User Tools
networking:router:mikrotik_vpn_wg
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
networking:router:mikrotik_vpn_wg [2023/07/01 09:39] gcooper |
networking:router:mikrotik_vpn_wg [2023/07/10 10:36] (current) gcooper |
||
|---|---|---|---|
| Line 13: | Line 13: | ||
| **Road Warrior HowTo**: https:// | **Road Warrior HowTo**: https:// | ||
| - | <note tip>Note that **Windows workstations do not respond to pings by default**, but will if you temporarily disable the firewall. | + | **Why WireGuard?**: https:// |
| - | ===== Both Ends Static ===== | + | **Enable/ |
| + | |||
| + | <note tip>Note that **Windows workstations do not respond to pings by default**, but will if you temporarily disable the firewall. | ||
| ===== One End Dynamic ===== | ===== One End Dynamic ===== | ||
| Line 25: | Line 27: | ||
| ==== Server (Static IP) ==== | ==== Server (Static IP) ==== | ||
| + | === Using CLI === | ||
| + | |||
| + | < | ||
| + | # perform the next three commands only once | ||
| + | |||
| + | # allow wireguard connections to the router - move rule as needed | ||
| + | /ip firewall filter add action=accept chain=input comment=" | ||
| + | protocol=udp place-before=4 | ||
| + | |||
| + | # add a wireguard interface - name is arbitrary - select UDP listen port not blocked by all ISPs | ||
| + | /interface wireguard add comment=" | ||
| + | |||
| + | # set the address of the wireguard interface - the address is arbitrary | ||
| + | # we use a /24 netmask with peer wireguard interfaces to be assigned address in 172.16.2.0/ | ||
| + | # name must match interface name above | ||
| + | /ip address add address=172.16.2.1/ | ||
| + | |||
| + | # do the following for each remote site | ||
| + | |||
| + | # define remote wireguard peers - be sure to identify peer with comment | ||
| + | # allowed addresses are remote peer address and address ranges behind the remote peer | ||
| + | /interface wireguard peers add allowed-address=172.16.2.3/ | ||
| + | interface=wg0 persistent-keepalive=25s public-key="< | ||
| + | |||
| + | # add a route to the subnet(s) behind the remote peers | ||
| + | /ip route add comment=" | ||
| + | </ | ||
| ==== CPE (Dynamic IP) ==== | ==== CPE (Dynamic IP) ==== | ||
| Line 101: | Line 130: | ||
| # listen port probably doesn' | # listen port probably doesn' | ||
| /interface wireguard add listen-port=51820 mtu=1420 name=wireguard1 | /interface wireguard add listen-port=51820 mtu=1420 name=wireguard1 | ||
| - | |||
| - | # assign an address to the wireguard interface - will show in traceroute | ||
| - | # address choice is arbitrary - /24 used to route multiple peers of /32 | ||
| - | /ip address add address=172.16.2.3/ | ||
| # the peer is the remote side definition - server in this case | # the peer is the remote side definition - server in this case | ||
| Line 114: | Line 139: | ||
| endpoint-address=< | endpoint-address=< | ||
| persistent-keepalive=25s public-key="< | persistent-keepalive=25s public-key="< | ||
| + | |||
| + | # assign an address to the wireguard interface - will show in traceroute | ||
| + | # address choice is arbitrary - /24 used to route multiple peers of /32 | ||
| + | /ip address add address=172.16.2.3/ | ||
| # you must add a static route to the subnet(s) behind the remote peer - server in this case | # you must add a static route to the subnet(s) behind the remote peer - server in this case | ||
networking/router/mikrotik_vpn_wg.1688225941.txt.gz · Last modified: 2023/07/01 09:39 by gcooper
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
