Wireguard Road Warrior Setup, Ft. MikroTik

[@TheNetworkBerg]

Some reference material and useful links: MikroTik Wireguard Docs: help.mikrotik.com/docs/display/ROS/WireGuard Wireguard Docs: www.wireguard.com/papers/wireguard.pdf Wireguard Ubuntu Setup: www.thomas-krenn.com/en/wiki/Ubuntu_Desktop_as_WireGuard_VPN_client_configuration

[@geoffvandermerwe6220]

IPSec road warrior sound like a awesome next video ! Thanks again for a great upload ! Have a good evening

[@konikonradowski9773]

absolutely the best MK WG manual. great job. thank you.

[@vokurka-net]

Wow. On your video it works without add any firewall rule (e.g. masquerade) for access to LAN. It's really shocking. 👍

[@andrisvereczki359]

An important thing to note is that if you want to reach out to hosts inside the subnet(s) that are connected to the wireguard server (the router) from your wireguard roadwarrior peers, you need to srcnat the range of your wireguard subnet on your router otherwise, the only thing you’re going to reach through the tunnel is the router itself and the internet. Since my main goal with the tunnel was reaching my remote desktops and services at home, this was key to a working setup. The other very important step is to allow the wireguard udp port through your input chain early on so the connection can establish successfully.

[@TheNetworkBerg]

Yes that is correct, thanks for leaving the comment and your experience.

[@hit-757]

My wireguard clients connect even if I don't accept traffic incoming to my wireguard's listening port. It's like MT adds this silently for me.

[@andrisvereczki359]

@@hit-757 if you don’t have any “drop all” kind of rules at the end of the chain thenn unlike cisco for example, which has an implicit drop all at the end of every firewall list, mikrotik chains have an implicit accept all rule at the end so that is why it could be working

[@hit-757]

@@andrisvereczki359 I do have drop all, and my input chain is very short and restricted. I've found the reason. I'm accepting established+related and my other WG endpoints are defined on my MT, so probably my MT is an initiator of those connections. Checked with no endpoints defined and these couldn't connect. So I was wrong. We need a dedicated rule for WG incoming connections. :)

[@mikkio5371]

thank you and i am your student . i did sstp ,l2tp and wireguard VPN on my pc and mikrotik router as server . trust me the BW test i got on each test . wiregaurd is by far the best. without vpn speed is 80/80M, l2tp 11/4M ,SSTP 6/13M and wiregaurd 27/21M. wow !!

[@palwindersingh9678]

Thanks, the actual setup worked fine. But the setup video only makes Wireguard tunnel accessible from the local network. IMO, it defeats the purpose of road warrior setup. To make it accessible from the WAN. I had to add this firewall rule: chain=input action=accept protocol=udp in-interface= dst-port= Add this rule and move it in number one place of your firewall rules. AFAIK, Wireguard has in-built protection against port-scanners, so you would be fine here. I tested with an online open port checker and my WG port was displayed as closed. Just for assurance don't use WG's default port. P.S: If you'd like to access your Mikrotik's webfig and Winbox settings through Wireguard tunnel. Make sure to add this rule and put it under the 'Wireguard Port' rule: chain=input action=accept protocol=tcp in-interface= dst-port=80,8291

[@TheNetworkBerg]

That's correct, just like I mentioned in the video you will need to add a rule that allows the listening port from the outside if you have firewall rules running on your MikroTik that is potentially blocking the traffic. It is also stated in the comments :)

[@mnero83]

What are the firewall rules and NAT config when Using Wireguard on a Mikrotik LTE device??? I dont have a static IP, but I am using the DDNS option. Wireguard runs OK when connected directly with LAN cable ( Mikrotik LTE device as wireguard server - win10 wireguard client) so the wireguard setup is right.

[@palwindersingh9678]

@@TheNetworkBerg Thanks, my mistake, I didn't watch the video till the end.

[@lorcster6694]

I found out what the problem was. I had a firewall NAT rule for my phone server for ports 2000-65000 UDP and this clashed with wireguard UDP 13231. So i changed wireguard to a port below 2000 and it works fine! Thanks!

[@Anavllama]

Covering third party vpn setup could be a useful video, sure to get lots of hits............. Juice it up by adding road warrior connection person A, using your main router internet as you have just demonstrated and road warrior connection person B, tunneling in and using the 3rdparty wireguard VPN tunnel (and not the main ISP internet).

[@TheNetworkBerg]

That's a great idea Alex, man I actually wish I still live streamed because that would be such a nice live lab to tackle with the viewers. After I finish a few of my other planned videos I am definitely swinging back around to cover WG in this way.

[@tamasiferenc9033]

/32 for the peers, now it's working, thanks again!!!

[@jamesugbojoide1229]

Thanks for the Video, Lovely I must say. Someday I want you to do some video on user manager for ISP set up to manage data volume for WISP. Using Mikrotik router as the core device

[@lakromani8172]

Another good video. You should note that it would help to have control of alle the peer by adding a comment to them. No one knows what an IP is. You can use netwatch to monitor the stateless Wireguard.

[@TheNetworkBerg]

Really great point

[@Riekertvv]

The need for a adblocker on your browser is real! haha Great little tutorial though! Need to setup and test mine too

[@TheNetworkBerg]

Hahahaha yeah man, those ads are surrounding the speed test window from all sides.

[@Riekertvv]

@@TheNetworkBerg yeah! Haha always funny to see that!

[@zeljkomikrotik]

Hi! great video, big learning process! Could you make a WG setup with a firewall rules (no production setup is been done without the proper fw rules)? tx

[@LuLuXDCraft]

Nice video thank you ! For quick and easy LAN access through the wireguard tunnel, if I'm correct, you can add the wireguard interface in the default "LAN" interface list.

[@kilko007]

Thank you for sharing knowlegde! Great and straight to the point :) I'm wondering if you could make a video wireguard setup on a mikrotik - then connect ether1 to internal network - and then share that wireguard connection to port 2-5. Then several PCs, TV/netflix etc can share the vpn connection. Possible?

[@m-electronics5977]

8:12 You can give the Clients also a /24 Address. MikroTik doesn't automatically setup routes for the AllowedIPs i think/know.

[@johnsant199114]

did everything exactly as mentioned in the video... unfortunately could not get it to work anywhere.. not even on local network :(

[@adekusilejohnseun5530]

I saw this on your LinkedIn, Kindly do a tutorial (mikrotik & cisco) on these - Configuration of traffic engineering with features such as QoS, CoS, ToS, and Traffic Queues. - Configuring advanced features such as traffic manipulation through services such as route-leaking

[@kirksteinklauber260]

Loved the video!!! I did tried but I noticed that something was missing. I had to add a Firewall rule for the input chain to allow the UDP port 13231

[@TheNetworkBerg]

Thanks for the info! I do mention that in the video that you will need to add an input chain for the listening port if your firewall is potentially blocking the traffic. This point is varied for all ROS users since many have various firewall rules in different combinations in what they are allowing or blocking. (Although maybe I should have shown this example as well for people that do have rules blocking the traffic)

[@kirksteinklauber260]

@@TheNetworkBerg thanks! I missed that part in the video 🤦‍♂️

[@ruffneck718]

Thanks!

[@TheNetworkBerg]

Thank you very much, I appreciate the support!

[@shalak001]

I'm interested in setting up an ultimate road-warrior, portable Access Point. The goal is to have a mikrotik device, that I can travel with. That device should have several ways to connect to any internet uplink - of course, all of them by default disabled, and I'd enable whatever I have at my disposal - sometimes, I'd put a SIM card in, sometimes I'd connect to hotel WiFi and sometimes, I'd simply plug in an ethernet cable. On the other side of this device, I'd have it spread 3 WiFi networks. One would allow me to reach internet directly + all my self-hosted services at home via a wireguard tunnel. The second WiFi would tunnel all traffic through wireguard tunnel. And the third, would only share the internet uplink (this WiFi I'd share with the friends I'm travelling with). I'm thinking on what would be the best approach to achieve this. Any suggestions?

[@chaddthompson]

Quick question I am able to connect with an android device to my router with Wireguard, I have the available addresses set to 0.0.0.0/0 on the android and can access the internet through the WG connection and other IP's on the network that my MT is connected to but cant access the mikrotik or anything on the local network of the MT itself. Checked all firewall rules and nothing there blocking input from WG ip's any ideas?

[@biplobchandro4424]

From client device hdandshake not working. Public key at both end are okay. What could be problem?

[@BenFisher532017]

I would be most grateful if someone would kindly explain the /24 /32 masks in more detail. I think I understand why this is, but not really. Why does /24 on the warriors break the setup? How exactly does it break it? Thanks in advance :)

[@armonefourie]

Can we do a IPsec or wireguard setup same as NordVPN to only push certain devices (Apple TV) over the VPN to bypass restricted content. Maybe with a hosted ROS in linode? Using Mikroik as the client device.

[@antonionyto9600]

Kindly post a video tutorial of this senarrio I have wireguard vpn server on my ubuntu server and i want to connect my mikrotik as wireguard client

[@antoniomax3163]

i like it

[@eduannaude8301]

Great video

[@urZcszyYo3TMEDmW]

Thanks for manual! What would be the difference in connection logic if made server on two sides? Like point A would be 10.1.1.1, point B 10.1.1.2, and on both sides I would create opposite peer with endpoint etc.

[@PetrKrenzelok]

How could client provisioning become more automated? I tried to set allowed ips to the /24 subnet and tried to setup a DCP server on Mikrotik. But the interface is not listed there. OTOH it might not make sense, because you already need to have an allowed IP, when connecting to MT server. Wonder how to aproach that topic ....

[@pablo6405]

I have an issue with this configuration. I can not connect via remote desktop client. I can see the Windows Logon Screen but when I enter the credentials it says that user or password are wrong. I created dst-nat rule to access the Windows Server directly via intenet and I can connect with no issues. I´ve found this NAT rule that was causing me the issue: chain=dstnat action=dst-nat to-addresses=192.168.x.103 to-ports=3389 protocol=tcp dst-port=3389 log=no log-prefix=""

[@kirksteinklauber260]

Can you do another video showing S2S VPNs? The use case is one side working as a server with a public IP (Static or dynamic) and the client side behind a NAT (i.e., CGNAT). Your other video assumes that you have each endpoint's IP address but that configuration doesn't work for this use case

[@TheNetworkBerg]

Sure thing Kirk, I've been working on a lab for just that type of scenario. Hopefully this will be my final and best Wireguard tutorial video on MikroTik :)

[@kirksteinklauber260]

@@TheNetworkBerg excellent thanks!! Looking to see it!!

[@SavannahTL]

Can you show us the firewall setup for WireGuard? Would it be in the Input chain or the forward? Filter list or nat list?

[@TheNetworkBerg]

Hi Steve, my firewall has no filter rules. The default rules on ROS should also still allow the traffic I think. But you want to make sure that "INPUT" on the Filter List allows the listening port on your firewall since a session is being established to the router's IP. So a rule might look something like: /ip/firewall/filter/add chain=input protocol=tcp/udp dst-port=13231 in-interface="WAN PORT" (Could change interface to destination IP as well if you have a static IP) Just make sure this rule is at the top and being referenced first.

[@urZcszyYo3TMEDmW]

what you mean? you just make "ip firewall filter add chain=input action=accept protocol=udp dst-port=XXXXX place-before=0 in-interface-list=WAN" like rule where XXXXX is wireguard interface port.

[@locusm]

If you didnt want the WG to be the default route I assume you add all the subnets behind the WG server to allowed-ips on the client?

[@TheNetworkBerg]

Correct

[@vanogelashvili4333]

hello i have wireguard site to site How do I get a public IP address from Site B to Site A? thanks

[@Codename_47]

Hello again, The Network Berg, thank you for this video, but it will be nice to see this case with the mobile device between two Mikrotik A and B routers, which is connected site to site via IPsec. And when C (android or iphone) are connected, get access to both LANs of router A and B. Is this possible? Here is the scheme: |C - Mobile| | |Wireguard or | IPsec IKEv2 | |A - Router1| |B - Router2|

[@lorcster6694]

Do you know why my mikrotik-wireguard interface is in italics? Also, in IP->Addresses, the IP Address I setup for wireguard says 'Invalid' as it is in red writing.

[@locusm]

You cant have multiple WG interfaces using the same port - check that.

[@henrikmller852]

How do you find the Endpoint IP on your MikroTik?

[@MrInsanityflea]

Quick update it's no longer 'public.key' it's just publickey

[@gezimleka7751]

3 weeks ago I was using L2TP and PPTP. After watching your video I set up Wireguard and have installed and configured in many Mobiles and Windows PCs. I have been using it for 3 weeks and I am not satisfied. I noticed that the speed is less than what I had. So I decided not to use it anymore.

[@chesalazar1315]

why mine is not working

[@lorcster6694]

This sadly did not work. It may be due to the firewall filter rules i am not sure. I tried to add a rule but it didn't work. add action=accept chain=input comment="Wireguard 13231 port allowed" \ dst-port=13231 in-interface=ether1 protocol=udp

[@petrucci2]

I have same issue. I don't have any rule in the firewall in any tab.

[@lorcster6694]

@@petrucci2 My issue turned out to be that the port 13231 was in use by my Phone server. Make sure you are doing port forwarding on whatever port you require for wireguard, AND it is not in use for anything else. You can use any number, lets say 378 as random

[@sunilmahajan7]

Why does WireGuard using Dragon logo- just wondering...

[@TheNetworkBerg]

I have no idea honestly, maybe the people that created it thinks dragons look cool. Will need to google for an answer or ask them directly :P

[@PInc777]

We've configured WireGuard on all our Mikrotik routers in a site-to-site configuration. We have one site setup with the server configuration and the other sites connect to it. All the sites can see each other and the devices at each site. We are trying to create a Road Warrior config that will enable remote users to access resources on the various subnets. We are unable to get the Road Warrior client to see any other subnet other than the subnet the WireGuard server is on. Any ideas?

[@HiltonT69]

Do you have src-nat configured for the wireguard subnet?

[@ocular57]

Topology is Road Warrior--> Close Mikrotik WG node-->Distant Mikrotik WG node-->local subnet. In your distant MT WG node go to the WG Peer that allows traffic from the near MT WG node into the distant MT WG node and in allowed IPs make sure you have the WG IP of the Road Warrior in /32 format listed and this should allow the Road Warrior in to see the distant node subnet. It sounds as though you have already associated the WG interface and LAN interface in the interface list in each MT WG node. With default Mikrotik firewall rules setting up the WG - LAN interface list is enough to allow NATted traffic without having to add specific firewall rules.