(1) Need persistent keep alive in your Peer settings so........
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=5.172.196.95 endpoint-port="proton-provided-port" interface=wireguard1 \
persistent-keep-alive=30s public-key="public_key_of_provider"
/routing table
add fib name=via-WG1
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=5.172.196.95 \
endpoint-port="proton-provided-port" interface=wireguard1 persistent-keep-alive=30s \
public-key="public_key_of_provider"
/ip dhcp-server network
add address=192.168.13.0/24 dns-server=192.168.32.1 gateway=192.168.13.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
add action=masquerade chain=srcnat out-interface=wireguard1
/ip firewall mangle
add action=change-mss chain=forward comment="Clamp MSS to PMTU for Outgoing packets" \
new-mss=clamp-to-pmtu out-interface=wireguard1 passthrough=yes protocol=tcp tcp-flags=syn
/ip route
add check-gateway=ping distance=1 dst-address=0.0.0.0/0 gateway=19.168.1.1 routing-table=main
add distance=5 dst-address=0.0.0.0/0 gateway=19.168.2.1 routing-table=main
add dst-address=0.0.0.0/0 gateway=wireguard1 routing-table=via-WG1
/routing rule
add action=lookup src-address=192.168.13.0/24 table=via-WG0
Note1: If you NEVER want your bridge LAN users to access your local WAN, if wireguard is not available then change action on routing rule to:
action=lookup-only-in-table
Note2: If you are using IP DHCP client for your two wans: Do NOT select add default route or peer DNS on IP DHCP clients.
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=5.172.196.95 endpoint-port="proton-provided-port" interface=wireguard1 \
persistent-keep-alive=30s public-key="public_key_of_provider"
/routing table
add fib name=via-WG1
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=5.172.196.95 \
endpoint-port="proton-provided-port" interface=wireguard1 persistent-keep-alive=30s \
public-key="public_key_of_provider"
/ip dhcp-server network
add address=192.168.13.0/24 dns-server=192.168.32.1 gateway=192.168.13.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
add action=masquerade chain=srcnat out-interface=wireguard1
/ip firewall mangle
add action=change-mss chain=forward comment="Clamp MSS to PMTU for Outgoing packets" \
new-mss=clamp-to-pmtu out-interface=wireguard1 passthrough=yes protocol=tcp tcp-flags=syn
/ip route
add check-gateway=ping distance=1 dst-address=0.0.0.0/0 gateway=19.168.1.1 routing-table=main
add distance=5 dst-address=0.0.0.0/0 gateway=19.168.2.1 routing-table=main
add dst-address=0.0.0.0/0 gateway=wireguard1 routing-table=via-WG1
/routing rule
add action=lookup src-address=192.168.13.0/24 table=via-WG0
Note1: If you NEVER want your bridge LAN users to access your local WAN, if wireguard is not available then change action on routing rule to:
action=lookup-only-in-table
Note2: If you are using IP DHCP client for your two wans: Do NOT select add default route or peer DNS on IP DHCP clients.
Statistics: Posted by anav — Tue Mar 12, 2024 3:38 pm