mikrotik
- AllowedIPs is not access control
A per-friend WireGuard kit scoped each peer with AllowedIPs, which is a route on the friend's own device. The real scope is a forward-chain drop on the router.
- The iPhone camera wanted to Google my private key
Adding WireGuard to a MikroTik: the hairpin test that fails for no reason, and the iPhone Camera app offering to web-search a private key.
- The router had been running fine, which was the problem
A read-only audit of a hAP ac3 that had run fine for years: a 6.x bootloader, plaintext services on, NTP off, and admin reachable from anywhere.