User Tools
networking:router:mikrotik_vpn_wg
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
networking:router:mikrotik_vpn_wg [2023/07/01 09:22] gcooper |
networking:router:mikrotik_vpn_wg [2023/07/10 10:36] (current) gcooper |
||
|---|---|---|---|
| Line 13: | Line 13: | ||
| **Road Warrior HowTo**: https:// | **Road Warrior HowTo**: https:// | ||
| - | <note tip>Note that **Windows workstations do not respond to pings by default**, but will if you temporarily disable the firewall. | + | **Why WireGuard?**: https:// |
| - | ===== Both Ends Static ===== | + | **Enable/ |
| + | |||
| + | <note tip>Note that **Windows workstations do not respond to pings by default**, but will if you temporarily disable the firewall. | ||
| ===== One End Dynamic ===== | ===== One End Dynamic ===== | ||
| Line 25: | Line 27: | ||
| ==== Server (Static IP) ==== | ==== Server (Static IP) ==== | ||
| + | === Using CLI === | ||
| + | |||
| + | < | ||
| + | # perform the next three commands only once | ||
| + | |||
| + | # allow wireguard connections to the router - move rule as needed | ||
| + | /ip firewall filter add action=accept chain=input comment=" | ||
| + | protocol=udp place-before=4 | ||
| + | |||
| + | # add a wireguard interface - name is arbitrary - select UDP listen port not blocked by all ISPs | ||
| + | /interface wireguard add comment=" | ||
| + | |||
| + | # set the address of the wireguard interface - the address is arbitrary | ||
| + | # we use a /24 netmask with peer wireguard interfaces to be assigned address in 172.16.2.0/ | ||
| + | # name must match interface name above | ||
| + | /ip address add address=172.16.2.1/ | ||
| + | |||
| + | # do the following for each remote site | ||
| + | |||
| + | # define remote wireguard peers - be sure to identify peer with comment | ||
| + | # allowed addresses are remote peer address and address ranges behind the remote peer | ||
| + | /interface wireguard peers add allowed-address=172.16.2.3/ | ||
| + | interface=wg0 persistent-keepalive=25s public-key="< | ||
| + | |||
| + | # add a route to the subnet(s) behind the remote peers | ||
| + | /ip route add comment=" | ||
| + | </ | ||
| ==== CPE (Dynamic IP) ==== | ==== CPE (Dynamic IP) ==== | ||
| Line 97: | Line 126: | ||
| < | < | ||
| - | /interface wireguard | + | # the interface name is arbitrary - wg0, wg1 are common - wireguard1 is the default |
| - | add listen-port=51820 mtu=1420 name=wireguard1 | + | # the port is also arbitrary - 51820 is customary - choose UDP port not blocked by ISP |
| + | # listen port probably doesn' | ||
| + | /interface wireguard add listen-port=51820 mtu=1420 name=wireguard1 | ||
| + | # the peer is the remote side definition - server in this case | ||
| + | # allowed addresses are addresses at the remote side - server in this case | ||
| + | # the public key is the public key of the remote side - server in this case | ||
| + | # endpoint port must match remote listen port - server in this case | ||
| /interface wireguard peers | /interface wireguard peers | ||
| - | add allowed-address=172.16.2.1/ | + | add allowed-address=172.16.2.1/ |
| endpoint-address=< | endpoint-address=< | ||
| persistent-keepalive=25s public-key="< | persistent-keepalive=25s public-key="< | ||
| - | /ip route | + | # assign an address to the wireguard interface - will show in traceroute |
| - | add disabled=no dst-address=192.168.50.0/ | + | # address choice is arbitrary - /24 used to route multiple peers of /32 |
| - | | + | /ip address add address=172.16.2.3/ |
| + | |||
| + | # you must add a static | ||
| + | /ip route add disabled=no dst-address=192.168.50.0/ | ||
| + | | ||
| </ | </ | ||
networking/router/mikrotik_vpn_wg.1688224958.txt.gz · Last modified: 2023/07/01 09:22 by gcooper
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
