CloudLabBox
Try the free demo

MikroTik MTCNA lab 15 of 19

WireGuard: site-to-site and remote access

Build RouterOS 7's modern VPN: a WireGuard hub at head office with a branch router and a travelling laptop as peers, keys exchanged by hand, allowed addresses doing the routing policy, routes for the remote LANs and a firewall hole for the tunnel.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 3,072 MB in total. That fits the free demo too.

In your workspace: Shared, then MikroTik MTCNA RouterOS v7 guided labs, then 15 - WireGuard - site-to-site and remote access

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 60 minutes
Nodes need
6 vCPU, 3,072 MB
Smallest plan
Lite

The scenario

An accountancy firm wants its branch office joined to head office and its partners able to reach the HQ file server from anywhere. Fernvale chooses WireGuard: fast, simple, built into RouterOS 7. HQ is the hub; the Branch router and the partner's Laptop (a RouterOS device here; on a real laptop you'd use the WireGuard app) are its peers. HQ already has an input firewall that drops everything from the Internet.

DeviceWANLANWireGuard
HQ203.0.113.2/30192.168.1.0/24 (PC-HQ .10)wg-hub 10.255.0.1/24, listens on UDP 13231
Branch198.51.100.2/30192.168.2.0/24 (PC-BR .10)wg-hq 10.255.0.2/24
Laptop192.0.2.50/24 (café)–wg-hq 10.255.0.10/24

What you’ll practise

  • Explain WireGuard keys, peers, endpoints, allowed addresses and keepalive
  • Create WireGuard interfaces and exchange public keys between routers
  • Configure a hub with two peers: a site and a road warrior
  • Route remote LANs through the tunnel
  • Open the WireGuard port in an input firewall
  • Check handshakes and traffic counters

The tasks

  1. Create the WireGuard interfaces
  2. Add the peers on the hub
  3. Point the spokes at the hub
  4. Open the door in HQ's firewall
  5. Route the LANs through the tunnel
  6. Read the tunnel state

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of WireGuard - site-to-site and remote access6 nodes, 5 links. Every link is listed as text below the diagram.ISPHQBranchLaptopPC-HQPC-BRether2eth0ether2eth0ether1ether1ether2ether1ether3ether1
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • ISP ether1 to HQ ether1
  • ISP ether2 to Branch ether1
  • ISP ether3 to Laptop ether1
  • HQ ether2 to PC-HQ eth0
  • Branch ether2 to PC-BR eth0
Nodes in WireGuard: site-to-site and remote access, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
HQMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
BranchMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
LaptopMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
PC-HQVPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
PC-BRVPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCNA RouterOS v7 guided labs.

  3. Open 15 - WireGuard - site-to-site and remote access and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MikroTik MTCNA labs

All MikroTik MTCNA labs

Related labs in other courses

CloudLabBox is independent of MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.