User Tools
networking:router:mikrotik_vpn_wg
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
networking:router:mikrotik_vpn_wg [2023/07/01 21:18] gcooper |
networking:router:mikrotik_vpn_wg [2023/07/10 10:36] (current) gcooper |
||
|---|---|---|---|
| Line 12: | Line 12: | ||
| **Road Warrior HowTo**: https:// | **Road Warrior HowTo**: https:// | ||
| + | |||
| + | **Why WireGuard? | ||
| + | |||
| + | **Enable/ | ||
| <note tip>Note that **Windows workstations do not respond to pings by default**, but will if you temporarily disable the firewall. | <note tip>Note that **Windows workstations do not respond to pings by default**, but will if you temporarily disable the firewall. | ||
| Line 26: | Line 30: | ||
| < | < | ||
| - | # allow connections to wireguard in the firewall | + | # perform the next three commands only once |
| - | # the port must match the wireguard interface UDP listen port | + | |
| - | /ip firewall filter add action=accept chain=input comment=" | + | # allow wireguard |
| + | /ip firewall filter add action=accept chain=input comment=" | ||
| + | | ||
| # add a wireguard interface - name is arbitrary - select UDP listen port not blocked by all ISPs | # add a wireguard interface - name is arbitrary - select UDP listen port not blocked by all ISPs | ||
| - | /interface wireguard add comment=" | + | /interface wireguard add comment=" |
| + | |||
| + | # set the address of the wireguard interface - the address is arbitrary | ||
| + | # we use a /24 netmask with peer wireguard interfaces to be assigned address in 172.16.2.0/ | ||
| + | # name must match interface name above | ||
| + | /ip address add address=172.16.2.1/ | ||
| + | |||
| + | # do the following for each remote site | ||
| # define remote wireguard peers - be sure to identify peer with comment | # define remote wireguard peers - be sure to identify peer with comment | ||
| Line 37: | Line 50: | ||
| /interface wireguard peers add allowed-address=172.16.2.3/ | /interface wireguard peers add allowed-address=172.16.2.3/ | ||
| interface=wg0 persistent-keepalive=25s public-key="< | interface=wg0 persistent-keepalive=25s public-key="< | ||
| - | |||
| - | # set the address of the wireguard interface - the address is arbitrary | ||
| - | # we use a /24 netmask to include all peers - name must match interface name above | ||
| - | /ip address add address=172.16.2.1/ | ||
| # add a route to the subnet(s) behind the remote peers | # add a route to the subnet(s) behind the remote peers | ||
networking/router/mikrotik_vpn_wg.1688267898.txt.gz · Last modified: 2023/07/01 21:18 by gcooper
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
