Recipe: reaching home or the office from the road

The goal: from your phone or laptop, reach your NAS, your cameras, your printer or your router's management as if you were sitting at home or in the office.

What you need

• A MikroTik that handles the internet traffic at that location, or at least a router in front of it in which you can forward a port.
• An address where that router can be reached: a fixed IP address, or a hostname through DDNS. Without a fixed IP, switch on IP Cloud DDNS under Management access; the router then gets a name on sn.mynetname.net.
• One UDP port that arrives from outside, 13231 by default.
• The WireGuard app on your phone or laptop. If you are not allowed to install it, see VPN for individual users.

The steps

1. Pick your device and then the VPN gateway role, which switches on IP Cloud DDNS for you. If you already have a configuration with another role, add the VPN part in the Combine step, or work in advanced under VPN.
2. Fill in the public address or hostname. It ends up in the client configuration; leave it empty and there is a placeholder there instead.
3. Go over the WireGuard interface. One is ready for you: name wg-rw, UDP port 13231, and 10.10.10.1/24 as the router address in the tunnel. You may change that range, but pick something you will not run into at home, at the office or in hotels. Leave tunnel counts as LAN on, or you cannot reach the router's management and DNS over the VPN.
4. Generate the router key pair with the button next to the key field. That happens in your browser.
5. Add a peer per device. Kind: road-warrior client. Give it a name you will recognise later (phone-marcel), let the tunnel address count up (10.10.10.2/32, 10.10.10.3/32) and generate a key pair there too. One configuration per device, never shared.
6. Choose full tunnel or not. With all traffic through the VPN on, your ordinary internet traffic goes out through home as well. Off means only your own network through the tunnel and the rest directly. On public Wi-Fi the first is pleasant, for watching video it is not.
7. Read the checks above the script and fix the errors.
8. Put the script on the router. Reset, paste, make sure you can still get in; see Using the script.
9. Install the client configuration. Below the script there is a block per client with a copy and a download button. Load the .conf file into the WireGuard app, or paste the text into it. There is a private key in it, so do not send it through a chat group.
10. Is the MikroTik behind another router? Forward UDP 13231 there to the MikroTik. See Port forwarding.

Testing

1. Turn off the Wi-Fi on your phone and use mobile data. Connecting from your own network to your own public address usually fails, and it tells you nothing about your configuration.
2. Switch the tunnel on. The app should show traffic in both directions within a few seconds.
3. On the router: /interface wireguard peers print. There should be a recent handshake for that peer.
4. Ping your router's LAN address, then something behind it, your NAS for example.
5. Try a name instead of an address. If that fails, check that the DNS line in the client configuration points at your router; see DNS.
6. On a full tunnel: look up what your public address is. It should now be the one at home.

What to watch

• Clashing address ranges. If home is on 192.168.1.0/24 and so is the hotel, you will not get through. Pick something unusual at home, 10.44.7.0/24 for instance.
• A peer per device. Two phones with the same key and the same address keep tripping over each other.
• Management stays closed. You do not have to put WinBox or SSH on the internet; over the VPN the router is reachable anyway. That is the main gain of this recipe.
• MTU. If the connection works but large pages stall, see the MTU section in WireGuard.
• Keep your configuration. The keys live in your project in the browser; export it if you want to keep them. See Saving and sharing.

Behind CGNAT

Many connections, mobile ones and fibre from smaller providers in particular, no longer give you a public IPv4 address of your own. Your router then sits behind the provider's NAT and there is no port to come in on.

How to tell: look at the address on your WAN interface with /ip address print and compare it with what a "what is my IP" site shows. If they differ, or your WAN address starts somewhere between 100.64. and 100.127., you are behind CGNAT. The IP Cloud address does not help there: it only publishes the address the router itself has, and Back To Home works from that same address.

What you can do:

• Ask your provider for a public IPv4 address. Often possible, sometimes free, sometimes for a couple of euros a month. This is the simplest fix.
• Use IPv6. If both your router and your phone get IPv6, the tunnel can run over it: use the IPv6 address or hostname as the endpoint. Do switch on the IPv6 firewall; see IPv6. The catch is that you do not always have IPv6 while travelling.
• Terminate the tunnel on a VPS. A small server with a public address is the fixed point: your router dials out to it with a keepalive, your phone does too, and the traffic goes through that server. The configurator does not configure the VPS for you, but the router side is the same work as above: a site-to-site peer with the VPS as its endpoint.

Further reading

WireGuard for all the fields, VPN for individual users when no client may be installed, and Example: two locations with a tunnel when it is about permanent links.