VPN Site to Site con Wireguard

Hoy va una guía «Ultra rápida» de como configurar una VPN Site to Site con Wireguard!. Este es un laboratorio para testear las posibilidades de esta vpn.
Wireguard presume de ser más rápida, más segura y moderna que OpenVPN y sus predecesoras lo cuál me pareció una excelente excusa para hacer un laboratorio express de como configurarla.

Manos a la obra

Configuramos el Router 1

[admin@MikroTik] > system/identity/set name="R1"
[admin@R1] > ip address/add interface=ether2 address=192.168.10.1/24
[admin@R1] > ip dhcp-server/setup
Select interface to run DHCP server on 

dhcp server interface: ether2
Select network for DHCP addresses 

dhcp address space: 192.168.10.0/24
Select gateway for given network 

gateway for dhcp network: 192.168.10.1
Select pool of ip addresses given out by DHCP server 

addresses to give out: 192.168.10.2-192.168.10.254
Select DNS servers 

dns servers: 8.8.8.8      
Select lease time 

lease time: 1800
[admin@R1] > ip firewall/nat/add chain=srcnat out-interface=ether1 action=masquerade 
[admin@R1] > ip dns/set servers=8.8.8.8 allow-remote-requests=yes

Configuramos el Router 2

[admin@MikroTik] > system/identity/set name="R2"
[admin@R2] > ip address/print 
Flags: D - DYNAMIC
Columns: ADDRESS, NETWORK, INTERFACE
#   ADDRESS             NETWORK        INTERFACE
0 D 192.168.122.132/24  192.168.122.0  ether1   
[admin@R2] > ip address/add interface=ether2 address=192.168.20.1/24
[admin@R2] > ip dhcp-server/setup 
Select interface to run DHCP server on 

dhcp server interface: ether2
Select network for DHCP addresses 

dhcp address space: 192.168.20.0/24
Select gateway for given network 

gateway for dhcp network: 192.168.20.1
Select pool of ip addresses given out by DHCP server 

addresses to give out: 192.168.20.2-192.168.20.254
Select DNS servers 

dns servers: 8.8.8.8      
Select lease time 

lease time: 1800
[admin@R2] > ip firewall/nat/add chain=srcnat out-interface=ether1 action=masquerade 
[admin@R2] > ip dns/set servers=8.8.8.8 allow-remote-requests=yes 

Ahora vamos por la configuración de Wireguard.

Configuramos las ips de las interfaces de Wireguard.

#R1
ip/address add interface=wireguard1 address=10.0.0.1/30
#r2
ip/address add interface=wireguard1 address=10.0.0.2/30

Configuramos la interfaz de Wireguard en el R1

Configuramos la interfaz de Wireguard en el Router2

[admin@R2] > interface/wireguard/add name=»Wireguard1″ mtu=1420 listen-port=13231

Ya tenemos las dos interfaces, exportamos las claves con el botón WG Export y al descargarlas veremos algo como esto:

Ya que la configuración de Mikrotik nosmostrará solo la clave pública en la configuración, es necesario exportarla y esto lo hará en un texto plano. Desde files podemos descargarlos. (segundo botón sobre el archivo, descargar/Download)

En cada router configuraremos, en la sección de Peer los datos que ya tenemos del otro.

Les dejo este gráfico suuuuuuper fácil de leer (ouch)

En el segundo Router (R1)

Ahora comprobamos si funciona

Y por último,igualar las rutas

Para que ambos equipos sepan por donde buscar las redes ahora vecinas.

Lo que me pareció interesante de Wireguard es que podemos aplicar reglas de firewall directamente sobre la interfaz virtual donde corre o con las redes de origen y destino como si estuvieran directamente conectadas o ruteadas lo cuál hace mucho más fácil la administración.

Les dejo el lab para que lo prueben con las configs de ambos routers.

R1.rsc

# 2024-06-21 20:50:27 by RouterOS 7.14.2
# software id = 
#
/disk
set slot1 slot=slot1
set slot2 slot=slot2
/interface ethernet
set [ find default-name=ether1 ] disable-running-check=no
set [ find default-name=ether2 ] disable-running-check=no
set [ find default-name=ether3 ] disable-running-check=no
set [ find default-name=ether4 ] disable-running-check=no
set [ find default-name=ether5 ] disable-running-check=no
set [ find default-name=ether6 ] disable-running-check=no
set [ find default-name=ether7 ] disable-running-check=no
set [ find default-name=ether8 ] disable-running-check=no
set [ find default-name=ether9 ] disable-running-check=no
set [ find default-name=ether10 ] disable-running-check=no
set [ find default-name=ether11 ] disable-running-check=no
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/ip pool
add name=dhcp_pool0 ranges=192.168.10.2-192.168.10.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=ether2 name=dhcp1
/port
set 0 name=serial0
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=192.168.122.132 endpoint-port=\
    13231 interface=wireguard1 private-key=\
    "YMGmwgpl0Ilbdo8Nd1W0kYzBLhkOlSVmz+RMpzA05Fk=" public-key=\
    "UPXhsQ6KTsd3D4IjWxgEl20E9PszrPjLdrjWdayOZCg="
/ip address
add address=192.168.10.1/24 comment=LAN interface=ether2 network=192.168.10.0
add address=10.0.0.1/30 comment=Wireguard interface=wireguard1 network=\
    10.0.0.0
/ip dhcp-client
add interface=ether1
/ip dhcp-server network
add address=192.168.10.0/24 dns-server=8.8.8.8 gateway=192.168.10.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
/ip route
add disabled=no dst-address=192.168.20.0/24 gateway=10.0.0.2 routing-table=\
    main suppress-hw-offload=no
/system identity
set name=R1
/system note
set show-at-login=no

R2.rsc

# 2024-06-21 20:50:09 by RouterOS 7.14.2

# software id =

#

/disk

set slot1 slot=slot1

set slot2 slot=slot2

/interface ethernet

set [ find default-name=ether1 ] disable-running-check=no

set [ find default-name=ether2 ] disable-running-check=no

set [ find default-name=ether3 ] disable-running-check=no

set [ find default-name=ether4 ] disable-running-check=no

set [ find default-name=ether5 ] disable-running-check=no

set [ find default-name=ether6 ] disable-running-check=no

set [ find default-name=ether7 ] disable-running-check=no

set [ find default-name=ether8 ] disable-running-check=no

set [ find default-name=ether9 ] disable-running-check=no

set [ find default-name=ether10 ] disable-running-check=no

set [ find default-name=ether11 ] disable-running-check=no

/interface wireguard

add listen-port=13231 mtu=1420 name=wireguard1

/ip pool

add name=dhcp_pool0 ranges=192.168.20.2-192.168.20.254

/ip dhcp-server

add address-pool=dhcp_pool0 interface=ether2 name=dhcp1

/port

set 0 name=serial0

/interface wireguard peers

add allowed-address=0.0.0.0/0 endpoint-address=192.168.122.98 endpoint-port=\

13231 interface=wireguard1 private-key=\

«OFP9S3TqsImwljhppgdJZ5+RE+Q0RKBsy/49j+YsRUI=» public-key=\

«RnmWHd5QmNJSHEbme5cuOefFnU39utXpiqezUJaJfDQ=»

/ip address

add address=192.168.20.1/24 comment=LAN interface=ether2 network=192.168.20.0

add address=10.0.0.2/30 comment=Wireguard interface=wireguard1 network=\

10.0.0.0

/ip dhcp-client

add interface=ether1

/ip dhcp-server network

add address=192.168.20.0/24 dns-server=8.8.8.8 gateway=192.168.20.1

/ip dns

set allow-remote-requests=yes servers=8.8.8.8

/ip firewall nat

add action=masquerade chain=srcnat out-interface=ether1

/ip route

add disabled=no dst-address=192.168.10.0/24 gateway=10.0.0.1 routing-table=\

main suppress-hw-offload=no

/system identity

set name=R2

/system note

set show-at-login=no