Mikrotik. Wireguard VPN. Mikrotik VPN Server + Clients

Description

In this article we install and configure only Wireguard tunnels.

Here we won't touch on static or dynamic routing

Input data

Server Mikrotik Wireguard

WAN - 172.16.1.2

Wireguard interface IP address - 10.10.10.1/24

Client Wireguard Mikrotik

Wireguard interface IP address - 10.10.10.2/24

Client Wireguard Windows 10

Wireguard interface IP address - 10.10.10.3/24

Server Mikrotik install and configure

Firewall accept wireguard (it may be custom) udp port

/ip firewall filter

add action=accept chain=input dst-port=1111 in-interface=ether3 protocol=udp

Interface add

/interface wireguard

add listen-port=1111 mtu=1420 name=wireguard1

IP address add

/ip address

add address=10.10.10.1/24 interface=wireguard1

Get and remember Mikrotik-Server interface's public-key (we will need it during install clients)

/interface/wireguard/print detail

    ...
    Flags: X - disabled; R - running 
    0  R name="wireguard1" mtu=1420 listen-port=1111 private-key="6N3/h46NlYqzNQr6h6Z+2tdhK4CSYxJBhy3cwolV8XY=" 
        public-key="4gBu3gbZMfgOjnTd0OhhGpi/h5wQrMi0V+XXTDwx12w="
    ...

Clients install and configure

Mikrotik-Client

Interface add

/interface wireguard

add listen-port=1111 mtu=1420 name=wireguard2

IP address add

/ip address

add address=10.10.10.2/24 interface=wireguard2

Get Mikrotik-Client's interface public key

! Now we have got client's Mikrotik-Client public-key and we can set it in the peer for this Mikrotik-Client's on the Mikrotik-Server's side !

/interface/wireguard/print detail

    ...
    Flags: X - disabled; R - running 
    0  R name="wireguard2" mtu=1420 listen-port=1111 private-key="oE96127HCyK0qiJnoojYstspVDuR0pAV0mC0LnbzjGw=" 
        public-key="xrXMoab0w4/D87YxMd1ZOd9iRJKdLQyrqY2pMVPsA0A="
    ...

Peer add (for Mikrotik-Server)

! Copy public-key from interface wireguard1 on the Mikrotik-Server's side !

/interface wireguard peers

add allowed-address=10.10.10.0/24,192.168.1.0/24 endpoint-address=172.16.1.2 endpoint-port=1111 interface=wireguard2 public-key=\

   "4gBu3gbZMfgOjnTd0OhhGpi/h5wQrMi0V+XXTDwx12w="

Windows-Client

Download and install Windows Wireguard Client

https://www.wireguard.com/install/#windows-7-8-81-10-2012-2016-2019

Add empty tunnel

! remember autogenerated public-key: 77kGQB+aEcCaFAYOOD9iOUuUSsoy+L0ex6XpdvW6eXw= !

[Interface]
PrivateKey = 6IOT1Ip/o+7FZryy+0h1JPSeMY35XvrAFTDl9ojSq1M= # autogenerated
Address = 10.10.10.3/24 # Wireguard interface IP address - 10.10.10.3/24
DNS = 77.88.8.8

[Peer]
PublicKey = 4gBu3gbZMfgOjnTd0OhhGpi/h5wQrMi0V+XXTDwx12w= # Copy public-key from Server-Mikrotik wireguard interface
AllowedIPs = 0.0.0.0/0
Endpoint = 172.16.1.2:1111 # Mikrotik-Server's WAN IP address

Mikrotik-Server

Mikrotik-Client Peer add

! Copy public-key from interface wireguard on the Mikrotik-Client's side !

/interface wireguard peers

add allowed-address=10.10.10.0/24,192.168.2.0/24 interface=wireguard1 public-key="xrXMoab0w4/D87YxMd1ZOd9iRJKdLQyrqY2pMVPsA0A="

Windows-Client Peer add

! Copy public-key from interface wireguard on the Windows-Client's side !

/interface wireguard peers

add allowed-address=10.10.10.0/24,192.168.3.0/24 interface=wireguard1 public-key="77kGQB+aEcCaFAYOOD9iOUuUSsoy+L0ex6XpdvW6eXw="

Test

Mikrotik-Server

Ping Mikrotik-Client wireguard interface IP

ping 10.10.10.2

    ...
    SEQ HOST                                     SIZE TTL TIME       STATUS                                                           
        0 10.10.10.2                                 56  64 12ms180us 
        1 10.10.10.2                                 56  64 3ms959us  
        2 10.10.10.2                                 56  64 3ms628us
    ...

Ping Windows-Client wireguard interface IP

ping 10.10.10.3

    ...
    SEQ HOST                                     SIZE TTL TIME       STATUS                                                           
        0 10.10.10.3                                 56  64 12ms180us 
        1 10.10.10.3                                 56  64 3ms959us  
        2 10.10.10.3                                 56  64 3ms628us
    ...

Mikrotik-Client

Ping Mikrotik-Server wireguard interface IP

ping 10.10.10.1

    ...  
    SEQ HOST                                     SIZE TTL TIME       STATUS                                                           
    0 10.10.10.1                                 56  64 4ms624us  
    1 10.10.10.1                                 56  64 4ms227us  
    2 10.10.10.1                                 56  64 3ms735us  
    sent=3 received=3 packet-loss=0% min-rtt=3ms735us avg-rtt=4ms195us max-rtt=4ms624us
    ...

Windows-Client

Ping Mikrotik-Server wireguard interface IP

ping 10.10.10.1

...
Ответ от 10.10.10.1: число байт=32 время=5мс TTL=64
Ответ от 10.10.10.1: число байт=32 время=5мс TTL=64
...