How to Get Connected with RouterOS - Revision history

Pancakepuppy: More formatting, massaging images and stuff

2026-08-29T04:49:19Z

More formatting, massaging images and stuff

Pancakepuppy: Formatting change

2026-08-29T04:42:13Z

Formatting change

← Older revision		Revision as of 21:42, 28 August 2026
Line 2:		Line 2:
	This step will look different depending on your router hardware, pre-existing RouterOS configuration, and home network architecture. In my case, I’m using a ''Mikrotik hAP ac2'', minimal pre-existing settings, and a home network that configures hosts via DHCP.		This step will look different depending on your router hardware, pre-existing RouterOS configuration, and home network architecture. In my case, I’m using a ''Mikrotik hAP ac2'', minimal pre-existing settings, and a home network that configures hosts via DHCP.

	Interface ''ether2'' is used for the connection onto my home network. (You’ll use whatever interface you want on your hardware.) Since this is Mikrotik router hardware with switched Ethernet ports, I will enter the '''Switch > Port Isolation''' menu to forward traffic directly to the CPU from ''~~eth''~~		Interface ''ether2'' is used for the connection onto my home network. (You’ll use whatever interface you want on your hardware.) Since this is Mikrotik router hardware with switched Ethernet ports, I will enter the '''Switch > Port Isolation''' menu to forward traffic directly to the CPU from ''ether2''.[[File:Step 1 - Port Isolation.png\|thumb\|442x442px\|RouterOS Switch Port Isolation menu\|border\|none]]Enter the '''IP > DHCP Client''' menu and create a new DHCP client to configure ''ether2''. Once a lease is obtained, a default route and interface IP address will be visible in the IP > Routes and IP > Addresses menus respectively.

	~~''er2~~''.

	[[File:Step 1 - Port Isolation.png\|thumb\|442x442px\|RouterOS Switch Port Isolation menu\|border\|none]]Enter the '''IP > DHCP Client''' menu and create a new DHCP client to configure ''ether2''. Once a lease is obtained, a default route and interface IP address will be visible in the IP > Routes and IP > Addresses menus respectively.

	[[File:Step 1 - DHCP Client.png\|thumb\|423x423px\|RouterOS DHCP Client menu\|none]]		[[File:Step 1 - DHCP Client.png\|thumb\|423x423px\|RouterOS DHCP Client menu\|none]]

Pancakepuppy: Formatting changes

2026-08-29T04:41:45Z

Formatting changes

Show changes

Pancakepuppy: Created page and added content. Version 1, please edit or submit feedback as necessary!

2026-08-29T04:36:21Z

Created page and added content. Version 1, please edit or submit feedback as necessary!

New page

=== Configure your Internet-Facing Port ===
This step will look different depending on your router hardware, pre-existing RouterOS configuration, and home network architecture. In my case, I’m using a ''Mikrotik hAP ac2'', minimal pre-existing settings, and a home network that configures hosts via DHCP.
[[File:Step 1 - DHCP Client.png|thumb|423x423px|RouterOS DHCP Client menu]]

Interface ''ether2'' is used for the connection onto my home network. (You’ll use whatever interface you want on your hardware.) Since this is Mikrotik router hardware with switched Ethernet ports, I will enter the '''Switch > Port Isolation''' menu to forward traffic directly to the CPU from ''eth''

''er2''.

[[File:Step 1 - Port Isolation.png|thumb|442x442px|RouterOS Switch Port Isolation menu]]Enter the '''IP > DHCP Client''' menu and create a new DHCP client to configure ''ether2''. Once a lease is obtained, a default route and interface IP address will be visible in the IP > Routes and IP > Addresses menus respectively.

=== Configure your WireGuard Tunnel ===
[[File:Step 2 - WireGuard Interface.png|thumb|393x393px|RouterOS WireGuard menu]]
For this step, you’ll need your WireGuard connection info from CGHMN User Services, which also require that you’ve generated public and private keys.

Open the '''WireGuard''' menu and create a new WireGuard interface. You only need to add your public and private keys in this window and can leave the listen port blank.

[[File:Step 2 - WireGuard Peer.png|thumb|459x459px|RouterOS WireGuard Peer menu]]

Navigate to the '''Peers''' tab and create a new peer. From your CGHMN User Services ‘Welcome’ e-mail, fill in the Public Key, Endpoint and Endpoint Port, Allowed Addresses, Preshared Key, Persistent Keepalive, and Client Address (which is your ‘Tunnel IP’.) Client Keepalive isn’t required but I have it set to 25 seconds.

=== Configure Your CGHMN Routed Subnet ===
Next, we’ll set up the routed subnet we were assigned. I’ve configured my subnet to assign addresses to clients with DHCP, which I’ll cover in this section as well.

[[File:Step 3 - Bridge menu.png|thumb|172x172px|RouterOS Bridge menu]]
[[File:Step 3 - Bridge Ports menu.png|thumb|243x243px|RouterOS Bridge Ports menu]]
Ports ''ether3'' through ''ether5'' have been added to a bridge named ''cghmn-lan'' in the '''Bridge''' menu.

[[File:Step 3 - IP Addresses menu.png|thumb|306x306px|RouterOS IP Addresses menu]]
In the '''IP > Addresses''' menu, create a new IP address in your routed subnet for the router to use with the bridge interface. I (PancakePuppy) have the 100.68.209.0/24 subnet and I’m going to use the first available address for my router. T his is arbitrary – it can be any address that isn’t network (.0) or broadcast (.255).

[[File:Step 3 - IP Pool menu.png|thumb|306x306px|RouterOS IP Pool menu]]
Let’s set up the DHCP Server to dynamically configure our hosts. With a protocol. First, open the '''IP > Pool''' menu and create a new pool. I’ve made a pool which covers the full remainder of my routed subnet, but you may want to leave some room for statically configured devices.

[[File:Step 3 - DHCP Networks menu.png|thumb|403x403px|RouterOS DHCP Server Networks menu]]
Open the '''IP > DHCP Server''' menu and go to the '''Networks''' tab. Create a new network and enter your routed subnet in the Address field, your router IP in Gateway, and whichever DNS servers you wish your hosts to use. I used the CGHMN Core DNS servers. Configure the other options to your preference.

[[File:Step 3 - DHCP Server menu.png|thumb|317x317px|RouterOS DHCP Server menu]]

In the '''DHCP''' tab, create a new DHCP server on your routed subnet interface and select the Address Pool we created earlier. With this created, hosts you connect to the specified interface will receive IP addresses, domain name services, and know where to send packets that want to escape the subnet.

[[File:Step 3 - DHCP Leases menu.png|thumb|476x476px|RouterOS DHCP Leases menu]]

You can view DHCP leases assigned by the server and create reservations in the '''Leases''' tab.

=== Add Routes ===
At this point, if a host sends the router a packet destined for a CGHMN address outside your subnet, it will be dropped. We need to add a few static routes so our router knows where to send CGHMN traffic.

[[File:Step 4 - Add Routes.png|thumb|715x715px|RouterOS IP Routes menu]]
Open the '''IP > Routes''' menu. You should see a few entries in the routing table already with a '''D''' flag, indicating they were dynamically (automatically) added for us. We will create 3 new routes using the Allowed IPs list to guide us and set Gateway Interface to the WireGuard interface from Step 2, ''wg1'' in this case.

=== Add Firewall Rules ===
While it may not be absolutely necessary, I like to have a few basic firewall rules for allowing incoming pings, related and established connections, and blocking everything else. I also want a rule to drop packets arriving from the tunnel interface with a destination address on my home network. I can’t imagine that happening but I’ll cover the possibility anyways.
[[File:Step 5 - Add Firewall Rules.png|thumb|787x787px|RouterOS Firewall Rules menu]]

Rules are evaluated in ascending numerical order, so make sure your final “deny everything else” rule comes last. Besides just allowing or denying traffic, firewall rules can also be used to log, create address lists, or tarpit connections. Experimenting is part of the fun!

← Older revision		Revision as of 21:49, 28 August 2026
Line 2:		Line 2:
	This step will look different depending on your router hardware, pre-existing RouterOS configuration, and home network architecture. In my case, I’m using a ''Mikrotik hAP ac2'', minimal pre-existing settings, and a home network that configures hosts via DHCP.		This step will look different depending on your router hardware, pre-existing RouterOS configuration, and home network architecture. In my case, I’m using a ''Mikrotik hAP ac2'', minimal pre-existing settings, and a home network that configures hosts via DHCP.

	Interface ''ether2'' is used for the connection onto my home network. (You’ll use whatever interface you want on your hardware.) Since this is Mikrotik router hardware with switched Ethernet ports, I will enter the '''Switch > Port Isolation''' menu to forward traffic directly to the CPU from ''ether2''.[[File:Step 1 - Port Isolation.png\|thumb\|~~442x442px~~\|RouterOS Switch Port Isolation menu~~\|border~~\|none]]Enter the '''IP > DHCP Client''' menu and create a new DHCP client to configure ''ether2''. Once a lease is obtained, a default route and interface IP address will be visible in the IP > Routes and IP > Addresses menus respectively.		Interface ''ether2'' is used for the connection onto my home network. (You’ll use whatever interface you want on your hardware.) Since this is Mikrotik router hardware with switched Ethernet ports, I will enter the '''Switch > Port Isolation''' menu to forward traffic directly to the CPU from ''ether2''.[[File:Step 1 - Port Isolation.png\|thumb\|701x701px\|RouterOS Switch Port Isolation menu\|none]]Enter the '''IP > DHCP Client''' menu and create a new DHCP client to configure ''ether2''. Once a lease is obtained, a default route and interface IP address will be visible in the IP > Routes and IP > Addresses menus respectively.

	[[File:Step 1 - DHCP Client.png\|thumb\|~~423x423px~~\|RouterOS DHCP Client menu\|none]]		[[File:Step 1 - DHCP Client.png\|thumb\|697x697px\|RouterOS DHCP Client menu\|none]]
	=== Configure your WireGuard Tunnel ===		=== Configure your WireGuard Tunnel ===
	For this step, you’ll need your WireGuard connection info from CGHMN User Services, which also require that you’ve generated public and private keys.		For this step, you’ll need your WireGuard connection info from CGHMN User Services, which also require that you’ve generated public and private keys.

	[[File:Step 2 - WireGuard Interface.png\|thumb\|~~393x393px~~\|RouterOS WireGuard menu\|none]]Open the '''WireGuard''' menu and create a new WireGuard interface. You only need to add your public and private keys in this window and can leave the listen port blank.		[[File:Step 2 - WireGuard Interface.png\|thumb\|605x605px\|RouterOS WireGuard menu\|none]]Open the '''WireGuard''' menu and create a new WireGuard interface. You only need to add your public and private keys in this window and can leave the listen port blank.

	[[File:Step 2 - WireGuard Peer.png\|thumb\|~~459x459px~~\|RouterOS WireGuard Peer menu\|none]]Navigate to the '''Peers''' tab and create a new peer. From your CGHMN User Services ‘Welcome’ e-mail, fill in the Public Key, Endpoint and Endpoint Port, Allowed Addresses, Preshared Key, Persistent Keepalive, and Client Address (which is your ‘Tunnel IP’.) Client Keepalive isn’t required but I have it set to 25 seconds.		[[File:Step 2 - WireGuard Peer.png\|thumb\|738x738px\|RouterOS WireGuard Peer menu\|none]]Navigate to the '''Peers''' tab and create a new peer. From your CGHMN User Services ‘Welcome’ e-mail, fill in the Public Key, Endpoint and Endpoint Port, Allowed Addresses, Preshared Key, Persistent Keepalive, and Client Address (which is your ‘Tunnel IP’.) Client Keepalive isn’t required but I have it set to 25 seconds.

	=== Configure Your CGHMN Routed Subnet ===		=== Configure Your CGHMN Routed Subnet ===
	Next, we’ll set up the routed subnet we were assigned. I’ve configured my subnet to assign addresses to clients with DHCP, which I’ll cover in this section as well.		Next, we’ll set up the routed subnet we were assigned. I’ve configured my subnet to assign addresses to clients with DHCP, which I’ll cover in this section as well.

	Ports ''ether3'' through ''ether5'' have been added to a bridge named ''cghmn-lan'' in the '''Bridge''' menu.[[File:Step 3 - Bridge menu.png~~\|thumb\|172x172px~~\|RouterOS Bridge menu\|none]]		Ports ''ether3'' through ''ether5'' have been added to a bridge named ''cghmn-lan'' in the '''Bridge''' menu.[[File:Step 3 - Bridge menu.png\|RouterOS Bridge menu\|none\|frame]]
	[[File:Step 3 - Bridge Ports menu.png\|thumb\|~~243x243px~~\|RouterOS Bridge Ports menu\|none]]		[[File:Step 3 - Bridge Ports menu.png\|thumb\|407x407px\|RouterOS Bridge Ports menu\|none]]

	In the '''IP > Addresses''' menu, create a new IP address in your routed subnet for the router to use with the bridge interface. I (PancakePuppy) have the 100.68.209.0/24 subnet and I’m going to use the first available address for my router. T his is arbitrary – it can be any address that isn’t network (.0) or broadcast (.255).		In the '''IP > Addresses''' menu, create a new IP address in your routed subnet for the router to use with the bridge interface. I (PancakePuppy) have the 100.68.209.0/24 subnet and I’m going to use the first available address for my router. T his is arbitrary – it can be any address that isn’t network (.0) or broadcast (.255).
	[[File:Step 3 - IP Addresses menu.png\|thumb\|~~306x306px~~\|RouterOS IP Addresses menu\|none]]		[[File:Step 3 - IP Addresses menu.png\|thumb\|538x538px\|RouterOS IP Addresses menu\|none]]

	Let’s set up the DHCP Server to dynamically configure our hosts. With a protocol. First, open the '''IP > Pool''' menu and create a new pool. I’ve made a pool which covers the full remainder of my routed subnet, but you may want to leave some room for statically configured devices.[[File:Step 3 - IP Pool menu.png\|thumb\|~~306x306px~~\|RouterOS IP Pool ~~menu\|none]]~~		Let’s set up the DHCP Server to dynamically configure our hosts. With a protocol. First, open the '''IP > Pool''' menu and create a new pool. I’ve made a pool which covers the full remainder of my routed subnet, but you may want to leave some room for statically configured devices.[[File:Step 3 - IP Pool menu.png\|thumb\|462x462px\|RouterOS IP Pool menu\|none]]

	Open the '''IP > DHCP Server''' menu and go to the '''Networks''' tab. Create a new network and enter your routed subnet in the Address field, your router IP in Gateway, and whichever DNS servers you wish your hosts to use. I used the CGHMN Core DNS servers. Configure the other options to your preference.[[File:Step 3 - DHCP Networks menu.png\|thumb\|403x403px\|RouterOS DHCP Server Networks menu\|none]]



	In the '''DHCP''' tab, create a new DHCP server on your routed subnet interface and select the Address Pool we created earlier. With this created, hosts you connect to the specified interface will receive IP addresses, domain name services, and know where to send packets that want to escape the subnet.[[File:Step 3 - DHCP Server menu.png\|thumb\|317x317px\|RouterOS DHCP Server menu\|none]]



	~~You can view DHCP leases assigned by the server and create reservations in the '''Leases''' tab.[[File:Step 3 - DHCP Leases menu.png\|thumb\|476x476px\|RouterOS DHCP Leases~~ menu\|none]]

			Open the '''IP > DHCP Server''' menu and go to the '''Networks''' tab. Create a new network and enter your routed subnet in the Address field, your router IP in Gateway, and whichever DNS servers you wish your hosts to use. I used the CGHMN Core DNS servers. Configure the other options to your preference.[[File:Step 3 - DHCP Networks menu.png\|thumb\|563x563px\|RouterOS DHCP Server Networks menu\|none]]

			In the '''DHCP''' tab, create a new DHCP server on your routed subnet interface and select the Address Pool we created earlier. With this created, hosts you connect to the specified interface will receive IP addresses, domain name services, and know where to send packets that want to escape the subnet.[[File:Step 3 - DHCP Server menu.png\|thumb\|672x672px\|RouterOS DHCP Server menu\|none]]

			You can view DHCP leases assigned by the server and create reservations in the '''Leases''' tab.[[File:Step 3 - DHCP Leases menu.png\|thumb\|1074x1074px\|RouterOS DHCP Leases menu\|none]]
	=== Add Routes ===		=== Add Routes ===
	At this point, if a host sends the router a packet destined for a CGHMN address outside your subnet, it will be dropped. We need to add a few static routes so our router knows where to send CGHMN traffic.		At this point, if a host sends the router a packet destined for a CGHMN address outside your subnet, it will be dropped. We need to add a few static routes so our router knows where to send CGHMN traffic.

	Open the '''IP > Routes''' menu. You should see a few entries in the routing table already with a '''D''' flag, indicating they were dynamically (automatically) added for us. We will create 3 new routes using the Allowed IPs list to guide us and set Gateway Interface to the WireGuard interface from Step 2, ''wg1'' in this case.[[File:Step 4 - Add Routes.png\|thumb\|~~715x715px~~\|RouterOS IP Routes menu\|none]]		Open the '''IP > Routes''' menu. You should see a few entries in the routing table already with a '''D''' flag, indicating they were dynamically (automatically) added for us. We will create 3 new routes using the Allowed IPs list to guide us and set Gateway Interface to the WireGuard interface from Step 2, ''wg1'' in this case.[[File:Step 4 - Add Routes.png\|thumb\|784x784px\|RouterOS IP Routes menu\|none]]

	=== Add Firewall Rules ===		=== Add Firewall Rules ===
	While it may not be absolutely necessary, I like to have a few basic firewall rules for allowing incoming pings, related and established connections, and blocking everything else. I also want a rule to drop packets arriving from the tunnel interface with a destination address on my home network. I can’t imagine that happening but I’ll cover the possibility anyways.		While it may not be absolutely necessary, I like to have a few basic firewall rules for allowing incoming pings, related and established connections, and blocking everything else. I also want a rule to drop packets arriving from the tunnel interface with a destination address on my home network. I can’t imagine that happening but I’ll cover the possibility anyways.
	[[File:Step 5 - Add Firewall Rules.png\|thumb\|~~787x787px~~\|RouterOS Firewall Rules menu\|none]]		[[File:Step 5 - Add Firewall Rules.png\|thumb\|1121x1121px\|RouterOS Firewall Rules menu\|none]]


	Rules are evaluated in ascending numerical order, so make sure your final “deny everything else” rule comes last. Besides just allowing or denying traffic, firewall rules can also be used to log, create address lists, or tarpit connections. Experimenting is part of the fun!		Rules are evaluated in ascending numerical order, so make sure your final “deny everything else” rule comes last. Besides just allowing or denying traffic, firewall rules can also be used to log, create address lists, or tarpit connections. Experimenting is part of the fun!