Cursed Silicons Wiki - User contributions [en]

How to Get Connected with RouterOS

2026-08-29T04:49:19Z

Pancakepuppy: More formatting, massaging images and stuff

=== Configure your Internet-Facing Port ===
This step will look different depending on your router hardware, pre-existing RouterOS configuration, and home network architecture. In my case, I’m using a ''Mikrotik hAP ac2'', minimal pre-existing settings, and a home network that configures hosts via DHCP.

Interface ''ether2'' is used for the connection onto my home network. (You’ll use whatever interface you want on your hardware.) Since this is Mikrotik router hardware with switched Ethernet ports, I will enter the '''Switch > Port Isolation''' menu to forward traffic directly to the CPU from ''ether2''.[[File:Step 1 - Port Isolation.png|thumb|701x701px|RouterOS Switch Port Isolation menu|none]]Enter the '''IP > DHCP Client''' menu and create a new DHCP client to configure ''ether2''. Once a lease is obtained, a default route and interface IP address will be visible in the IP > Routes and IP > Addresses menus respectively.

[[File:Step 1 - DHCP Client.png|thumb|697x697px|RouterOS DHCP Client menu|none]]
=== Configure your WireGuard Tunnel ===
For this step, you’ll need your WireGuard connection info from CGHMN User Services, which also require that you’ve generated public and private keys.

[[File:Step 2 - WireGuard Interface.png|thumb|605x605px|RouterOS WireGuard menu|none]]Open the '''WireGuard''' menu and create a new WireGuard interface. You only need to add your public and private keys in this window and can leave the listen port blank.

[[File:Step 2 - WireGuard Peer.png|thumb|738x738px|RouterOS WireGuard Peer menu|none]]Navigate to the '''Peers''' tab and create a new peer. From your CGHMN User Services ‘Welcome’ e-mail, fill in the Public Key, Endpoint and Endpoint Port, Allowed Addresses, Preshared Key, Persistent Keepalive, and Client Address (which is your ‘Tunnel IP’.) Client Keepalive isn’t required but I have it set to 25 seconds.

=== Configure Your CGHMN Routed Subnet ===
Next, we’ll set up the routed subnet we were assigned. I’ve configured my subnet to assign addresses to clients with DHCP, which I’ll cover in this section as well.

Ports ''ether3'' through ''ether5'' have been added to a bridge named ''cghmn-lan'' in the '''Bridge''' menu.[[File:Step 3 - Bridge menu.png|RouterOS Bridge menu|none|frame]]
[[File:Step 3 - Bridge Ports menu.png|thumb|407x407px|RouterOS Bridge Ports menu|none]]

In the '''IP > Addresses''' menu, create a new IP address in your routed subnet for the router to use with the bridge interface. I (PancakePuppy) have the 100.68.209.0/24 subnet and I’m going to use the first available address for my router. T his is arbitrary – it can be any address that isn’t network (.0) or broadcast (.255).
[[File:Step 3 - IP Addresses menu.png|thumb|538x538px|RouterOS IP Addresses menu|none]]

Let’s set up the DHCP Server to dynamically configure our hosts. With a protocol. First, open the '''IP > Pool''' menu and create a new pool. I’ve made a pool which covers the full remainder of my routed subnet, but you may want to leave some room for statically configured devices.[[File:Step 3 - IP Pool menu.png|thumb|462x462px|RouterOS IP Pool menu|none]]

Open the '''IP > DHCP Server''' menu and go to the '''Networks''' tab. Create a new network and enter your routed subnet in the Address field, your router IP in Gateway, and whichever DNS servers you wish your hosts to use. I used the CGHMN Core DNS servers. Configure the other options to your preference.[[File:Step 3 - DHCP Networks menu.png|thumb|563x563px|RouterOS DHCP Server Networks menu|none]]

In the '''DHCP''' tab, create a new DHCP server on your routed subnet interface and select the Address Pool we created earlier. With this created, hosts you connect to the specified interface will receive IP addresses, domain name services, and know where to send packets that want to escape the subnet.[[File:Step 3 - DHCP Server menu.png|thumb|672x672px|RouterOS DHCP Server menu|none]]

You can view DHCP leases assigned by the server and create reservations in the '''Leases''' tab.[[File:Step 3 - DHCP Leases menu.png|thumb|1074x1074px|RouterOS DHCP Leases menu|none]]
=== Add Routes ===
At this point, if a host sends the router a packet destined for a CGHMN address outside your subnet, it will be dropped. We need to add a few static routes so our router knows where to send CGHMN traffic.

Open the '''IP > Routes''' menu. You should see a few entries in the routing table already with a '''D''' flag, indicating they were dynamically (automatically) added for us. We will create 3 new routes using the Allowed IPs list to guide us and set Gateway Interface to the WireGuard interface from Step 2, ''wg1'' in this case.[[File:Step 4 - Add Routes.png|thumb|784x784px|RouterOS IP Routes menu|none]]

=== Add Firewall Rules ===
While it may not be absolutely necessary, I like to have a few basic firewall rules for allowing incoming pings, related and established connections, and blocking everything else. I also want a rule to drop packets arriving from the tunnel interface with a destination address on my home network. I can’t imagine that happening but I’ll cover the possibility anyways.
[[File:Step 5 - Add Firewall Rules.png|thumb|1121x1121px|RouterOS Firewall Rules menu|none]]

Rules are evaluated in ascending numerical order, so make sure your final “deny everything else” rule comes last. Besides just allowing or denying traffic, firewall rules can also be used to log, create address lists, or tarpit connections. Experimenting is part of the fun!

How to Get Connected

2026-08-29T04:45:46Z

Pancakepuppy: Added link to RouterOS how-to page

[[Category:Compu-Global-Hyper-Mega-Net]]
This is a quick and dirty "how do I get on CGHMN"

'''Since the service is in "open beta" these steps are a bit vague and manual. But over time as we figure out what works we'll add more connection methods and better documentation'''

=== Step 1: ===
[[Signup|'''Let us know you'd like to connect!''']]

(We'll need information from you such as your WireGuard Pubkey to let you connect to the network)[[File:CGHMN.png|thumb|319x319px|Example CGHMN Router Setup using a GL-AR300M and basic network switch]]

=== Hardware requirements ===
To connect your retro machine(s) to the CGHMN, you'll need the following:
*'''An Ethernet connection on your retro device(s) of choice, with a TCP/IP (v4) stack for now! TrumpetWinSock, Microsoft TCP/IP, whatever. It all works.'''

* '''Something with the ability to run WireGuard and forward IPv4 packets at the minimum and, for any non-IP packets, <code>gretap</code> and <code>nftables</code>. Personally we recommend something running OpenWRT, like the [https://www.gl-inet.com/products/gl-ar300m GL-AR300M] which we have successfully tested to work. We're currently working on a pre-built image for some select routers to make the setup easier for new members. A script to configure already existing OpenWRT instances can be found below.'''
* Alternatively, you can also run the CGHMN routing on any standard Linux box which has at least one Ethernet port and either a second one or WiFi for internet connectivity. <s>A basic script to set up a Linux machine as a router is posted below</s> (TODO!).

* '''Optionally: A simple network switch, in case you want to add multiple machines to the network. You plug one end into the CGHMN Router box and then your clients can all access CGHMN. Super easy!'''

On the right is an example of what a CGHMN router setup could look like.

=== Get connected - With OpenWRT ===
If you chose to go with an OpenWRT compatible router or want to run OpenWRT on typical x86 hardware/in a VM, you can follow these steps to get yourself connected to the CGHMN:

# Update your OpenWRT install to the latest version to ensure all required packages are available and compatible.
# Download [https://raw.githubusercontent.com/CGHMN/openwrt-scripts/refs/heads/main/get-connected/setup-cghmn.sh this script from GitHub] to your OpenWRT router: <code>wget https://cghmn.org/get-connected.sh</code>
# Run the following commands on the router:
## <code>ash setup-cghmn.sh install-pkgs</code>
### If you run into issues at this step, please make sure you are on OpenWRT 25.12 or later - the setup script only supports version 25.12 and up.
## Reboot the router, this step is necessary if you intend to use the web UI for any other configuration or see the status of the CGHMN connection, to make LuCI recognize WireGuard connections.
## <code>ash setup-cghmn.sh init</code>
## You will be asked what network port you'd like to use for the Retro LAN. This is where you will plug in your retro machines to be part of the CGHMN. Choose a port that is not assigned to any OpenWRT interface like '''lan''' or '''wan''' or which not already part of a bridge and enter the Linux interface name, e.g. <code>eth1</code>, then press <code>[Enter]</code> to continue. If your router only has two ports and you're using one for WAN, then you first have to [https://openwrt.org/docs/guide-user/luci/luci.secure#allow_access_from_internet enable the web UI and SSH access via the '''wan''' OpenWRT interface], remove the entire '''lan''' OpenWRT interface and the default <code>br-lan</code> or any other bridge the interface might belong to, to free the network port and continue the setup over the IP address your router got on its WAN side. If you only have a single Ethernet port, you're running on a router setup we can't really recommend, however you can configure VLANs and use a managed switch to both get a WAN DHCP address for internet access and have a separate VLAN for the Retro LAN bridge over a single port. This is commonly referred to as "[[wikipedia:Router_on_a_stick|router on a stick]]". Just enter the VLAN interface name here if you choose to go that route.
# Now you will be given some information on the console, including a WireGuard public key. Head over to https://signup.cghmn.org, fill out the form there with your details like an e-mail address we can reach you under and copy over the WireGuard public key from the script output into the appropriate field on the web page. Once your request has been approved, you'll receive an e-mail with your CGHMN WireGuard connection details. Note: If you cannot copy-paste, for example, because you're on a VM VNC console, you can run <code>ash setup-cghmn.sh pubkey-qr</code> to get a QR code with your public key, which can be scanned with a phone, tablet or software QR code parser to get the key as copy-pastable text.
# In the e-mail from your sign-up server post approval, you will receive a tunnel IPv4 address (<code>100.65.x.x/32</code>) and a routed IPv4 subnet (<code>100.68.x.0/24</code> and up). These will be needed on the next step
# Run <code>ash setup-cghmn.sh set-tunnel-ip</code>, enter your new tunnel IP address with or without the <code>/32</code> subnet mask, enter your routed subnet '''with''' the CIDR netmask and supply your pre-shared key from the e-mail.
# Once the script completed successfully, reboot the router to ensure all interfaces are up properly. After the reboot, your retro devices should receive an IP address in your routed IPv4 subnet on the Retro LAN port you chose above and be able to communicate with other machines on the CGHMN network.

=== Get Connected - Manually (Linux, WireGuard/IP traffic only) ===
In case you want to setup a connection into the network manually, here are the required steps and information you should be needing:

* Generate a Wireguard private key and public key, this command writes a fresh WireGuard private key to <code>private-key</code> and the corresponding public key to <code>public-key</code>:

$ wg genkey | tee private-key | wg pubkey > public-key

* NEVER share your private key, even with us! It should never be required outside of your own WireGuard setup!
* You will, however, need to share your public key with us. Head over to https://signup.cghmn.org, fill out the forms with some details like an e-mail address we can reach you under and paste the newly generated public key into the public key field.
* After submitting your request, we'll approve it as soon as possible and you'll get two IP addresses sent over to your specified e-mail: Your tunnel IP address, with which ''your'' router talks to ''our'' router, and a routed subnet, from which you can assign IPs to your own machines so they can talk to other CGHMN member devices on the network without NAT in the way.
* In the e-mail, you will also find a full WireGuard configuration looking a little like this:

[Interface]
PrivateKey = xxx
Address = 100.65.0.xxx/32

[Peer]
PublicKey = k/QiJIbMakMKgTCHVt8/D+8k4DzRVM6U33F3gMZfRUg=
Endpoint = us.wg.cghmn.org:42070
AllowedIPs = 100.64.0.0/10
PersistentKeepalive = 15
PresharedKey = xxx

* Copy this configuration to a file, <code>wg-cghmn.conf</code>, for example.
* If you use wg-quick like below, you can also add the line <code>DNS = 100.64.12.2</code> in the [Interface] section to make use of our DNS resolvers and access other CGHMN member's services through domain names, though be adviced that we cannot guarantee public internet address lookups, which means this might break internet access for the host you're opening this WireGuard tunnel from! Alternatively, for advanced users, one can setup dnsmasq to automatically pull any domains we offer within the CGHMN and forward them to our DNS resolvers with the help of [https://raw.githubusercontent.com/CGHMN/openwrt-scripts/refs/heads/main/dns/update-dns-forwards.sh this script from our GitHub] and having it being run periodically through cron, systemd-timers or similar. See [[CGHMN DNS Information#dnsmasq Synchronization Script|this Wiki article]] for more information.
* Then, run <code>wg-quick up ./wg-cghmn.conf</code>, perhaps requiring <code>doas</code>/<code>sudo</code>, to bring the tunnel up and connect to the network!

This should bring whatever system you've set the tunnel up on onto the network and is now reachable for other members on the network, as long as the firewall on your device is configured accordingly, of course.

==== Enabling routing ====

Once you have WireGuard running and are able to reach CGHMN hosts from your Linux box, all you have to do to get the rest of your network online is enable routing in the kernel.

# echo 1 > /proc/sys/net/ipv4/conf/default/forwarding

Check your distro's docs for instructions for automatically setting sysctls on startup. On Debian, you can add this line to <code>/etc/sysctl.conf</code>:

net.ipv4.conf.default.forwarding=1

You will need to give your client machines IP addresses within your CGHMN routed subnet (provided in your welcome email) and set the gateway to the IP of the machine you're running WireGuard on. You can assign addresses manually or use a DHCP/BOOTP server. Many CGHMN users use <code>dnsmasq</code> for this; ask for help in IRC if you need it.

At present, CGHMN does not use IPv6.

=== Get Connected - With Mikrotik RouterOS ===
[[How to Get Connected with RouterOS]]

=== After you get connected ===
There are a few optional things you might want to do.

==== Network mailing list ====
There is a mailing list you can subscribe to if you want to be notified about things that may affect CGHMN or core services. You can subscribe to the list here: https://berwick-upon-tweed.cobaltqu.be/postorius/lists/cghmn-announce.lists.cobaltqu.be/.

If you need to post to the list, you will need to subscribe before you can be added to the list of poster.

==== Explore things available on the network ====
There is a collection of [[services people are running]] - things like email/hosting/chat/search/etc.

How to Get Connected with RouterOS

2026-08-29T04:42:13Z

Pancakepuppy: Formatting change

=== Configure your Internet-Facing Port ===
This step will look different depending on your router hardware, pre-existing RouterOS configuration, and home network architecture. In my case, I’m using a ''Mikrotik hAP ac2'', minimal pre-existing settings, and a home network that configures hosts via DHCP.

Interface ''ether2'' is used for the connection onto my home network. (You’ll use whatever interface you want on your hardware.) Since this is Mikrotik router hardware with switched Ethernet ports, I will enter the '''Switch > Port Isolation''' menu to forward traffic directly to the CPU from ''ether2''.[[File:Step 1 - Port Isolation.png|thumb|442x442px|RouterOS Switch Port Isolation menu|border|none]]Enter the '''IP > DHCP Client''' menu and create a new DHCP client to configure ''ether2''. Once a lease is obtained, a default route and interface IP address will be visible in the IP > Routes and IP > Addresses menus respectively.

[[File:Step 1 - DHCP Client.png|thumb|423x423px|RouterOS DHCP Client menu|none]]
=== Configure your WireGuard Tunnel ===
For this step, you’ll need your WireGuard connection info from CGHMN User Services, which also require that you’ve generated public and private keys.

[[File:Step 2 - WireGuard Interface.png|thumb|393x393px|RouterOS WireGuard menu|none]]Open the '''WireGuard''' menu and create a new WireGuard interface. You only need to add your public and private keys in this window and can leave the listen port blank.

[[File:Step 2 - WireGuard Peer.png|thumb|459x459px|RouterOS WireGuard Peer menu|none]]Navigate to the '''Peers''' tab and create a new peer. From your CGHMN User Services ‘Welcome’ e-mail, fill in the Public Key, Endpoint and Endpoint Port, Allowed Addresses, Preshared Key, Persistent Keepalive, and Client Address (which is your ‘Tunnel IP’.) Client Keepalive isn’t required but I have it set to 25 seconds.

=== Configure Your CGHMN Routed Subnet ===
Next, we’ll set up the routed subnet we were assigned. I’ve configured my subnet to assign addresses to clients with DHCP, which I’ll cover in this section as well.

Ports ''ether3'' through ''ether5'' have been added to a bridge named ''cghmn-lan'' in the '''Bridge''' menu.[[File:Step 3 - Bridge menu.png|thumb|172x172px|RouterOS Bridge menu|none]]
[[File:Step 3 - Bridge Ports menu.png|thumb|243x243px|RouterOS Bridge Ports menu|none]]

In the '''IP > Addresses''' menu, create a new IP address in your routed subnet for the router to use with the bridge interface. I (PancakePuppy) have the 100.68.209.0/24 subnet and I’m going to use the first available address for my router. T his is arbitrary – it can be any address that isn’t network (.0) or broadcast (.255).
[[File:Step 3 - IP Addresses menu.png|thumb|306x306px|RouterOS IP Addresses menu|none]]

Let’s set up the DHCP Server to dynamically configure our hosts. With a protocol. First, open the '''IP > Pool''' menu and create a new pool. I’ve made a pool which covers the full remainder of my routed subnet, but you may want to leave some room for statically configured devices.[[File:Step 3 - IP Pool menu.png|thumb|306x306px|RouterOS IP Pool menu|none]]

Open the '''IP > DHCP Server''' menu and go to the '''Networks''' tab. Create a new network and enter your routed subnet in the Address field, your router IP in Gateway, and whichever DNS servers you wish your hosts to use. I used the CGHMN Core DNS servers. Configure the other options to your preference.[[File:Step 3 - DHCP Networks menu.png|thumb|403x403px|RouterOS DHCP Server Networks menu|none]]

In the '''DHCP''' tab, create a new DHCP server on your routed subnet interface and select the Address Pool we created earlier. With this created, hosts you connect to the specified interface will receive IP addresses, domain name services, and know where to send packets that want to escape the subnet.[[File:Step 3 - DHCP Server menu.png|thumb|317x317px|RouterOS DHCP Server menu|none]]

You can view DHCP leases assigned by the server and create reservations in the '''Leases''' tab.[[File:Step 3 - DHCP Leases menu.png|thumb|476x476px|RouterOS DHCP Leases menu|none]]

=== Add Routes ===
At this point, if a host sends the router a packet destined for a CGHMN address outside your subnet, it will be dropped. We need to add a few static routes so our router knows where to send CGHMN traffic.

Open the '''IP > Routes''' menu. You should see a few entries in the routing table already with a '''D''' flag, indicating they were dynamically (automatically) added for us. We will create 3 new routes using the Allowed IPs list to guide us and set Gateway Interface to the WireGuard interface from Step 2, ''wg1'' in this case.[[File:Step 4 - Add Routes.png|thumb|715x715px|RouterOS IP Routes menu|none]]

=== Add Firewall Rules ===
While it may not be absolutely necessary, I like to have a few basic firewall rules for allowing incoming pings, related and established connections, and blocking everything else. I also want a rule to drop packets arriving from the tunnel interface with a destination address on my home network. I can’t imagine that happening but I’ll cover the possibility anyways.
[[File:Step 5 - Add Firewall Rules.png|thumb|787x787px|RouterOS Firewall Rules menu|none]]

Rules are evaluated in ascending numerical order, so make sure your final “deny everything else” rule comes last. Besides just allowing or denying traffic, firewall rules can also be used to log, create address lists, or tarpit connections. Experimenting is part of the fun!

How to Get Connected with RouterOS

2026-08-29T04:41:45Z

Pancakepuppy: Formatting changes

=== Configure your Internet-Facing Port ===
This step will look different depending on your router hardware, pre-existing RouterOS configuration, and home network architecture. In my case, I’m using a ''Mikrotik hAP ac2'', minimal pre-existing settings, and a home network that configures hosts via DHCP.

Interface ''ether2'' is used for the connection onto my home network. (You’ll use whatever interface you want on your hardware.) Since this is Mikrotik router hardware with switched Ethernet ports, I will enter the '''Switch > Port Isolation''' menu to forward traffic directly to the CPU from ''eth''

''er2''.

[[File:Step 1 - Port Isolation.png|thumb|442x442px|RouterOS Switch Port Isolation menu|border|none]]Enter the '''IP > DHCP Client''' menu and create a new DHCP client to configure ''ether2''. Once a lease is obtained, a default route and interface IP address will be visible in the IP > Routes and IP > Addresses menus respectively.

[[File:Step 1 - DHCP Client.png|thumb|423x423px|RouterOS DHCP Client menu|none]]
=== Configure your WireGuard Tunnel ===
For this step, you’ll need your WireGuard connection info from CGHMN User Services, which also require that you’ve generated public and private keys.

[[File:Step 2 - WireGuard Interface.png|thumb|393x393px|RouterOS WireGuard menu|none]]Open the '''WireGuard''' menu and create a new WireGuard interface. You only need to add your public and private keys in this window and can leave the listen port blank.

[[File:Step 2 - WireGuard Peer.png|thumb|459x459px|RouterOS WireGuard Peer menu|none]]Navigate to the '''Peers''' tab and create a new peer. From your CGHMN User Services ‘Welcome’ e-mail, fill in the Public Key, Endpoint and Endpoint Port, Allowed Addresses, Preshared Key, Persistent Keepalive, and Client Address (which is your ‘Tunnel IP’.) Client Keepalive isn’t required but I have it set to 25 seconds.

=== Configure Your CGHMN Routed Subnet ===
Next, we’ll set up the routed subnet we were assigned. I’ve configured my subnet to assign addresses to clients with DHCP, which I’ll cover in this section as well.

Ports ''ether3'' through ''ether5'' have been added to a bridge named ''cghmn-lan'' in the '''Bridge''' menu.[[File:Step 3 - Bridge menu.png|thumb|172x172px|RouterOS Bridge menu|none]]
[[File:Step 3 - Bridge Ports menu.png|thumb|243x243px|RouterOS Bridge Ports menu|none]]

In the '''IP > Addresses''' menu, create a new IP address in your routed subnet for the router to use with the bridge interface. I (PancakePuppy) have the 100.68.209.0/24 subnet and I’m going to use the first available address for my router. T his is arbitrary – it can be any address that isn’t network (.0) or broadcast (.255).
[[File:Step 3 - IP Addresses menu.png|thumb|306x306px|RouterOS IP Addresses menu|none]]

Let’s set up the DHCP Server to dynamically configure our hosts. With a protocol. First, open the '''IP > Pool''' menu and create a new pool. I’ve made a pool which covers the full remainder of my routed subnet, but you may want to leave some room for statically configured devices.[[File:Step 3 - IP Pool menu.png|thumb|306x306px|RouterOS IP Pool menu|none]]

Open the '''IP > DHCP Server''' menu and go to the '''Networks''' tab. Create a new network and enter your routed subnet in the Address field, your router IP in Gateway, and whichever DNS servers you wish your hosts to use. I used the CGHMN Core DNS servers. Configure the other options to your preference.[[File:Step 3 - DHCP Networks menu.png|thumb|403x403px|RouterOS DHCP Server Networks menu|none]]

In the '''DHCP''' tab, create a new DHCP server on your routed subnet interface and select the Address Pool we created earlier. With this created, hosts you connect to the specified interface will receive IP addresses, domain name services, and know where to send packets that want to escape the subnet.[[File:Step 3 - DHCP Server menu.png|thumb|317x317px|RouterOS DHCP Server menu|none]]

You can view DHCP leases assigned by the server and create reservations in the '''Leases''' tab.[[File:Step 3 - DHCP Leases menu.png|thumb|476x476px|RouterOS DHCP Leases menu|none]]

=== Add Routes ===
At this point, if a host sends the router a packet destined for a CGHMN address outside your subnet, it will be dropped. We need to add a few static routes so our router knows where to send CGHMN traffic.

Open the '''IP > Routes''' menu. You should see a few entries in the routing table already with a '''D''' flag, indicating they were dynamically (automatically) added for us. We will create 3 new routes using the Allowed IPs list to guide us and set Gateway Interface to the WireGuard interface from Step 2, ''wg1'' in this case.[[File:Step 4 - Add Routes.png|thumb|715x715px|RouterOS IP Routes menu|none]]

=== Add Firewall Rules ===
While it may not be absolutely necessary, I like to have a few basic firewall rules for allowing incoming pings, related and established connections, and blocking everything else. I also want a rule to drop packets arriving from the tunnel interface with a destination address on my home network. I can’t imagine that happening but I’ll cover the possibility anyways.
[[File:Step 5 - Add Firewall Rules.png|thumb|787x787px|RouterOS Firewall Rules menu|none]]

Rules are evaluated in ascending numerical order, so make sure your final “deny everything else” rule comes last. Besides just allowing or denying traffic, firewall rules can also be used to log, create address lists, or tarpit connections. Experimenting is part of the fun!

How to Get Connected with RouterOS

2026-08-29T04:36:21Z

Pancakepuppy: Created page and added content. Version 1, please edit or submit feedback as necessary!

=== Configure your Internet-Facing Port ===
This step will look different depending on your router hardware, pre-existing RouterOS configuration, and home network architecture. In my case, I’m using a ''Mikrotik hAP ac2'', minimal pre-existing settings, and a home network that configures hosts via DHCP.
[[File:Step 1 - DHCP Client.png|thumb|423x423px|RouterOS DHCP Client menu]]

Interface ''ether2'' is used for the connection onto my home network. (You’ll use whatever interface you want on your hardware.) Since this is Mikrotik router hardware with switched Ethernet ports, I will enter the '''Switch > Port Isolation''' menu to forward traffic directly to the CPU from ''eth''

''er2''.

[[File:Step 1 - Port Isolation.png|thumb|442x442px|RouterOS Switch Port Isolation menu]]Enter the '''IP > DHCP Client''' menu and create a new DHCP client to configure ''ether2''. Once a lease is obtained, a default route and interface IP address will be visible in the IP > Routes and IP > Addresses menus respectively.

=== Configure your WireGuard Tunnel ===
[[File:Step 2 - WireGuard Interface.png|thumb|393x393px|RouterOS WireGuard menu]]
For this step, you’ll need your WireGuard connection info from CGHMN User Services, which also require that you’ve generated public and private keys.

Open the '''WireGuard''' menu and create a new WireGuard interface. You only need to add your public and private keys in this window and can leave the listen port blank.

[[File:Step 2 - WireGuard Peer.png|thumb|459x459px|RouterOS WireGuard Peer menu]]

Navigate to the '''Peers''' tab and create a new peer. From your CGHMN User Services ‘Welcome’ e-mail, fill in the Public Key, Endpoint and Endpoint Port, Allowed Addresses, Preshared Key, Persistent Keepalive, and Client Address (which is your ‘Tunnel IP’.) Client Keepalive isn’t required but I have it set to 25 seconds.

=== Configure Your CGHMN Routed Subnet ===
Next, we’ll set up the routed subnet we were assigned. I’ve configured my subnet to assign addresses to clients with DHCP, which I’ll cover in this section as well.

[[File:Step 3 - Bridge menu.png|thumb|172x172px|RouterOS Bridge menu]]
[[File:Step 3 - Bridge Ports menu.png|thumb|243x243px|RouterOS Bridge Ports menu]]
Ports ''ether3'' through ''ether5'' have been added to a bridge named ''cghmn-lan'' in the '''Bridge''' menu.

[[File:Step 3 - IP Addresses menu.png|thumb|306x306px|RouterOS IP Addresses menu]]
In the '''IP > Addresses''' menu, create a new IP address in your routed subnet for the router to use with the bridge interface. I (PancakePuppy) have the 100.68.209.0/24 subnet and I’m going to use the first available address for my router. T his is arbitrary – it can be any address that isn’t network (.0) or broadcast (.255).

[[File:Step 3 - IP Pool menu.png|thumb|306x306px|RouterOS IP Pool menu]]
Let’s set up the DHCP Server to dynamically configure our hosts. With a protocol. First, open the '''IP > Pool''' menu and create a new pool. I’ve made a pool which covers the full remainder of my routed subnet, but you may want to leave some room for statically configured devices.

[[File:Step 3 - DHCP Networks menu.png|thumb|403x403px|RouterOS DHCP Server Networks menu]]
Open the '''IP > DHCP Server''' menu and go to the '''Networks''' tab. Create a new network and enter your routed subnet in the Address field, your router IP in Gateway, and whichever DNS servers you wish your hosts to use. I used the CGHMN Core DNS servers. Configure the other options to your preference.

[[File:Step 3 - DHCP Server menu.png|thumb|317x317px|RouterOS DHCP Server menu]]

In the '''DHCP''' tab, create a new DHCP server on your routed subnet interface and select the Address Pool we created earlier. With this created, hosts you connect to the specified interface will receive IP addresses, domain name services, and know where to send packets that want to escape the subnet.

[[File:Step 3 - DHCP Leases menu.png|thumb|476x476px|RouterOS DHCP Leases menu]]

You can view DHCP leases assigned by the server and create reservations in the '''Leases''' tab.

=== Add Routes ===
At this point, if a host sends the router a packet destined for a CGHMN address outside your subnet, it will be dropped. We need to add a few static routes so our router knows where to send CGHMN traffic.

[[File:Step 4 - Add Routes.png|thumb|715x715px|RouterOS IP Routes menu]]
Open the '''IP > Routes''' menu. You should see a few entries in the routing table already with a '''D''' flag, indicating they were dynamically (automatically) added for us. We will create 3 new routes using the Allowed IPs list to guide us and set Gateway Interface to the WireGuard interface from Step 2, ''wg1'' in this case.

=== Add Firewall Rules ===
While it may not be absolutely necessary, I like to have a few basic firewall rules for allowing incoming pings, related and established connections, and blocking everything else. I also want a rule to drop packets arriving from the tunnel interface with a destination address on my home network. I can’t imagine that happening but I’ll cover the possibility anyways.
[[File:Step 5 - Add Firewall Rules.png|thumb|787x787px|RouterOS Firewall Rules menu]]

Rules are evaluated in ascending numerical order, so make sure your final “deny everything else” rule comes last. Besides just allowing or denying traffic, firewall rules can also be used to log, create address lists, or tarpit connections. Experimenting is part of the fun!

File:Step 5 - Add Firewall Rules.png

2026-08-29T04:35:24Z

Pancakepuppy:

RouterOS Firewall Rules menu

File:Step 4 - Add Routes.png

2026-08-29T04:34:04Z

Pancakepuppy:

RouterOS Routes menu

File:Step 3 - DHCP Leases menu.png

2026-08-29T04:30:55Z

Pancakepuppy:

RouterOS DHCP Leases menu

File:Step 3 - DHCP Server menu.png

2026-08-29T04:30:10Z

Pancakepuppy:

RouterOS DHCP Server menu

File:Step 3 - DHCP Networks menu.png

2026-08-29T04:28:06Z

Pancakepuppy:

RouterOS DHCP Networks menu

File:Step 3 - IP Pool menu.png

2026-08-29T04:26:40Z

Pancakepuppy:

RouterOS IP Pool menu

File:Step 3 - IP Addresses menu.png

2026-08-29T04:25:46Z

Pancakepuppy:

RouterOS IP Addresses menu

File:Step 3 - Bridge Ports menu.png

2026-08-29T04:24:51Z

Pancakepuppy:

RouterOS Bridge Ports menu

File:Step 3 - Bridge menu.png

2026-08-29T04:23:58Z

Pancakepuppy:

RouterOS Bridge menu

File:Step 2 - WireGuard Peer.png

2026-08-29T04:16:46Z

Pancakepuppy:

RouterOS WireGuard Peer menu

File:Step 2 - WireGuard Interface.png

2026-08-29T04:13:07Z

Pancakepuppy:

The RouterOS WireGuard interface configuration menu

File:Step 1 - DHCP Client.png

2026-08-29T04:09:42Z

Pancakepuppy:

Shows DHCP Client configuration on RouterOS

File:Step 1 - Port Isolation.png

2026-08-29T04:06:53Z

Pancakepuppy:

Shows the RouterOS Switch Port Isolation settings