@ Chupaka thanks for the feedback. Makes sense, though I think it is indeed unnecessary for me and I will just check against hosts I do not use anyway. Though I have to admit I had hoped MikroTik would provide an easier solution to thi, like e.g. just adding a list of IP addresses to check for a rou...

It's probably not very likely, but that would be fun. ;) This is why I didn't add any checks for my failover Internet :) So if those all stop working, then the failover Internet will still work until I can adjust the configuration accordingly (e.g. remove the checks from the main internet). One sol...

Thanks for the information. As mentioned it is fine in my case now, just find it an odd limit, but I guess if want really needs it, there is always scripting to do this. I now use two DNS servers to check (in case one is down, however unlikely that is) and one of the remaining providers for my real ...

@bpwl Thanks again. I expected this to be the case (since yesterday). I guess there is no easy way around this? It isn't that problematic because as you mentioned there are multiple safe IP addresses to check against but I still think it is a weird limitation :) It is also something that is very sel...

@bpwl: Thanks for the feedback. As mentioned it mostly works fine this way. However, if the main WAN is down, then the gateway used to check for it, is not reachable either as the route with the gateway (e.g. "8.8.8.8") is down but not the one where "8.8.8.8" is the dst-address w...

Hi, first: Thanks for all the information. It is a lot of helpful information so far. However, it is actually a bit much and therefore I am a bit confused to find the really relevant parts for me and what exactly what part does. I have a failover WAN already working using recursive routing. However,...

I have now ordered a "RBD52G-5HacD2HnD-TC" to use for VPN for now. I only have one or two clients at once, so it should have more than enough bandwidth and it is ARM 32Bit based like your devices are.

Maybe I will buy a cheap corresponding device for wireguard server too and return the main to stock firmware. Would probably be a better solution currently anyway - until ROS7 is at least in RC status - but I wanted to test it first before commiting.

I have done some furher testing and it might be an issue to the used router/hardware, see my post in another thread: https://forum.mikrotik.com/viewtopic.php?f=1&t=175643&p=870251#p870251 I was able to get it working fine immediately with the same settings on a different Mikrotik router whic...

I have now tried forwarding the WireGuard Port to my Internet fallback Mikrotik router instead of the main one and try WireGuard there. I used the same configurations with the same allow rules etc. and I got it working immediately without any issues. Access to internal networks was immediately possi...

We have made documentation here: https://help.mikrotik.com/docs/display/ROS/WireGuard Sadly, I want to set it up for mobile clients, so this is not really helpful. I tried a lot and stumbled upon these threads: https://forum.mikrotik.com/viewtopic.php?t=174417 https://forum.mikrotik.com/viewtopic.p...

Not sure when exactly but sometimes changing wireguard interfaces, e.g. public key of a peer, results in wireguard freezing, no traffic updates are shown anymore etc. What is even worse is deleting a peer which a lot of times results in the router basically not deleting the peer but it seems to be p...

I am using 7.1b6 and CCR1009-7G-1C-1S+ and I also cannot get wireguard VPN to work with road warriors. I have verified that the public / private keys are definitely setup correctly as once I change it at either the road warrior or the Mikrotik router, I only have transmitted packets on the client. H...

Sadly, I didn't find time to do any tests over the weekend. Not sure yet, when I will find them but I will let you know about the results once I do.

@anav Probably not explained to well what I meant and I don't know if I actually will do with this post. But I am currently using ipsec for VPN and there no interface was did exist, the clients just got an IP assigned, so I was using multiple subnets to give different VPN clients different permissio...

ok. but that only works if you can access the router through an IP outside the VPN subnet and have wireguard go over it. if you want to use an IP in the same subnet and have wireguard be outside your router's subnets, I think you need to assign an IP to the router though it mit not be needed in most...

Yes. At least that is my guess. As long as you only need to access devices inside the network and not the router itself, it most likely is enough to not assign an IP address. Cannot be sure, of course, but I might test this later on. But first I need to get it working in general but I think I know n...

Well my scenario would be more for external clients to connect via wireguard and then use the router as DNS to access internal services. I think for this you need to assign an IP to the wireguard interface but not 100% sure. I will probably not be able to do further tests until Thursday,Friday or Sa...

According to https://wiki.mikrotik.com/wiki/Manual:IP/DNS when using DNS entries, e.g. forwarding of DNS using regex one should use lowercase characters as mikrotik converts uppercase to lowercase automatically. However, with 7.1b6 this does not seem to work. If I do "nslookup -type=srv _kerber...

@Normis Thanks for the documentation. What I am missing is how to set it up with mobile endpoints because those do not have a fix IP and in your configuration both office specify a listen port and endpoint address. I guess I can just skip the listen port and endpoint address on the mobile endpoint a...

@anav Thanks. I will check out it and hopefully can get it working.

Hi, one of the reasons I upgraded to the RouterOS v7 BETA was the WireGuard VPN feature. I have tried to set it up but I just can't seem to get it working. I already have IKEv2 VPN in use but the certificate management is kind of annoying (small business - mostly just family members). I setup a &quo...