0

I'm new in the Linux world so I don't know how to do the IPtable configs. my scenario is like this: I have a MikroTik and an UBUNTU Linux server. I created a GRE Tunnel between them and it works well. I also created a Wireguard on my Linux server and I can connect to it from my windows PC. all I want now is to send all incoming traffic to my Linux server from Wireguard connection to the GRE Tunnel. i already enabled port forwarding on my Linux by setting it to 1. here is my wireguard config :

[Interface]
PrivateKey = ***************
address = 10.0.0.1/8
SaveConfig=true
PostUp=iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o gre1 -j MASQUERADE;
PostDown=iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o gre1 -j MASQUERADE;
ListenPort=51820

gre1 is my GRE tunnel interface. but my IP is the same as my Linux server's public IP

GRE LINUX IP : 11.11.11.1/24
GRE MIKROTIK IP : 11.11.11.2/24
LINUX WIREGUARD IP : 10.0.0.1/8
WINDOWS WIREGUARD IP : 10.0.0.2/8
MIKROTIK PUBLIC IP : 171.51.174.240
LINUX PUBIC IP : 71.141.34.80

thanks for your reply, but unfortunately my scenario is like this one :

pc/phone -- vpn(PPTP/WireGuard/l2tp) ---> Linux server --> GRE Tunnel --> Mikrotik Server ---> INTERNET

I can connect to the Linux server via VPN without any issues and my Linux is also connected to MikroTik via GRE Tunnel. the only problem is in the Linux server where I don't know how to route the incoming traffic from the VPNs to GRE Tunnel.

Ward - Trying Codidact
  • 12,899
  • 28
  • 46
  • 59
Fredy
  • 1
  • 1

1 Answers1

0

As far as I read the question you have the following setup:

Mikrotik <--> Linux <--> Windows

And you want to be able to connect to the Mikrotik server from you Windows machine?

It is not particularly hard, since all you have to know about is static routing.

In a nutshell what you need todo is creating two routes.

One route telling Windows which host it should connect to in order to reach the Mikrotik subnet 11.11.11.0/24 which btw is a bad subnet since it is NOT a RFC1918 ip address (aka private ip address), but rather a public ip address. Don't use this range. My suggestion would be using 10.11.0.0/24 subnet instead - or choose another one that you fancy.

Also the range /8 for the 10.0.0.0 is too big for RFC1918 (and a bit overkill!), since it can contain about 2^24 hosts.

My setup for the two tunnels is as follows:

GRE LINUX IP : 10.11.0.1/24
GRE MIKROTIK IP : 10.11.0.2/24
LINUX WIREGUARD IP : 10.0.0.1/24
WINDOWS WIREGUARD IP : 10.0.0.2/24

Using my suggestion for subnet you can do this in Windows with the command:

route add 10.11.0.0 mask 255.255.255.0 10.0.0.1

If you want the rule to survive between reboots then you add /p between the words route and add.

It is also possible that WireGuard add this route when the interface is up and delete the route when the interface is down, but I cannot remember that setting by heart.

(I am writing from a phone).

The other route you need to setup is which host the Mikrotik server should connect to in order to reach the Windows machines subnet 10.0.0.0/24.

In Linux you can create the route to Windows with the command:

ip route add 10.0.0.0/24 via 10.11.0.1

As long as ip forwarding is enabled on the Linux server then there is nothing more that needs configuring in ordercto make the Windows and Mikrotik machine talk to each other.

Lasse Michael Mølgaard
  • 947
  • 10
  • 27