{"id":5418,"date":"2023-08-16T22:36:00","date_gmt":"2023-08-17T03:36:00","guid":{"rendered":"https:\/\/www.incredigeek.com\/home\/?p=5418"},"modified":"2023-08-16T22:32:48","modified_gmt":"2023-08-17T03:32:48","slug":"how-to-create-wireguard-point-to-point-between-mikrotik-routers","status":"publish","type":"post","link":"https:\/\/www.incredigeek.com\/home\/how-to-create-wireguard-point-to-point-between-mikrotik-routers\/","title":{"rendered":"How to Create WireGuard Point-to-point Between Mikrotik Routers"},"content":{"rendered":"\n<p>We&#8217;ll create a tunnel between two Mikrotik RouterOS routers.  Once we have the tunnel connected, we can then route traffic between them.<\/p>\n\n\n\n<p>Note: You can add Preshared keys, but we don&#8217;t cover that in this post, just to keep things simple.  Check out the following post if you want to add Preshared keys.<\/p>\n\n\n\n<p><a href=\"https:\/\/www.incredigeek.com\/home\/how-to-create-a-preshared-key-for-wireguard\/\" data-type=\"post\" data-id=\"5214\">How to Create a Preshared Key for Wireguard<\/a><\/p>\n\n\n\n<p>Here is how we will want our routers set up.  The WireGuard PtP IP is the IP addresses used on both ends of the tunnel.  The WAN IP is the IP of each Router.  Local IP on Host B is setup to distribute DHCP.<\/p>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-9d6595d7 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<p><strong>Host A<\/strong><\/p>\n\n\n\n<p>WAN IP: 172.16.0.1<br>WireGuard PtP IP: 10.1.1.1\/30<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<p><strong>Host B<\/strong><\/p>\n\n\n\n<p>WAN IP: 10.0.0.2<br>WireGuard PtP IP: 10.1.1.2\/30<br>Local IP: 192.168.0.1\/24<\/p>\n<\/div>\n<\/div>\n\n\n\n<p>We need Host A to be able to access Private IP&#8217;s (192.168.0.0\/24) behind Host B.<\/p>\n\n\n\n<p>We&#8217;ll pretend that the 172.16.0.1 address is a public IP, and Host B, is behind some sort of NAT network.<\/p>\n\n\n\n<p>To create the Point-to-point, or PtP, we will create a WireGuard VPN tunnel, and then add routes from Host A to Host B.<\/p>\n\n\n\n<p>For each Mikrotik we need to create a WireGuard interface, and then a peer.  One of the peers needs a keep alive if we are behind a NAT.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Wireguard Setup Overview<\/h2>\n\n\n\n<p>Here is an overview screenshot of what our WireGuard settings will look like.  Host A is on top, and Host B on the bottom.  On the left are the WireGuard interfaces, and the right contains the Peers. <\/p>\n\n\n\n<p>We copy the Public Key from the remote WireGuard interface, to the Public Key on the local Peer.  I.e. The Host_B Peer contains Host_A&#8217;s Interface Public Key and vice verse<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/08\/image-4.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"854\" src=\"https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/08\/image-4-1024x854.png\" alt=\"\" class=\"wp-image-5445\" srcset=\"https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/08\/image-4-1024x854.png 1024w, https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/08\/image-4-300x250.png 300w, https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/08\/image-4-768x640.png 768w, https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/08\/image-4-360x300.png 360w, https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/08\/image-4.png 1232w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Host A<\/h2>\n\n\n\n<p>If you want to, you can use the WinBox GUI to setup and configure the router.<\/p>\n\n\n\n<p>Create the WireGuard interface<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"> \/interface\/wireguard\/add name=wireguard-Host_A disabled=no<\/pre>\n\n\n\n<p>Add IP address 10.1.1.1\/30 to the newly created WireGuard Interface in \/IP\/Address<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">\/ip\/address\/add address=10.1.1.1\/30 interface=wireguard-Host_A disabled=no<\/pre>\n\n\n\n<p>Create WireGuard Peer, WireGuard -> Peers<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Select the WireGuard interface, <\/li>\n\n\n\n<li>In the Allowed Addresses, put 10.1.1.0\/30 and 192.168.0.0\/24*.  <\/li>\n\n\n\n<li>Finally, put in the Public Key from Host B.  <br><em>Note that we can&#8217;t do this until we create the WireGuard Interface on Host B, so you&#8217;ll need to come back for this step<\/em>.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-preformatted\">interface\/wireguard\/peers\/add interface=wireguard-Host_A public-key=HOST_B_WG_PUBLIC_KEY allowed-address=10.1.1.0\/30,192.168.0.0\/24<\/pre>\n\n\n\n<p>Add route for 192.168.0.0\/24 to point to 10.1.1.2<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">\/ip\/route\/add dst-address=192.168.0.0\/24 gateway=10.1.1.2<\/pre>\n\n\n\n<p>*<em>The Allowed Address sets which addresses work on the other side of the tunnel.  If we don&#8217;t specify 192.168.0.0\/24, then we won&#8217;t be able to route to those addresses.  If we don&#8217;t add 10.1.1.0\/30, then our tunnel won&#8217;t work at all.  Since we only need to route to the 192.168.0.0\/24 network from the Host A side, we don&#8217;t need this IP range on Host B.<\/em><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Host B<\/h2>\n\n\n\n<p>Create the WireGuard interface, WireGuard -> Add<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"> \/interface\/wireguard\/add name=wireguard-Host_B disabled=no<\/pre>\n\n\n\n<p>Add IP address 10.1.1.2\/30 to the newly created WireGuard Interface in \/IP\/Address<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">\/ip\/address\/add address=10.1.1.2\/30 interface=wireguard-Host_B disabled=no<\/pre>\n\n\n\n<p>Create a WireGuard Peer, WireGuard -> Peers<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Select the WireGuard interface, <\/li>\n\n\n\n<li>In the Allowed Addresses, put 10.1.1.0\/30  <\/li>\n\n\n\n<li>Finally, put in the Public Key from Host A.  <\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-preformatted\">\/interface\/wireguard\/peers\/add interface=wireguard-Host_A public-key=HOST_A_WG_PUBLIC_KEY endpoint-address=172.16.0.1 endpoint-port=13231 allowed-address=10.1.1.0\/30 persistent-keepalive=00:00:30<\/pre>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p>That should be it.  Verify that there is a connection.  From Host A, ping 192.168.0.1 or any other remote device.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Troubleshooting<\/h2>\n\n\n\n<p>Unfortunately, there appear to be some wonky bugs with WireGuard on RouterOS.  It does appear to be getting better, but here are a couple things to check if the tunnel is not connecting.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Verify that the Firewall is not blocking WireGuard.  You can allow the WireGuard port in the Firewall.<\/li>\n\n\n\n<li>Try disabling and re-enabling the Interfaces and\/or Peers<\/li>\n\n\n\n<li>Verify that all the routes for the PtP are in \/ip\/routes.  If not, try manually adding the route (10.1.1.0\/30) on the WireGuard interface on both routers.<\/li>\n\n\n\n<li>Add a keep alive if a router is behind a firewall\/NAT.<\/li>\n\n\n\n<li>Reboot and or Upgrade the RouterOS version and firmware.<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>We&#8217;ll create a tunnel between two Mikrotik RouterOS routers. Once we have the tunnel connected, we can then route traffic between them. Note: You can add Preshared keys, but we don&#8217;t cover that in this post, just to keep things &hellip; <a href=\"https:\/\/www.incredigeek.com\/home\/how-to-create-wireguard-point-to-point-between-mikrotik-routers\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[452,573],"tags":[301,128,1558,1504,388,503,476,924,1559,1334],"class_list":["post-5418","post","type-post","status-publish","format-standard","hentry","category-mikrotik","category-security","tag-mikrotik","tag-networking-2","tag-point-to-point","tag-ptp","tag-routeros","tag-security","tag-tunnel","tag-vpn","tag-wg","tag-wireguard"],"_links":{"self":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/5418","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/comments?post=5418"}],"version-history":[{"count":7,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/5418\/revisions"}],"predecessor-version":[{"id":5451,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/5418\/revisions\/5451"}],"wp:attachment":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/media?parent=5418"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/categories?post=5418"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/tags?post=5418"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}