Skip to content

Instantly share code, notes, and snippets.

@yradunchev

yradunchev/mikrotik wg vpn

Last active April 30, 2023 13:20
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save yradunchev/2dd505e19a5cc6fb29a390a9b13fe80a to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save yradunchev/2dd505e19a5cc6fb29a390a9b13fe80a to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. yradunchev revised this gist Apr 30, 2023. 1 changed file with 4 additions and 4 deletions.
    8 changes: 4 additions & 4 deletions mikrotik wg vpn
    View file
    Original file line number Diff line number Diff line change
    @@ -4,19 +4,19 @@
    endpoint-port=51820 interface=vpn persistent-keepalive=25s \
    public-key="<replace_with_endpoint_public_key>"

    /ip address
    /ip address \
    add address=<replace_with_vpn_client_address> interface=vpn network=<replace_with_vpn_client_address>

    /ip firewall nat
    /ip firewall nat \
    add action=masquerade chain=srcnat out-interface=vpn

    /routing table add name=wg-vpn fib

    /ip firewall mangle
    /ip firewall mangle \
    add action=mark-routing chain=prerouting comment="Device based VPN" \
    new-routing-mark=wg-vpn passthrough=yes src-address-list=device-based-vpn

    /ip firewall address-list
    /ip firewall address-list \
    add address=192.168.88.72 list=device-based-vpn

    /ip route
  2. yradunchev created this gist Apr 30, 2023.
    25 changes: 25 additions & 0 deletions mikrotik wg vpn
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,25 @@
    /interface wireguard add listen-port=51820 mtu=1420 name=vpn

    /interface wireguard peers add allowed-address=0.0.0.0/0 comment=vpn-peer endpoint-address=<replace_with_vpn_server_ip> \
    endpoint-port=51820 interface=vpn persistent-keepalive=25s \
    public-key="<replace_with_endpoint_public_key>"

    /ip address
    add address=<replace_with_vpn_client_address> interface=vpn network=<replace_with_vpn_client_address>

    /ip firewall nat
    add action=masquerade chain=srcnat out-interface=vpn

    /routing table add name=wg-vpn fib

    /ip firewall mangle
    add action=mark-routing chain=prerouting comment="Device based VPN" \
    new-routing-mark=wg-vpn passthrough=yes src-address-list=device-based-vpn

    /ip firewall address-list
    add address=192.168.88.72 list=device-based-vpn

    /ip route
    add check-gateway=none comment="wg-vpn mark" disabled=no distance=10 \
    dst-address=0.0.0.0/0 gateway=vpn pref-src="" routing-table=wg-vpn \
    scope=30 suppress-hw-offload=no target-scope=10