MikroTik

slaz

What is listening on IP address 192.168.200.1 and what on 192.168.200.11?: Line 458: add action=dst-nat chain=dstnat comment="Wireguard hairpin nat" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=no !dscp !dst-address dst-address-l...

slaz

Hello all, Did anything change lately regarding wireguard in latest OS? I did an upgrade and it seems I can't come from the outside anymore to connect to the wireguard. If I am internally I can connect to it and handshake is established ok. I have the same settings from before and nothing change fro...

slaz

Why have any firewall rules, all is permitted............. so the rules you made are not even necessary as there are no blocking rules. A mess of a config......... if you are truly internet facing!! What is the purpose of this rule?? add action=masquerade chain=srcnat comment="Hairpin NAT"...

slaz

I see that you have a second wireguard interface setup on the RPI, for android access probably not a bad idea but are you saying that both Devices have publicly accessible WAN IPs? The important addition to android phone connectivity is the ability for the NAS server and the webservers to a. be acc...

slaz

This is the config on the rpi with pivpn sami@pivpn:~ $ pivpn -d ::: Generating Debug Output :::: PiVPN debug :::: ============================================= :::: Latest commit :::: Branch: master Commit: 4032a55c80f25b51419180eda93f44d579ab79e9 Author: 4s3ti Date: Wed Mar 29 14:54:19 2023 +0200 ...

slaz

Understood, but how can I make sure the mikrotik is the one connecting to the rpi? Meaning, how can he be the one initiating the connection?

slaz

you can create second peers on each MikroTik Wireguard interface. https://forum.mikrotik.com/viewtopic.php?p=920105 Scenario 4 - (MEDIUM) Peer to Peer tunnelling with one Wireguard interface & Use of IP addresses for Wireguard interfaces. hi, thank you for the response. Unfortunately I only hav...

slaz

Hi all, I would like to ask you if it's possible to have the mikrotik router as a Wireguard server and as a Wireguard client in the same time. Basically I have it set up as a server and it works ok to connect from android phone to a NAS behind the router. Now I would like to add a RPI Wireguard serv...

slaz

With this it doesn't work either
So maybe it's time to try the advice from my previous post?

This is nice. Now it works like a charm. But now, what did I just disable? Me happy that it works but I want to learn also.
Many many thanks. Much appreciated

slaz

Like this? [sami@Mikrotik_router] > ip firewall/nat/print Flags: X - disabled, I - invalid; D - dynamic 0 ;;; Hairpin NAT chain=srcnat action=masquerade connection-mark=Hairpin NAT log=no log-prefix="" 1 ;;; defconf: masquerade chain=srcnat action=masquerade out-interface-list=WAN ipsec-po...

slaz

Hello, I am trying to access some devices on local network going through the WAN but this doesn't seem to work anymore. Previously on ros6 I was able to have this 2 rules that were taking care of this and it worked like a charm 4 ;;; Camere Dahua internal chain=srcnat action=masquerade protocol=tcp ...

slaz

I contacted support and they got me straightened out. Posting here on the off chance it benefits someone else. I had to delete the 5GHz CAP from the CAPsMAN interface list and then reprovision and it came right up. I am not sure if that is already documented somewhere, but I had not found it. Is th...

slaz

Doing some more configuration on the router I see that something changed since ros v6 to 7 in the sense that I can't seem to be able to connect to local devices if I am in local and I go over the internet. This is what I try to do: 1. Connect from local devices to local devices ( works ): from 192.1...

slaz

After posting the above information I noticed that on the nas ( 192.168.200.11) I still had the wireguard interface up from before moving the wireguard server to the router. That would mean that he had no way to route the packets to correct place. root@DS1621xs:~# wg interface: wg0 public key: XXXlG...

slaz

Thank you @Sob for your reply. Much appreciated. I want to say that I tried before to ping from 192.168.201.3 ( android with tunnel) to 192.168.200.11 ( nas device on LAN) and I did tcpdump on nas and saw the request and reply on the nas but it was not arriving on the 192.168.201.3. I also did anoth...

slaz

I just did but still can't access it. If I ping from android (192.168.201.3) to router (192.168.201.1 or 192.168.200.1) it works. But if I try to ping anything on 192.168.200.0/24 it does not work

slaz

So, I managed to be able to get on the internet from android (192.168.201.3/32) through the tunnel from router ( 192.168.201.1/24).
Only thing that does not work so far is to access the native network ( 192.168.200.0/24) from the android over the tunnel. This I don't know how to do it

slaz

Don't invent random things that don't make sense. Endpoint on Android is where server is, if it should work from internet, it needs to be public address (or hostname) of your router. You also don't need another route to 192.168.201.3, there's already dynamic route to 192.168.201.0/24 created by IP ...

slaz

Did a test. On android I set 192.168.200.1:51820 as endpoint and then I can see rx on android increasing. I can go on the internet on android and I can ping 192.168.200.1 and 192.168.201.1 ( the router) but can't ping other devices in 192.168.200.0 range. So I think there is something to do with the...

slaz

Requirement: Android to reach local devices ( 192.168.200.0/24 range ) and to reach the internet through the router 192.168.200.1 Mullvad is there from some try but it's not in use and no plans for it atm That makes no sense to me..... The traffic coming on the android phone, Wireguard_Android inte...

slaz

I can start from scratch regarding wireguard and can follow instructions if that works and can always show screen

slaz

Requirement:

Android to reach local devices ( 192.168.200.0/24 range ) and to reach the internet through the router 192.168.200.1
Mullvad is there from some try but it's not in use and no plans for it atm

slaz

Input chain rule.. add action=accept chain=input comment="Allow Wireguard" dst-port=51820 \ in-interface= eth1-wan protocol=udp Should be add action=accept chain=input comment="Allow Wireguard" dst-port=51820 \ in-interface= digi protocol=udp alternatively this would have worked...

slaz

changed. Still not yet there

slaz

In case it's wanted I can always setup a discord share screen session or a team viewer to help easier

slaz

Config is here

slaz

android is via 4G cause I want to make sure it works and wifi does not interfere

slaz

Does Android client have any status? Can it try to ping 192.168.201.2? And when you do that, is there any change in peer's Rx and Tx on RB? If not, do you see at least some incoming packets on WG port 51820? You can use Tools->Torch on WAN interface (digi). And of course your router does have publi...

slaz

And you don't want this route: ;;; Wireguard range 2 s 192.168.201.0/24 bridge-lan 1 disabled the route [sami@Mikrotik_router] > ip route/ print Flags: D - DYNAMIC; X, I, A - ACTIVE; c, s, v, y - COPY Columns: DST-ADDRESS, GATEWAY, DISTANCE # DST-ADDRESS GATEWAY DISTANCE 0 Xs eth1-wan 1 ;;; Wiregua...

slaz

changed the android to 192.168.201.3/32 but no joy yet

slaz

I also added a bit to message, but you were too fast. Get rid of peer's endpoint on RB.

I did. posted updated config above

slaz

What about other config on RB? Addresses, routes, ... what you posted is not enough to make it work. [sami@Mikrotik_router] > ip address/ print Flags: D - DYNAMIC Columns: ADDRESS, NETWORK, INTERFACE # ADDRESS NETWORK INTERFACE 0 192.168.200.1/24 192.168.200.0 eth2-lan 1 50.0.0.1/24 50.0.0.0 bridge...

slaz

Check this topic.
viewtopic.php?t=182340

I read the topic but it's not clear for me how to make it work

slaz

Hello, I would appreciate if I could please get some help on setting up the RB5009UG as a Wireguard server to connect with android phone. Here is my server config: Screenshot_20220118_192954.jpeg Screenshot_20220118_193130.jpeg Here is my android phone config: Interface: name:home private key:IPrxxx...

slaz

Did anyone try to use capmans on v7.1? I am trying to get it working but with no joy. Have v7.1 on router Have it running on mAP with mAPlite as cap in lab setup. Maybe best to make separate post (provide link here) in order not to loose all info in this one. Then others can also inspect in detail ...

slaz

Did anyone try to use capmans on v7.1? I am trying to get it working but with no joy. Have v7.1 on router system/resource/print uptime: 5h36m25s version: 7.1 (testing) build-time: Dec/01/2021 14:07:27 factory-software: 7.0.4 free-memory: 812.5MiB total-memory: 1024.0MiB cpu-count: 4 cpu-frequency: 1...

slaz

Hi, I also see this behavior. Is there any chance you manage to get it solved? Thanks lots in advance

Search found 37 matches

Re: Wireguard connection broken

Wireguard connection broken

Re: Can a mikrotik be a Wireguard server and a client in the same time?

Re: Can a mikrotik be a Wireguard server and a client in the same time?

Re: Can a mikrotik be a Wireguard server and a client in the same time?

Re: Can a mikrotik be a Wireguard server and a client in the same time?

Re: Can a mikrotik be a Wireguard server and a client in the same time?

Can a mikrotik be a Wireguard server and a client in the same time?

Re: Access device from local network through WAN

Re: Access device from local network through WAN

Access device from local network through WAN

Re: CAPsMAN 5GHz Not Working [SOLVED]

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Re: Help needed for setting up Wireguard for android device

Help needed for setting up Wireguard for android device

Re: v7.1 is released!

Re: v7.1 is released!

Re: [Ask] load image in whatsapp become slow