Hoy va una guía «Ultra rápida» de como configurar una VPN Site to Site con Wireguard!. Este es un laboratorio para testear las posibilidades de esta vpn.
Wireguard presume de ser más rápida, más segura y moderna que OpenVPN y sus predecesoras lo cuál me pareció una excelente excusa para hacer un laboratorio express de como configurarla.
Manos a la obra
![](https://www.nerdadas.com/blog/wp-content/uploads/2024/06/image-5-1024x431.png)
Configuramos el Router 1
[admin@MikroTik] > system/identity/set name="R1"
[admin@R1] > ip address/add interface=ether2 address=192.168.10.1/24
[admin@R1] > ip dhcp-server/setup
Select interface to run DHCP server on
dhcp server interface: ether2
Select network for DHCP addresses
dhcp address space: 192.168.10.0/24
Select gateway for given network
gateway for dhcp network: 192.168.10.1
Select pool of ip addresses given out by DHCP server
addresses to give out: 192.168.10.2-192.168.10.254
Select DNS servers
dns servers: 8.8.8.8
Select lease time
lease time: 1800
[admin@R1] > ip firewall/nat/add chain=srcnat out-interface=ether1 action=masquerade
[admin@R1] > ip dns/set servers=8.8.8.8 allow-remote-requests=yes
Configuramos el Router 2
[admin@MikroTik] > system/identity/set name="R2"
[admin@R2] > ip address/print
Flags: D - DYNAMIC
Columns: ADDRESS, NETWORK, INTERFACE
# ADDRESS NETWORK INTERFACE
0 D 192.168.122.132/24 192.168.122.0 ether1
[admin@R2] > ip address/add interface=ether2 address=192.168.20.1/24
[admin@R2] > ip dhcp-server/setup
Select interface to run DHCP server on
dhcp server interface: ether2
Select network for DHCP addresses
dhcp address space: 192.168.20.0/24
Select gateway for given network
gateway for dhcp network: 192.168.20.1
Select pool of ip addresses given out by DHCP server
addresses to give out: 192.168.20.2-192.168.20.254
Select DNS servers
dns servers: 8.8.8.8
Select lease time
lease time: 1800
[admin@R2] > ip firewall/nat/add chain=srcnat out-interface=ether1 action=masquerade
[admin@R2] > ip dns/set servers=8.8.8.8 allow-remote-requests=yes
Ahora vamos por la configuración de Wireguard.
Configuramos las ips de las interfaces de Wireguard.
#R1
ip/address add interface=wireguard1 address=10.0.0.1/30
#r2
ip/address add interface=wireguard1 address=10.0.0.2/30
Configuramos la interfaz de Wireguard en el R1
![](https://www.nerdadas.com/blog/wp-content/uploads/2024/06/image-6.png)
Configuramos la interfaz de Wireguard en el Router2
[admin@R2] > interface/wireguard/add name=»Wireguard1″ mtu=1420 listen-port=13231
Ya tenemos las dos interfaces, exportamos las claves con el botón WG Export y al descargarlas veremos algo como esto:
![](https://www.nerdadas.com/blog/wp-content/uploads/2024/06/image-7.png)
Ya que la configuración de Mikrotik nosmostrará solo la clave pública en la configuración, es necesario exportarla y esto lo hará en un texto plano. Desde files podemos descargarlos. (segundo botón sobre el archivo, descargar/Download)
![](https://www.nerdadas.com/blog/wp-content/uploads/2024/06/image-8.png)
En cada router configuraremos, en la sección de Peer los datos que ya tenemos del otro.
Les dejo este gráfico suuuuuuper fácil de leer (ouch)
![](https://www.nerdadas.com/blog/wp-content/uploads/2024/06/image-9-1024x518.png)
En el segundo Router (R1)
![](https://www.nerdadas.com/blog/wp-content/uploads/2024/06/image-10-1024x517.png)
Ahora comprobamos si funciona
![](https://www.nerdadas.com/blog/wp-content/uploads/2024/06/image-11-1024x306.png)
Y por último,igualar las rutas
![](https://www.nerdadas.com/blog/wp-content/uploads/2024/06/image-12-1024x311.png)
Para que ambos equipos sepan por donde buscar las redes ahora vecinas.
Lo que me pareció interesante de Wireguard es que podemos aplicar reglas de firewall directamente sobre la interfaz virtual donde corre o con las redes de origen y destino como si estuvieran directamente conectadas o ruteadas lo cuál hace mucho más fácil la administración.
Les dejo el lab para que lo prueben con las configs de ambos routers.
R1.rsc
# 2024-06-21 20:50:27 by RouterOS 7.14.2
# software id =
#
/disk
set slot1 slot=slot1
set slot2 slot=slot2
/interface ethernet
set [ find default-name=ether1 ] disable-running-check=no
set [ find default-name=ether2 ] disable-running-check=no
set [ find default-name=ether3 ] disable-running-check=no
set [ find default-name=ether4 ] disable-running-check=no
set [ find default-name=ether5 ] disable-running-check=no
set [ find default-name=ether6 ] disable-running-check=no
set [ find default-name=ether7 ] disable-running-check=no
set [ find default-name=ether8 ] disable-running-check=no
set [ find default-name=ether9 ] disable-running-check=no
set [ find default-name=ether10 ] disable-running-check=no
set [ find default-name=ether11 ] disable-running-check=no
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/ip pool
add name=dhcp_pool0 ranges=192.168.10.2-192.168.10.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=ether2 name=dhcp1
/port
set 0 name=serial0
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=192.168.122.132 endpoint-port=\
13231 interface=wireguard1 private-key=\
"YMGmwgpl0Ilbdo8Nd1W0kYzBLhkOlSVmz+RMpzA05Fk=" public-key=\
"UPXhsQ6KTsd3D4IjWxgEl20E9PszrPjLdrjWdayOZCg="
/ip address
add address=192.168.10.1/24 comment=LAN interface=ether2 network=192.168.10.0
add address=10.0.0.1/30 comment=Wireguard interface=wireguard1 network=\
10.0.0.0
/ip dhcp-client
add interface=ether1
/ip dhcp-server network
add address=192.168.10.0/24 dns-server=8.8.8.8 gateway=192.168.10.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
/ip route
add disabled=no dst-address=192.168.20.0/24 gateway=10.0.0.2 routing-table=\
main suppress-hw-offload=no
/system identity
set name=R1
/system note
set show-at-login=no
R2.rsc
# 2024-06-21 20:50:09 by RouterOS 7.14.2
# software id =
#
/disk
set slot1 slot=slot1
set slot2 slot=slot2
/interface ethernet
set [ find default-name=ether1 ] disable-running-check=no
set [ find default-name=ether2 ] disable-running-check=no
set [ find default-name=ether3 ] disable-running-check=no
set [ find default-name=ether4 ] disable-running-check=no
set [ find default-name=ether5 ] disable-running-check=no
set [ find default-name=ether6 ] disable-running-check=no
set [ find default-name=ether7 ] disable-running-check=no
set [ find default-name=ether8 ] disable-running-check=no
set [ find default-name=ether9 ] disable-running-check=no
set [ find default-name=ether10 ] disable-running-check=no
set [ find default-name=ether11 ] disable-running-check=no
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/ip pool
add name=dhcp_pool0 ranges=192.168.20.2-192.168.20.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=ether2 name=dhcp1
/port
set 0 name=serial0
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=192.168.122.98 endpoint-port=\
13231 interface=wireguard1 private-key=\
«OFP9S3TqsImwljhppgdJZ5+RE+Q0RKBsy/49j+YsRUI=» public-key=\
«RnmWHd5QmNJSHEbme5cuOefFnU39utXpiqezUJaJfDQ=»
/ip address
add address=192.168.20.1/24 comment=LAN interface=ether2 network=192.168.20.0
add address=10.0.0.2/30 comment=Wireguard interface=wireguard1 network=\
10.0.0.0
/ip dhcp-client
add interface=ether1
/ip dhcp-server network
add address=192.168.20.0/24 dns-server=8.8.8.8 gateway=192.168.20.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
/ip route
add disabled=no dst-address=192.168.10.0/24 gateway=10.0.0.1 routing-table=\
main suppress-hw-offload=no
/system identity
set name=R2
/system note
set show-at-login=no
Hola buenos días,
Felicidades por el blog, contenido super interesante y util !
Tengo algunas dudas:
Quiero testear con mis 3 oficinas, cada una de ellas tiene router de compañía (vodafone, movistar, orange), para hacer SITE-SITE he de colgar el router Mirkotik como router pasivo del router de la operadora.
Es viable esto ?