На микротике настроен переброс части траффика в Wireguard тунель. Делает это правилами FWD для статических днес адресов и отдельным address list spotify. И в дальнейшем маркируем как mark_vpn и загоняем в тунель.
Разные известные сервисы отлично работают, но вот Google Gemini каким то образом отказывает хосту 172.16.2.8 в доступе. Хотя по трейсу видно, что пинг идет в туннель.
Код: Выделить всё
"error": {"code": 400, "message": "User location is not supported for the API use.", "status": "FAILED_PRECONDITION")Код: Выделить всё
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard-nexus
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=VPS endpoint-port=51447 interface=wireguard-nexus persistent-keepalive=5s preshared-key="hereismykey" public-key="my_publickey"
/ip address
add address=10.18.18.2/24 interface=wireguard-nexus network=10.18.18.0
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2 router-id=172.16.2.1
/routing ospf area
add disabled=no instance=default-v2 name=backbone-v2
/routing table
add disabled=no fib name=mark_vpn
/ip dns
set address-list-extra-time=1d allow-remote-requests=yes cache-size=120KiB doh-max-concurrent-queries=100 doh-max-server-connections=15 servers=1.1.1.1 verify-doh-cert=yes
/ip dns static
add address-list=spotify forward-to=1.1.1.1 match-subdomain=yes name=googleapis.com type=FWD
/ip firewall address-list
add address=googleapis.com list=spotify
add address=aistudio.google.com list=spotify
add address=ai.google.dev list=spotify
add address=gemini.google.com list=spotify
add address=bard.google.com list=spotify
add address=www3.l.google.com list=spotify
add address=generativelanguage.googleapis.com list=spotify
add address=deepmind.com list=spotify
add address=deepmind.google list=spotify
add address=geller-pa.googleapis.com list=spotify
add address=proactivebackend-pa.googleapis.com list=spotify
add address=alkalicore-pa.clients6.google.com list=spotify
add address=alkalimakersuite-pa.clients6.google.com list=spotify
add address=generativeai.google list=spotify
add address=makersuite.google.com list=spotify
/ip firewall filter #фэсттрек отключил
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=reject chain=input comment=PINGS disabled=yes protocol=icmp reject-with=icmp-network-unreachable
add action=accept chain=input comment="Unknown Established" connection-state=established
add action=accept chain=input comment="Unknown RELATED " connection-state=related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid log-prefix="DROP INVALID"
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN log-prefix=DROP2
add action=drop chain=input comment="Drop all not from LAN" in-interface-list=!LAN log-prefix="DROP NOT LAN"
/ip firewall mangle
add action=mark-routing chain=prerouting dst-address-list=spotify new-routing-mark=mark_vpn passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat comment="Wireguard nexus" out-interface=wireguard-nexus out-interface-list=all
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=10.18.18.1 routing-table=mark_vpn scope=20 suppress-hw-offload=no target-scope=10