Cannot reach Mikrotik wireguard server

blackoutfolo · Thu Feb 23, 2023 10:01 pm

Cannot reach wireguard server.

Good morning. I can't connect to the newly created wireguard server. Should we make a port forward of 13231? If yes, how ?
I followed this tutorial: https://systemzone.net/wireguard-vpn-se ... indows-os/

# feb/23/2023 19:57:15 by RouterOS 7.7
# software id = UUHP-GLJA
#
# model = RBD52G-5HacD2HnD
# serial number = HCY087NN590
/interface wireless
set [ find default-name=wlan1 ] ssid=MikroTik
set [ find default-name=wlan2 ] ssid=MikroTik
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=dhcp_pool1 ranges=192.168.50.2-192.168.50.254
/ip dhcp-server
add address-pool=dhcp_pool1 interface=ether5 name=dhcp1
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface ovpn-server server
set auth=sha1,md5
/interface wireguard peers
add allowed-address=192.168.30.5/32 interface=wireguard1 public-key=\
    "XxXxXfBB42Rf8Jx/taF0JX2Ng44gCjoXxXxXxXxXxX="
/ip address
add address=192.168.50.1/24 interface=ether5 network=192.168.50.0
add address=192.168.1.15/24 interface=ether1 network=192.168.1.0
add address=192.168.30.1/24 interface=wireguard1 network=192.168.30.0
/ip dhcp-client
add disabled=yes interface=ether1
/ip dhcp-server network
add address=192.168.50.0/24 gateway=192.168.50.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,1.1.1.1
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
/ip route
add check-gateway=ping disabled=no dst-address=0.0.0.0/0 gateway=\
    192.168.1.254
/system routerboard settings
set cpu-frequency=716MHz

Thu Feb 23, 2023 10:11 pm

Depends on what device you use from your ISP.
That's where the port forward needs to be done.

pe1chl · Thu Feb 23, 2023 10:14 pm

How did you get your config so messed up? Did that tutorial tell you to remove the entire firewall?
Well, at least the firewall is not the cause of the problen, but not having a firewall will be the cause of a lot of trouble for you!
When I tutorial instructs you to empty the firewall filter list (and some of them do), discard it for the maker being clueless.

blackoutfolo · Thu Feb 23, 2023 10:21 pm

This is a trial router. It's not my main router. I did not put a firewall to be sure that nothing was blocking wireguard. Once the problem is solved I will do the firewall as it should be.

pe1chl · Thu Feb 23, 2023 10:24 pm

I hope it is not too late by then, your router being hacked and/or your provider having disconnected you for having an open DNS resolver...

anav · Thu Feb 23, 2023 10:26 pm

Why are you here.............. shouldnt you complain to or ask for support from the authors of your demise systemzone!!

blackoutfolo · Thu Feb 23, 2023 10:28 pm

I hope it is not too late by then, your router being hacked and/or your provider having disconnected you for having an open DNS resolver...

Ok. But have you solution for me ? Do you know why i can't connect to the wireguard server?

blackoutfolo · Thu Feb 23, 2023 10:31 pm

Why are you here.............. shouldnt you complain to or ask for support from the authors of your demise systemzone!!

So you're not going to help me ?

Thu Feb 23, 2023 10:37 pm

I hope it is not too late by then, your router being hacked and/or your provider having disconnected you for having an open DNS resolver...
Ok. But have you solution for me ? Do you know why i can't connect to the wireguard server?

Did you even read what I wrote ?
Check your ISP modem. Is that port being forwarded ??
If not, you can wait until Easter and Christmas fall on the same day.

Best to start clean WITH DEFAULT FIREWALL and then add the wireguard config again.
Add a firewall input rule for that one wireguard port (move it before the drop rule for the input chain) and see if the counter starts increasing when you try to start the tunnel.
Then you can troubleshoot further.

blackoutfolo · Thu Feb 23, 2023 10:45 pm

Port 13231 was already fowarded on my isp router. But don't know verry well how to port foward 13231 since it's a double nat. Please can you give me a script to foward 13231 on Mikrotik ?

pe1chl · Thu Feb 23, 2023 11:03 pm

You should not forward it on the MikroTik. It is input for the MikroTik.

anav · Thu Feb 23, 2023 11:36 pm

The input chain is traffic to and fro the router, the brains, or the router services so to speak, vpn handshake being one of them.
The forward chain is for traffic through the router WAN to LAN, LAN to LAN, LAN to WAN, VPN TO LAN, LAN TO VPN etc..
As was stated,
netinstall a clean version of software and dont monkey with any rules you are not sure of, add wireguard and we can go from there to get wireguard working.

A network diagram helps

blackoutfolo · Fri Feb 24, 2023 12:57 am

netinstall a clean version of software and dont monkey with any rules you are not sure of, add wireguard and we can go from there to get wireguard working.

Tank you. I already started with clean version without any rules
I hope this diagram will help:

anav · Fri Feb 24, 2023 1:04 am

You want to start with a clean version WITH default rules........ if thats what you mean by without any rules, aka rules that you made/changed.

blackoutfolo · Fri Feb 24, 2023 1:28 am

You want to start with a clean version WITH default rules........ if thats what you mean by without any rules, aka rules that you made/changed.

Done with default ip 192.168.88.1

anav · Fri Feb 24, 2023 3:43 am

After the capsman default rule in the input chain is where you put
add chain=input action=accept dst-port=13231 protocol=udp comment="wireguard handshake"

Add your wireguard interface.... and peers ( generate public key for your client, and get public key generated by client etc.)

Ensure that in the /interface list members you add
/interface list members
add interface=ether1 list=WAN
add interface=bridge list=LAN
add interface=wireguard1 list=LAN

Add your wireguard IP address along with existing bridge address.

+++++++++++++++++++++++++
DONE you should be able to connect..........

blackoutfolo · Fri Feb 24, 2023 4:36 am

After the capsman default rule in the input chain is where you put
add chain=input action=accept dst-port=13231 protocol=udp comment="wireguard handshake" Done

Add your wireguard interface.... and peers ( generate public key for your client, and get public key generated by client etc.) Done

Ensure that in the /interface list members you add
/interface list members
add interface=ether1 list=WAN
add interface=bridge list=LAN
add interface=wireguard1 list=LAN
Done
Add your wireguard IP address along with existing bridge address. what do you mean ???

Tried and unsuccessful so far.
I don't know if it comes from there but port check on https://www.yougetsignal.com/tools/open-ports/ tells me that 13231 is closed.

pe1chl · Fri Feb 24, 2023 11:09 am

That means the problem is at your ISP or in your ISP router.
Not all ISPs do allow incoming connections.

erlinden · Fri Feb 24, 2023 11:37 am

If you are trying from a pc connected to the MikroTik...what IP do you use to connect to? Might be that the ISP modem/router does not support NAT loopback.

Can you:

Test with a smartphone? => Check the counter on your MikroTik "wireguard handshake" rule, if hit you know port forwarding and firewall rule on the MikroTik is working
Test wit your computer and use the 192.168.50.1 IP address (to see if your Wireguard is running)?

I don't know if it comes from there but port check on https://www.yougetsignal.com/tools/open-ports/ tells me that 13231 is closed.

Probably it is only testing TCP (and not UDP)

anav · Fri Feb 24, 2023 5:07 pm

Both posters bring up valid points.

A. do you have an accessible public WANIP??
B. are you being and ISP Router??
C. test from a cellular connection or from friends house.

When you enable IP cloud on the MT, is it the same WANIP your router shows under dhCP client settings and the same when you browse whats my ip?
( we dont want to see actual public IPs of course, for security reasons )

blackoutfolo · Fri Feb 24, 2023 7:40 pm

Hello,

Now the fiber ONT is connect directly to my MT. No more additional router between MT and ISP
The public ip under dhcp client is the same that ip/cloud and i can use ddns or public ip outside the house to reach MT.
I can port forward ftp server on my computer but can't port forward service on MT such as wireguard.
Can somebody please send me script for port forward 13231 udp ?
********************************************************************************************************************

Test with a smartphone? => Check the counter on your MikroTik "wireguard handshake" rule, if hit you know port forwarding and firewall rule on the MikroTik is working

The counter on my MikroTik "wireguard handshake" show packet increase when i connect my windows wg client with my public ip as well as my local ip 88.1 but wireguard itself show 0 packet tx rx.
Windows wg client show tx packet increase but rx is still 0.
Maybe it not port forward problem after all.

Fri Feb 24, 2023 8:10 pm

If your router is directly connected to fiber, no need anymore to port forward.
You're at the router where you need to be .
Counters going up is a good thing. Shows there is incoming traffic.
Tx counters will always go up since wireguard will always try to send.
It is only when you see rx moving that you know it works.

Are you sure the private and public key pairs have been set correctly on both ends ?

anav · Fri Feb 24, 2023 9:10 pm

You are a bit slow, THERE IS NO PORT FORWARD ON THE MIKROTIK to wireguard. This was noted by the first person who responded as well as myself explained later.
You really need to pay attention!!!

I already TOLD you where to put the necessary INPUT CHAIN rule for the wireguard rule!, input chain= for router services...............

blackoutfolo · Sat Feb 25, 2023 12:43 am

Problem Solved. Wrong public key at the wrong place. Thank you everyone. Sorry I should have paid more attention.

anav · Sat Feb 25, 2023 6:47 am

Good to hear you got it up and running............ Always a good idea to measure twice and cut once or something like that!

Cannot reach Mikrotik wireguard server

Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server

Re: Cannot reach Mikrotik wireguard server