1

I have been trying to create a VPN tunnel, the topology is following:

Device A (Windows computer, behind NAT)
Device B (Debian 11 VPS with a public IP address)
Device C (MikroTik router that supports Wireguard, behind NAT)

I want to tunnel all the traffic on device A through the device C, and I am using the device B as a "bounce server". Here is the topology visualized: Topology

So far, I have been able to configure the VPN in a way that allows all of my devices to ping each other, but I can't route the traffic. Can please somebody explain how can I set the device B (VPS, "bounce server") to route all the traffic going from device A (Windows PC) through device C (MikroTik router)?

I want to connect to the VPN on device A (Windows PC), route all the traffic through device C (MikroTik) and appear to the outside internet to have the IP address of device C (MikroTik) - full tunnel.

The configuration files are following (PUBLIC-IP is the public IP of device B, the bounce server):

Device A (windows PC):

[Interface]
Address = 10.10.5.3/32
DNS = 1.1.1.1
PrivateKey = gO.....

[Peer]
# Name = bounce server
PublicKey = mLdpo....
AllowedIPs = 0.0.0.0/0
Endpoint = PUBLIC-IP:54321
PersistentKeepalive = 25

Device B (VPS cloud, "bounce server"):

[Interface]
  # Name = bounce server
  Address = 10.10.5.1
  ListenPort = 54321
  PrivateKey = GD...
  Table = off

  [Peer]
  # Name = Device C, MikroTik router
  AllowedIPs = 0.0.0.0/0
  PublicKey = J7...
  # PersistentKeepalive = 300

  [Peer]
  # Name = Device A - Windows PC
  AllowedIPs = 10.10.5.3/24
  PublicKey = W7..
  # PersistentKeepalive = 300

Device C (MikroTik router): Config export from MikroTik:

/interface wireguard
add listen-port=54321 name=wireguard1
/interface wireguard peers
add allowed-address=10.10.5.0/24 endpoint-address=PUBLIC-IP endpoint-port=54321 interface=wireguard1 \
    persistent-keepalive=25s public-key="mLd..."

Re-written into the classic configuration look:

[Interface]
      # Name = MikroTik
      Address = 10.10.5.2
      ListenPort = 54321
      PrivateKey = ...
    
      [Peer]
      # Name = Device B, VPS "bounce server"
      AllowedIPs = 10.10.5.0/24
      PublicKey = mLd...
      Endpoint = PUBLIC-IP:54321
      PersistentKeepalive = 25

Thanks for help!

1

1 Answer 1

1

If you need internet for example from some VPN service

/interface wireguard add listen-port=51820 name=wireguard-inet private-key="xxx" comment="Internet through WireGuard commercial VPN provider"
/interface wireguard peers add allowed-address=0.0.0.0/0 endpoint-address=xxx.xxx.xxx.xxx endpoint-port=51820 interface=wireguard-inet persistent-keepalive=25m \
    preshared-key="xxx" public-key="xxx" comment="Internet through WireGuard commercial VPN provider"
/interface list member add interface=wireguard-inet list=WAN comment="Internet through WireGuard commercial VPN provider"
###
/ip address add address=xxx.xxx.xxx.xxx/32 interface=wireguard-inet comment="Internet through WireGuard commercial VPN provider"
/routing table add name=wireguard-wan fib comment="Internet through WireGuard commercial VPN provider"
/ip route add dst-address=0.0.0.0/0 gateway=wireguard-inet routing-table=wireguard-wan comment="Internet through WireGuard commercial VPN provider"
# xxx.xxx.xxx.xxx/24 replace to your local network
/routing rule add action=lookup src-address=192.168.xxx.0/24 table=wireguard-wan comment="Internet through WireGuard commercial VPN provider"
# Add DNS from VPN service
/ip/dhcp-server/network/set dns-server=10.xxx.0.1 0
# Need to reconnect your device(PC, PHONE) for receive new DNS server from router
2
  • 1
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    May 2 at 10:43
  • It worked very well for me. I am able to reach internet through wireguard tunnel. Jun 29 at 20:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.