ports=443
add action=dst-nat chain=dstnat comment="DNAT Port Forwarding to NAS PORTAL" \
dst-port=18888 dst-address-list=MYWAN protocol=tcp to-addresses=\
192.168.88.250 to-ports=5001

Wireguard connected but not able to access internal resources

Wireguard connected but not able to access internal resources

Re: Wireguard connected but not able to access internal resources

Re: Wireguard connected but not able to access internal resources

Re: Wireguard connected but not able to access internal resources

Re: Wireguard connected but not able to access internal resources

Re: Wireguard connected but not able to access internal resources