How to Get Connected with RouterOS
Configure your Internet-Facing Port
This step will look different depending on your router hardware, pre-existing RouterOS configuration, and home network architecture. In my case, I’m using a Mikrotik hAP ac2, minimal pre-existing settings, and a home network that configures hosts via DHCP.
Interface ether2 is used for the connection onto my home network. (You’ll use whatever interface you want on your hardware.) Since this is Mikrotik router hardware with switched Ethernet ports, I will enter the Switch > Port Isolation menu to forward traffic directly to the CPU from ether2.
Enter the IP > DHCP Client menu and create a new DHCP client to configure ether2. Once a lease is obtained, a default route and interface IP address will be visible in the IP > Routes and IP > Addresses menus respectively.
Configure your WireGuard Tunnel
For this step, you’ll need your WireGuard connection info from CGHMN User Services, which also require that you’ve generated public and private keys.
Open the WireGuard menu and create a new WireGuard interface. You only need to add your public and private keys in this window and can leave the listen port blank.
Navigate to the Peers tab and create a new peer. From your CGHMN User Services ‘Welcome’ e-mail, fill in the Public Key, Endpoint and Endpoint Port, Allowed Addresses, Preshared Key, Persistent Keepalive, and Client Address (which is your ‘Tunnel IP’.) Client Keepalive isn’t required but I have it set to 25 seconds.
Configure Your CGHMN Routed Subnet
Next, we’ll set up the routed subnet we were assigned. I’ve configured my subnet to assign addresses to clients with DHCP, which I’ll cover in this section as well.
Ports ether3 through ether5 have been added to a bridge named cghmn-lan in the Bridge menu.
In the IP > Addresses menu, create a new IP address in your routed subnet for the router to use with the bridge interface. I (PancakePuppy) have the 100.68.209.0/24 subnet and I’m going to use the first available address for my router. T his is arbitrary – it can be any address that isn’t network (.0) or broadcast (.255).
Let’s set up the DHCP Server to dynamically configure our hosts. With a protocol. First, open the IP > Pool menu and create a new pool. I’ve made a pool which covers the full remainder of my routed subnet, but you may want to leave some room for statically configured devices.
Open the IP > DHCP Server menu and go to the Networks tab. Create a new network and enter your routed subnet in the Address field, your router IP in Gateway, and whichever DNS servers you wish your hosts to use. I used the CGHMN Core DNS servers. Configure the other options to your preference.
In the DHCP tab, create a new DHCP server on your routed subnet interface and select the Address Pool we created earlier. With this created, hosts you connect to the specified interface will receive IP addresses, domain name services, and know where to send packets that want to escape the subnet.
You can view DHCP leases assigned by the server and create reservations in the Leases tab.
Add Routes
At this point, if a host sends the router a packet destined for a CGHMN address outside your subnet, it will be dropped. We need to add a few static routes so our router knows where to send CGHMN traffic.
Open the IP > Routes menu. You should see a few entries in the routing table already with a D flag, indicating they were dynamically (automatically) added for us. We will create 3 new routes using the Allowed IPs list to guide us and set Gateway Interface to the WireGuard interface from Step 2, wg1 in this case.
Add Firewall Rules
While it may not be absolutely necessary, I like to have a few basic firewall rules for allowing incoming pings, related and established connections, and blocking everything else. I also want a rule to drop packets arriving from the tunnel interface with a destination address on my home network. I can’t imagine that happening but I’ll cover the possibility anyways.
Rules are evaluated in ascending numerical order, so make sure your final “deny everything else” rule comes last. Besides just allowing or denying traffic, firewall rules can also be used to log, create address lists, or tarpit connections. Experimenting is part of the fun!