Hi together,

i try to setup a wireguard connection to another location (with help of wireguard ui).
If i try to connect from a local config (on my computer, not the router) i can connect andi it works well.

Now i setup a wireguard on my mikrotik (with if ip 18.1.1.6/30) and on the other location with 18.1.1.5/30.This is my wg-server-config:This is my peer config:I set up the route for the wg net (18.1.1.4/30 and the network of the other location) with the wg1 interface on my mikrotik.So i setup a few firewall rules to allow the wg1 interface to connect into my routeros and same for connections out of my routeros.If i try now to ping the other location i only can to WITHOUT the advanced settings (so from my mikrotik-wg-server-ip): - it worksI also can ping the other locations lan, or the devices in it:If i enter a locally LAN IP to ADVANCED from my side and try t ping the other location wg-tunnel-ip i only get timeouts:即使我尝试ping其他地方局域网an local IP out of my LAN under ADVANCED:
If i do that with an on my pc local installed wireguard and the same tunnel settings i can reach the other locations lan.
So i tried 3 weeks to figure it out but i'm not getting a solution

Is here someone who can help me?
Thanks really alot and have a nice day

Someone has an idea ?

Yes.

First, diagrams less helpful than full config
/export file=anynameyouwish ( minus router serial number and any public WANIP information or keys etc.)

1. Confirm the MT device acts as the client for the handshake, it would appear so.
2. What is at the other end of the tunnel, another MT acting as server? Third party VPN provider?
3. if not a 3rd party VPN do you have access/control over the config at the other end?

If MT, would need to see config as well.
If not MT, would need to see the wireguard settings regardless of type of server at other end.

Hiding critical parts ? What's secret on some private IP address used, except that it is imperative these ranges are 100% correct ?!

Export config's and hide only sensitive private information, but not the config details around wireguard IP, and routes.

I set up the route for the wg net (18.1.1.4/30 and the network of the other location) with the wg1 interface on my mikrotik.
3_wg_routes_wg_interface.png

Your route for the remote 192.168 subnet is wrong. Use the remote WireGuard IP Address not the interface wg1 for the route destination.

That's not it. You can use IP address as gateway, but WG doesn't really care, it decides itself where to send packets, based on peers' allowed-address.

E.g. if you'd have WG interface with 10.0.0.1/24 and two peers:

- peer1, allowed addresses 10.0.0.2, 192.168.2.0/24
- peer2, allowed addresses 10.0.0.3, 192.168.3.0/24

and you'd add route to 192.168.2.0/24 with (wrong) gateway 10.0.0.3 (address belongs to peer2), packets to 192.168.2.x would still go correctly to peer1.

Its very unclear what you are trying to do because you mix up config with requirements.

1. Provide a network diagram.
2. Clearly state in the diagram which device is client and which is server for the initial handshake.
3. what is at the other end............

Then the requirements (without mention of the config)
a. identify what users/groups of users do you have including the admin
b. identify what traffic should they be able to accomplish

Then provide the config at both ends