wireguard config issues

galash13 · Tue Dec 17, 2024 1:41 pm

Hi all

i have a mikrotik at home running routeros 7 where i have successfully set up a while back wireguard to connect remotely to my lan devices (and just those, i didn't need the internet access too).
i just recently acquired a mikrotik hap to connect it with wireguard to my home mikrotik and route internet through it so that i use my home internet.

i've been following several tutorials both here on the forum and on google but i cannot seem to get any internet or lan access from my hap despite the wireguard tunnel being up between the two. the idea is the hap gets internet from a wifi access point (i configured one of the wifi interfaces as station as you can see below, currently testing with my iphone hotspot) and all its traffic gets routed through the wireguard tunnel.

here's the configs of both routers, i'd really appreciate any help as i'm completely lost on what to do now

home mikrotik config

/interface bridge
add admin-mac=C4:AD:34:89:B3:CA arp=proxy-arp auto-mac=no comment=defconf \
    name=bridge port-cost-mode=short
/interface wireguard
add listen-port=13129 mtu=1420 name=VPN
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.13.100-192.168.13.254
add name="dhcp office" ranges=192.168.22.100-192.168.22.254
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=2d name=defconf
/ip smb users
set [ find default=yes ] disabled=yes
/port
set 0 name=serial0
/ppp profile
set *FFFFFFFE local-address=192.168.45.1
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2 \
    internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3 \
    internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4 \
    internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether5 \
    internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether6 \
    internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether7 \
    internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether8 \
    internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether9 \
    internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether10 \
    internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set max-neighbor-entries=8192
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface wireguard peers
add allowed-address=192.168.89.10/32 interface=VPN name="MacBook Air" \
    public-key="mypublickey"
add allowed-address=192.168.89.12/32 interface=VPN name="iPhone 13 mini" \
    public-key="mypublickey"
add allowed-address=192.168.89.13/32 interface=VPN name="iPad mini" \
    public-key="mypublickey"
add allowed-address=192.168.89.14/32 interface=VPN name="iPhone 13" \
    public-key="mypublickey"
add allowed-address=192.168.89.15/32 interface=VPN name="iPad 9" public-key=\
    "mypublickey"
add allowed-address=0.0.0.0/0 interface=VPN name="Mikrotik hAP" public-key=\
    "mypublickey"
/ip address
add address=192.168.13.1/24 interface=ether2 network=192.168.13.0
add address=192.168.22.1/24 interface=ether2 network=192.168.22.0
add address=192.168.89.1/24 interface=VPN network=192.168.89.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=1m
/ip dhcp-client
add comment=defconf interface=ether1
/ip dns
set allow-remote-requests=yes servers=192.168.13.1,8.8.8.8,8.8.4.4
/ip firewall address-list
add list=FastTrackBlacklist
/ip firewall filter
add action=reject chain=forward comment="isolate personal subnet" \
    dst-address=192.168.22.0/24 reject-with=icmp-network-unreachable \
    src-address=192.168.13.0/24
add action=reject chain=forward comment="isolate office subnet" dst-address=\
    192.168.13.0/24 reject-with=icmp-network-unreachable src-address=\
    192.168.22.0/24
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="Allow WireGuard" dst-port=13129 \
    protocol=udp
add action=accept chain=input comment="Allow WireGuard Traffic" src-address=\
    192.168.89.0/24
add action=accept chain=forward comment="Allow WireGuard Routing" \
    out-interface-list=WAN src-address=192.168.89.0/24
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=WAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related dst-address-list=!FastTrackBlacklist \
    hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=accept chain=prerouting dst-address=192.168.13.0/24 in-interface=\
    bridge
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ip firewall service-port
set pptp disabled=yes
/ip smb shares
set [ find default=yes ] directory=/pub
/system clock
set time-zone-name=Europe/Rome
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

hap config

/interface bridge
add admin-mac=D4:01:C3:BC:F6:F3 auto-mac=no comment=defconf name=bridge
/interface wifi
set [ find default-name=wifi1 ] channel.band=5ghz-ax .skip-dfs-channels=\
    10min-cac .width=20/40/80mhz configuration.mode=station .ssid=\
    "iPhone 13 mini" disabled=no security.authentication-types=\
    wpa2-psk,wpa3-psk .connect-priority=0 .ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel.band=2ghz-ax .skip-dfs-channels=\
    10min-cac .width=20/40mhz configuration.mode=ap .ssid=MikroTik-BCF6F7 \
    disabled=no security.authentication-types=wpa2-psk,wpa3-psk .ft=yes \
    .ft-over-ds=yes
/interface wireguard
add listen-port=13891 mtu=1420 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk connect-priority=0 disabled=yes \
    management-protection=allowed name="iPhone 13 mini"
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=10m name=defconf
/routing table
add disabled=no fib name=wireguard
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf disabled=yes interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=wifi1 list=WAN
add interface=wireguard1 list=LAN
/interface wifi access-list
add action=accept disabled=yes interface=wifi1 signal-range=0 ssid-regexp=\
    "iPhone 13 mini" time=0s-0s
/interface wireguard peers
add allowed-address=0.0.0.0/0 client-address=192.168.89.11/24 client-dns=\
    8.8.8.8,8.8.4.4 comment="Home Mikrotik" endpoint-address=\
    myddns.sn.mynetname.net endpoint-port=13129 interface=wireguard1 \
    persistent-keepalive=10s public-key=\
    "mypublickey"
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=192.168.89.11/24 interface=wireguard1 network=192.168.89.0
/ip dhcp-client
add comment=defconf interface=ether1
add interface=wifi1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="Allow WireGuard" dst-port=13891 \
    protocol=udp
add action=accept chain=input comment="Allow WireGuard Traffic" in-interface=\
    wireguard1
add action=accept chain=forward comment="Allow WireGuard Routing" \
    src-address=192.168.89.0/24
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat out-interface=wireguard1 \
    to-addresses=192.168.88.1
add action=masquerade chain=srcnat disabled=yes comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

anav · Tue Dec 17, 2024 5:12 pm

HOME DEVICE:

1. MAIN Problem is the allowed IPs on the peer settings for the HAP.
The allowed IPs is to indentify the client peer by its wireguard IP address, and also
a. any subnets that are going to hit your router
b. any subnets on the other device that local users will need to reach.

SO REPLACE WITH:
add allowed-address=192.168.89.11/32,192.168.88.0/24 interface=VPN name="Mikrotik hAP" public-key=\
"mypublickey"

2. Modify
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=VPN list=LAN
add comment=defconf interface=ether1 list=WAN

3. OTHER PROBLEMS you need to address the separate subnet you have which seems to be attached to ether2. SO.
a. remove ether2 from the bridge
b. assign the correct subnet address to the bridge not ether2.
add address=192.168.13.1/24 interface=bridge network=192.168.13.0

4. Remove mangle rule, not required!!

5. Firewall rules need works! order and keep chains together.

/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input comment="Allow WireGuard" dst-port=13129 protocol=udp
add action=accept chain=input comment="Allow WireGuard Traffic" src-address=192.168.89.0/24
add action=drop chain=input in-interface-list=WAN
++++++++++++++++++++++++++++++++++++++++
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward comment="internet traffic" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="admin access" in-interface-list=AUTHORIZED out-interface-list=LAN
add action=accept chain=forward comment="wireguard users to subnet ?????" if so then, in-interface=VPN dst-address=?????
add action=accept chain=forward comment="port forwarding" connection-nat-state=dstnat disabled=yes { enable or remove if not required }
add action=drop chain=forward comment="drop all else"

6. Missing DHCP server for the office!

7. Remove the address list and whatever doing with fasstrack...........
Instead use only for admin access to the router like so.
Especially as you may not need ALL the wireguard users to have access to config the router and you dont need ALL users to have access to the router for config purposes (input chain).
THUS:
/ip firewall address-list
add address=192.168.89.11/32 list=AUTHORIZED comment="remote admin hap"
add address=(any other admin wireguard device) list=AUTHORIZED comment="remote admin smartphone"
etc.
add address=LANIP address1 list=A\UTHORIZED comment="local admin device1"
add address=LANIP address2 list=AUTHORIZED comment="local admin device2"
etc.

AND FIREWALL INPUT CHAIN LOOKS LIKE:
/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input comment="WireGuard handshake" dst-port=13129 protocol=udp
add action=accept chain=input comment="admin access" src-address-list=AUTHORIZED
add action=accept chain=input comment="users to services" in-interface-list=LAN dst-port=53 protocol=udp
add action=accept chain=input comment="users to services" in-interface-list=LAN dst-port=53 protocol=tcp
add action=drop chain=input comment="Drop all else" { put this last --> in after all the above and firewall address list is in place }

8. Lastly require a route for return traffic for 192.168.88.0 subnet
/ip route
add dst-address=192.168.88.0/24 gateway=VPN table=main

anav · Tue Dec 17, 2024 5:48 pm

Before addresssing the HAP. Will it be used when you are travelling, or will it be in place statically.
Just to ensure that there is not going to be any access to its subnets or devices from other remote users or from the main router as more than likely it will be you with the hap somewhere...........

galash13 · Tue Dec 17, 2024 6:37 pm

thank you anav for your response i'll try it as soon as i can have the main one on downtime one of these nights or the weekend

Before addresssing the HAP. Will it be used when you are travelling, or will it be in place statically.
Just to ensure that there is not going to be any access to its subnets or devices from other remote users or from the main router as more than likely it will be you with the hap somewhere...........

yes it's gonna be with me when im travelling!

anav · Tue Dec 17, 2024 8:05 pm

OKAY then some assumptions.
Ether5 will be an off bridge port to ensure access to the HAP. It will be the sole IP that can access the local internet wherever you are.
- Plug laptop into port 5, change IPV4 settings to 192.168.55.2
Ether2-4 will be LAN devices going out WIREGUARD for internet through home MT
WIFI2 will be LAN going out WIREGUARD for internet through home MT.
Removed static IP DNS setting.
We do not need to masquerade out WIREGUARD as we have already identified 192.168.88.0/24 as incoming on allowed IPs at MAIN router plus added the necessary route for return traffic.
Remove all lists, rules for ipv6 except what is shown below.

CHANGES MODS ONLY
/interface ethernet
set [ find default-name=ether5 ] name=OffBridge5

/routing table
add disabled=no fib name=use-wireguard

/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf disabled=yes interface=wifi1
add bridge=bridge comment=defconf interface=wifi2

/ipv6 settings
set disable-ipv6=yes

/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=192.168.55.1/29 interface=OffBridge5 network=192.168.55.0
add address=192.168.89.11/24 interface=wireguard1 network=192.168.89.0

/ip firewall filter
add action=accept chain=input comment=connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input in-interface-list=LAN
add action=drop chain=input comment="Drop all else"
+++++++++++++++++++++++++++++
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward comment="internet traffic" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="allow to tunnel" src-address=192.168.88.0/24 out-interface=wireguard1
add action=drop chain=forward comment="drop all else"

/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
add chain=dstnat action=dst-nat src-address=192.168.88.0/24 dst-port=53 protocol=udp to-address=192.168.89.1
add chain=dstnat action=dst-nat src-address=192.168.88.0/24 dst-port=53 protocol=tcp to-address=192.168.89.1

/ipv6 firewall filter
add action=drop chain=forward
add action=drop chain=input

/ip route
add dst-address=0.0.0.0/0 gateway=wireguard1 routing-table=use-wireguard

/routing rule
add action=lookup-only-in-table min-prefix=0 table=main
add action=lookup-only-in-table src-address=192.168.88.0/24 table=use-wireguard

/tool mac-server
set allowed-interface-list=NONE
/tool mac-server mac-winbox
set allowed-interface-list=LAN

++++++++++++++++++++++++++

If for some reason wireguard is not working and you need internet access you can always use etherport5. Plug laptop into port 5, change IPV4 settings to 192.168.55.2
If you need the regular traffic bridge and wan2, to use the local internet

a. disable the two dstnat rules
b. disable the two routing rules

galash13 · Wed Dec 18, 2024 11:16 am

If you need the regular traffic bridge and wan2, to use the local internet

oh no it's perfect if the wireguard is down and there's no internet, like i want it to get access to it only through the wireguard, if i need to use the local internet i'll plug into eth5. i'll let you know once i get to try it thank you!!

galash13 · Wed Dec 18, 2024 8:06 pm

ok so i had a chance to try out your suggestions:

i haven't yet tackled the missing dhcp for subnet 22, that will require me to create vlans and i had issues last time i tried so since it's not the main topic here i'll leave it for later.

i can now successfully reach my lan devices on subnet 13 from the hap, as well as the internet BUT not all websites work for some reason which is interesting, here's a list of the ones i tried:

non-reachable, connection times out:
-infomaniak.com
-instagram.com
-facebook.com
-whatsapp.com
-github.com
-bsky.app

reachable:
-microsoft.com (slower)
-forum.mikrotik.com (slow)
-amazon.com (normal)
-google.com (normal)
-youtube.com (normal)
-web.telegram.org (normal)
-apple.com (slow)

all these websites can be reached just fine if i visit them from my home network. below is the updated configs for both, i did not disable the fasttrack on the home mikrotik as my gigabit connection would be really slow otherwise. i tried disabling it just to see if it would make a difference but it did not.

on the hap this command gives an error

[user@MikroTik]> /tool mac-server set allowed-interface-list=NONE
input does not match any value of allowed-interface-list

home mikrotik config

/interface bridge
add admin-mac=C4:AD:34:89:B3:CA arp=proxy-arp auto-mac=no comment=defconf \
    name=bridge port-cost-mode=short
/interface wireguard
add listen-port=13129 mtu=1420 name=VPN
/interface vlan
add disabled=yes interface=bridge name=vlan13 vlan-id=13
add disabled=yes interface=bridge name=vlan22 vlan-id=22
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec policy group
add name=vpn
/ip ipsec profile
set [ find default=yes ] enc-algorithm=aes-256,aes-128,3des hash-algorithm=\
    sha256
add dh-group=modp1024 enc-algorithm=aes-256 hash-algorithm=sha256 name=vpn
/ip ipsec peer
add exchange-mode=ike2 name=vpn passive=yes profile=vpn
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256,sha1 enc-algorithms="aes-256-c\
    bc,aes-256-gcm,aes-192-cbc,aes-192-gcm,aes-128-cbc,aes-128-gcm,3des"
add enc-algorithms=aes-256-cbc name=vpn pfs-group=none
/ip pool
add name=dhcp ranges=192.168.13.100-192.168.13.254
add name="dhcp office" ranges=192.168.22.100-192.168.22.254
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=2d name=defconf
/ip smb users
set [ find default=yes ] disabled=yes
/port
set 0 name=serial0
/ppp profile
set *FFFFFFFE local-address=192.168.45.1
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2 \
    internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3 \
    internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4 \
    internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether5 \
    internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether6 \
    internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether7 \
    internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether8 \
    internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether9 \
    internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether10 \
    internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set max-neighbor-entries=8192
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=VPN list=LAN
/interface wireguard peers
add allowed-address=192.168.89.10/32 interface=VPN name="MacBook Air" \
    public-key="mypublickey"
add allowed-address=192.168.89.12/32 interface=VPN name="iPhone 13 mini" \
    public-key="mypublickey"
add allowed-address=192.168.89.13/32 interface=VPN name="iPad mini" \
    public-key="mypublickey"
add allowed-address=192.168.89.14/32 interface=VPN name="iPhone 13" \
    public-key="mypublickey"
add allowed-address=192.168.89.15/32 interface=VPN name="iPad 9" public-key=\
    "mypublickey"
add allowed-address=192.168.89.11/32,192.168.88.0/24 interface=VPN name=\
    "Mikrotik hAP" public-key="mypublickey"
/ip address
add address=192.168.13.1/24 interface=bridge network=192.168.13.0
add address=192.168.22.1/24 interface=bridge network=192.168.22.0
add address=192.168.89.1/24 interface=VPN network=192.168.89.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=1m
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.13.0/24 comment=personal dns-server=\
    192.168.13.1,8.8.8.8,8.8.4.4 gateway=192.168.13.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=\
    192.168.13.1,192.168.22.1,192.168.89.1,8.8.8.8,8.8.4.4
/ip firewall address-list
add address=192.168.13.100 comment="local admin mac" list=AUTHORIZED
add address=192.168.89.11 comment="remote admin hap" list=AUTHORIZED
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="Allow WireGuard Handshake" dst-port=\
    13129 protocol=udp
add action=accept chain=input comment="Allow WireGuard Traffic" src-address=\
    192.168.89.0/24
add action=accept chain=input comment="admin access" src-address-list=\
    AUTHORIZED
add action=accept chain=input comment="users to services" dst-port=53 \
    in-interface-list=LAN protocol=tcp
add action=accept chain=input comment="users to services" dst-port=53 \
    in-interface-list=LAN protocol=udp
add action=drop chain=input comment="drop all else"
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=accept chain=forward comment="internet traffic" in-interface-list=\
    LAN out-interface-list=WAN
add action=reject chain=forward comment="isolate personal subnet" \
    dst-address=192.168.22.0/24 reject-with=icmp-network-unreachable \
    src-address=192.168.13.0/24
add action=reject chain=forward comment="isolate office subnet" dst-address=\
    192.168.13.0/24 reject-with=icmp-network-unreachable src-address=\
    192.168.22.0/24
add action=accept chain=forward comment="allow to personal subnet" \
    dst-address=192.168.13.0/24 in-interface=VPN
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ip firewall service-port
set pptp disabled=yes
/ip route
add disabled=no dst-address=192.168.88.0/24 gateway=VPN routing-table=main \
    suppress-hw-offload=no
/ip smb shares
set [ find default=yes ] directory=/pub
/system clock
set time-zone-name=Europe/Rome
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

hap config

/interface bridge
add admin-mac=D4:01:C3:BC:F6:F3 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether5 ] name=OffBridge5
/interface wifi
set [ find default-name=wifi1 ] channel.band=5ghz-ax .skip-dfs-channels=\
    10min-cac .width=20/40/80mhz configuration.mode=station .ssid=\
    "iPhone 13 mini" disabled=no security.authentication-types=\
    wpa2-psk,wpa3-psk .connect-priority=0 .ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel.band=2ghz-ax .skip-dfs-channels=\
    10min-cac .width=20/40mhz configuration.mode=ap .ssid=Cherokee disabled=\
    no security.authentication-types=wpa2-psk,wpa3-psk .connect-priority=0 \
    .ft=yes .ft-over-ds=yes
/interface wireguard
add listen-port=13891 mtu=1420 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk connect-priority=0 disabled=yes \
    management-protection=allowed name="iPhone 13 mini"
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=10m name=defconf
/routing table
add disabled=no fib name=use-wireguard
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf disabled=yes interface=OffBridge5
add bridge=bridge comment=defconf disabled=yes interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=wifi1 list=WAN
add interface=wireguard1 list=LAN
/interface wifi access-list
add action=accept disabled=yes interface=wifi1 signal-range=0 ssid-regexp=\
    "iPhone 13 mini" time=0s-0s
/interface wireguard peers
add allowed-address=0.0.0.0/0 client-address=192.168.89.11/24 client-dns=\
    192.168.89.1 comment="Home Mikrotik" endpoint-address=\
    myddns.sn.mynetname.net endpoint-port=13129 interface=wireguard1 \
    persistent-keepalive=10s public-key=\
    "mypublickey"
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=192.168.89.11/24 interface=wireguard1 network=192.168.89.0
add address=192.168.55.1/29 interface=OffBridge5 network=192.168.55.0
/ip dhcp-client
add comment=defconf interface=ether1
add interface=wifi1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes servers=192.168.88.1
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="accept lan" in-interface-list=LAN
add action=drop chain=input comment="drop all else"
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=accept chain=forward comment="internet traffic" in-interface-list=\
    LAN out-interface-list=WAN
add action=accept chain=forward comment="allow to wireguard tunnel" \
    out-interface=wireguard1 src-address=192.168.88.0/24
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=53 protocol=udp src-address=\
    192.168.88.0/24 to-addresses=192.168.89.1
add action=dst-nat chain=dstnat dst-port=53 protocol=tcp src-address=\
    192.168.88.0/24 to-addresses=192.168.89.1
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=wireguard1 pref-src=\
    "" routing-table=use-wireguard suppress-hw-offload=no
/ipv6 firewall filter
add action=drop chain=forward
add action=drop chain=input
/routing rule
add action=lookup-only-in-table disabled=no min-prefix=0 table=main
add action=lookup-only-in-table disabled=no src-address=192.168.88.0/24 \
    table=use-wireguard
/system clock
set time-zone-name=Europe/Rome
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

anav · Wed Dec 18, 2024 9:14 pm

Thats because it should be lower case none, which is available as a chooseable entry.

On the hap device, add this mangle rule....... see if it helps accessing sites.
/ip firewall mangle
add action=change-mss chain=forward comment="Clamp MSS to PMTU for Outgoing packets" new-mss=clamp-to-pmtu out-interface=wireguard1 passthrough=yes protocol=tcp tcp-flags=syn

galash13 · Wed Dec 18, 2024 11:11 pm

Thats because it should be lower case none, which is available as a chooseable entry.

On the hap device, add this mangle rule....... see if it helps accessing sites.
/ip firewall mangle
add action=change-mss chain=forward comment="Clamp MSS to PMTU for Outgoing packets" new-mss=clamp-to-pmtu out-interface=wireguard1 passthrough=yes protocol=tcp tcp-flags=syn

this seems to have done it i can now access all those sites so it should be good to go! just gotta configure the vlans on the home router to add that dhcp server on the 22. thank you for all the help!

wireguard config issues

wireguard config issues

Re: wireguard config issues

Re: wireguard config issues

Re: wireguard config issues

Re: wireguard config issues

Re: wireguard config issues

Re: wireguard config issues

Re: wireguard config issues

Re: wireguard config issues