AnchorPoint VPN

What it does

One SSID, anywhere in the world — you land on your own home LAN.

Two networks, one tunnel

Keep home (the exit point) and travel (where the MikroTik is) separate — everything else follows.

Travel devices sit on 192.168.20.0/24, tunnel over UDP 443 to the home WireGuard server (10.0.80.1), and exit onto the home internet line.

	Home network	Travel network
Where	Your house / office	Hotel, café, airport, client site
Hardware	FRITZ!Box or Linux + WireGuard server	MikroTik hAP ax2 — WireGuard client
Role	Exit point — traffic reaches the internet here	Entry point — collects your devices
WireGuard	Listens on UDP 443	Dials out to home on UDP 443
Subnet	10.0.80.0/24 (tunnel), server 10.0.80.1	192.168.20.0/24, gateway 192.168.20.1

Prerequisite: a home WireGuard server

AnchorPoint consumes a WireGuard server — it does not create one. Build the home end first.

The home network is the exit point. You need a WireGuard server running at home before the travel router has anything to dial into. The easiest path is a FRITZ!Box (FRITZ!OS 7.50+ has WireGuard built in); any Linux host works too.

AFRITZ!Box WireGuard server

1. Open http://fritz.box → Internet → Permit Access → VPN (WireGuard) → Add connection.
2. Choose the custom / "specific application" option (not the guided MyFRITZ!-app one) so you can export a raw config.
3. Name it anchorpoint-travel-router. The box generates a key pair and a client config — download / copy it.
4. Set the public-facing listener to UDP 443 so client-side firewalls treat it as HTTPS. If the FRITZ!Box sits behind another modem, add a port forward UDP 443 → FRITZ!Box there.
5. Set up DDNS so the travel router always finds home: Internet → MyFRITZ!-Account gives a free xxxx.myfritz.net name, or use Internet → Permit Access → DynDNS for your own provider.

Verify before you leave home. Import the client config into the WireGuard phone app over mobile data and connect, then open ifconfig.me. It must show your home IP — that proves home is the exit point.

[Interface]
PrivateKey = <CLIENT_PRIVATE_KEY>
Address    = 10.0.80.3/24
DNS        = 10.0.80.1

[Peer]
PublicKey           = <SERVER_PUBLIC_KEY>
Endpoint            = home.example.myfritz.net:443
AllowedIPs          = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

BLinux WireGuard server (alternative)

Prefer a Raspberry Pi / mini-PC / VPS? Run WireGuard on ListenPort = 443, masquerade the tunnel out to the internet, forward UDP 443 on the router in front of it, and add DDNS. Full server snippet is in the repo at config/wireguard-client.conf.example.

Travel router: MikroTik hAP ax2

Configure in WinBox → New Terminal. Paste in order; replace every <PLACEHOLDER>.

/system/ntp/client/set enabled=yes
/system/ntp/client/servers/add address=pool.ntp.org
/system/clock/set time-zone-name=Europe/Berlin

/interface/wireguard/wg-import config-string="
[Interface]
PrivateKey = <CLIENT_PRIVATE_KEY>
Address    = 10.0.80.3/24
DNS        = 10.0.80.1

[Peer]
PublicKey           = <SERVER_PUBLIC_KEY>
Endpoint            = home.example.myfritz.net:443
AllowedIPs          = 0.0.0.0/0,::/0
PersistentKeepalive = 25
"

The import creates interface wg1. AllowedIPs = 0.0.0.0/0 is a full tunnel — that is what makes home the exit point. Endpoint … :443 dials out on the HTTPS port so venue firewalls allow it.

# dedicated VPN bridge on ether2
/interface bridge port remove [find interface=ether2]
/interface bridge add name=bridge-vpn
/interface bridge port add bridge=bridge-vpn interface=ether2
/ip address add address=192.168.20.1/24 interface=bridge-vpn

# policy route: whole travel LAN exits via the tunnel
/routing table add name=to-vpn fib
/ip route add dst-address=0.0.0.0/0 gateway=wg1 routing-table=to-vpn
/routing rule add src-address=192.168.20.0/24 action=lookup-only-in-table table=to-vpn
/ip firewall nat add action=masquerade chain=srcnat out-interface=wg1

# DHCP for your devices, DNS pointed at home (no DNS leak)
/ip pool add name=vpn-pool ranges=192.168.20.10-192.168.20.100
/ip dhcp-server add address-pool=vpn-pool interface=bridge-vpn name=dhcp-vpn
/ip dhcp-server network add address=192.168.20.0/24 dns-server=10.0.80.1 gateway=192.168.20.1

/interface wireguard set wg1 mtu=1412
/ip firewall mangle add action=change-mss chain=forward new-mss=1280 out-interface=wg1 protocol=tcp tcp-flags=syn tcp-mss=1281-65535
/ip firewall mangle add action=change-mss chain=forward new-mss=1280 in-interface=wg1  protocol=tcp tcp-flags=syn tcp-mss=1281-65535

/interface/wifi/add name=wifi-vpn-5ghz master-interface=wifi1 \
    configuration.ssid="AnchorPoint Home Network" \
    security.passphrase="<HOME_NETWORK_PASSWORD>" \
    security.authentication-types=wpa2-psk,wpa3-psk disabled=no
/interface/bridge/port add bridge=bridge-vpn interface=wifi-vpn-5ghz

The 5 GHz radio (wifi1) broadcasts your home network. The 2.4 GHz radio (wifi2) is reserved as the uplink radio for venue Wi-Fi / hotspot below. (Use both radios for the home SSID only when your uplink is the wired ether1 port.)

Uplink failover: LAN → Wi-Fi → Hotspot

The router keeps the highest-priority uplink that has working internet — and heals itself.

Priority: wired LAN (ether1) → venue Wi-Fi (wifi2) → phone hotspot (wifi2). Wired always wins when a cable is present.

/interface/bridge/port/remove [find interface=wifi2]
/interface/list/member/add interface=wifi2 list=WAN
/interface/wifi/unset wifi2 configuration.mode
/interface/wifi/unset wifi2 configuration.ssid
/interface/wifi/unset wifi2 security.authentication-types
/interface/wifi/unset wifi2 security.passphrase
/interface/wifi/set wifi2 security.ft=no
/interface/wifi/set wifi2 security.ft-over-ds=no

/interface wifi security add name=wifi-sec-venue \
    authentication-types=wpa2-psk,wpa3-psk passphrase="<VENUE_WIFI_PASSWORD>"
/interface wifi configuration add name=wifi-cfg-venue mode=station \
    ssid="<VENUE_WIFI_SSID>" security=wifi-sec-venue disabled=no datapath.bridge=none

/interface wifi security add name=wifi-sec-hotspot \
    authentication-types=wpa2-psk,wpa3-psk passphrase="<PHONE_HOTSPOT_PASSWORD>"
/interface wifi configuration add name=wifi-cfg-hotspot mode=station \
    ssid="<PHONE_HOTSPOT_SSID>" security=wifi-sec-hotspot disabled=no datapath.bridge=none

/interface/wifi set wifi2 configuration=wifi-cfg-venue
/ip/dhcp-client/add interface=wifi2 disabled=no default-route-distance=10 comment="WiFi-WAN-Uplink"
/ip/dhcp-client/set [find interface=ether1] check-gateway=ping

The failover scripts (Switch-To-Venue, Switch-To-Hotspot), the WAN-Watchdog netwatch and the 15-minute Probe-Venue scheduler are in the repo file config/mikrotik-uplink-failover.rsc. To change hotels: /interface wifi configuration set wifi-cfg-venue ssid="<NEW_SSID>" then /system/script/run Switch-To-Venue.

Ports used — home vs. travel

Home exposes exactly one inbound port; travel needs exactly one outbound port.

Home network (WireGuard server — exit point)

Port	Proto	Direction	Purpose
443	UDP	Inbound (internet → server)	WireGuard listener — port-forward this to the server. The only inbound port. Looks like HTTPS so client firewalls allow it.
53	UDP/TCP	Internal	DNS resolver (10.0.80.1) that tunnel clients use. Stays on the LAN.
123	UDP	Outbound	NTP time sync.
—	DDNS	Outbound	Hostname (e.g. myfritz.net) tracking the changing home IP.

Travel network (MikroTik hAP ax2 — client)

Port	Proto	Direction	Purpose
443	UDP	Outbound (router → home)	The only port the tunnel needs. Dials home.example.myfritz.net:443. UDP/443 survives restrictive venue/corporate firewalls.
67 / 68	UDP	Both	DHCP — client on the uplinks (ether1, wifi2); server on bridge-vpn handing out 192.168.20.x.
53	UDP/TCP	Internal → tunnel	DNS from your devices, forwarded to home's resolver. Does not leak to the venue.
123	UDP	Outbound	NTP — correct time is mandatory or the WireGuard handshake fails.

In one line: home opens only UDP/443 inbound; travel needs only UDP/443 outbound. Both 10.0.80.0/24 (tunnel) and 192.168.20.0/24 (travel LAN) stay private and are never reachable from the venue.