Home Router Reference — CCR2004-16G-2S+

Validated onboarding target for the IT Pro Partner WireGuard tunnel pattern.

Hardware

Field	Value
Board	CCR2004-16G-2S+
Architecture	ARM64 (4 cores @ 1700MHz)
RAM	4 GB
Storage	128 MB NAND
RouterOS	7.18.2 (stable)
ISP	AT&T residential fiber (CGNAT)

WireGuard Tunnel (Multi-Peer Topology)

The router has two WireGuard peers — one for Core (active Hermes) and one for app1-bu (warm standby). Both peers use the same interface wg-itpp on the router.

Peer 1 — Core (netcup)

Interface: wg-itpp
Listen port: 13231 (same interface for both peers)
Local IP: 10.77.0.2/24
Peer: 10.77.0.1 (Core)
Router public key (CURRENT): 1fPwdGQ20CxlZCQZQV134olDcE91hfp78yNDeaKJZzg=
Core public key: WTwbuq3gwQDKaE8bdpBo/tFuO8fRcBlKX7ajSn5ry2k=
Endpoint: 152.53.192.33:51821
Keepalive: 25s
MTU: 1420

Peer 2 — app1-bu (Hetzner standby)

Peer: 10.77.0.3 (app1-bu)
app1-bu public key: aEDfY/XzE5m6van/NkvMnYZoYuhptvs1GGkbqmaFKBQ=
Endpoint: 5.161.114.8:51821
Keepalive: 25s

Latency: 37ms (Ashburn → Savannah) for Core, 87ms for app1-bu (Hetzner → Savannah)

Firewall rules (cleaned, no duplicates):

Allow established/related input — chain=input, connection-state=established,related, action=accept, place-before=1
IPsec IKE — chain=input, protocol=udp, in-interface-list=WAN, dst-port=500
allow WG (ITPP) — chain=input, protocol=udp, dst-port=13231, action=accept
IPsec NAT-T — chain=input, protocol=udp, in-interface-list=WAN, dst-port=4500
L2TP — chain=input, protocol=udp, in-interface-list=WAN, dst-port=1701
IPsec ESP — chain=input, protocol=ipsec-esp, in-interface-list=WAN

Total firewall rules: 26 (cleaned from 31)

SSH Access

Through WG tunnel (Core): ssh -i ~/.ssh/wisp_rsa shonuff@10.77.0.2
SSH restricted to: 10.1.0.0/24, 10.1.1.0/24, 192.168.88.0/24, 10.77.0.0/24
API restricted to: 10.1.0.0/24, 10.1.1.0/24
API-SSL: disabled
Winbox: unrestricted (user requirement)

SMTP Configuration (Status: Working)

Applied settings:

Server: mail.germainebrown.com
Port: 2525 (NOT 465 — times out from netcup infra)
TLS: starttls (NOT yes/SSL)
From/user: g@germainebrown.com
Password: LoveMyBoys1520!
Last status: succeeded

DNS resolvers: 10.1.1.14 (AdGuard primary), 10.1.1.10 (AdGuard backup) Previously on: 192.168.1.254 (AT&T DHCP) — could not resolve mail.germainebrown.com

Scheduled email jobs (daily at 4 AM, run-count was 0 until SMTP fixes):

Email - Router Logs (/log print file=home-rtr-logs, sends home-rtr-logs.txt)
Email - Router Config (/export file=home-rtr-config, sends home-rtr-config.rsc)
Email - Router Backup (/system backup save name=home-rtr, sends home-rtr.backup)

File naming fixed Jul 9: All three scripts were using mismatched file names (created as logs.txt but emailed as home-rtr-logs.txt, etc.). Corrected to use consistent naming.

DNS Logging

/ip/dns/set allow-remote-requests=yes log-queries=yes log-fwd-queries=yes

System logging outputs are set to action=remote topics=dns remote=10.77.0.1:514 remote-log-prefix="home-rtr".

Note: Server-side syslog receiver on 10.77.0.1:514 is NOT yet configured (UDP 514 is not listening). This is a known gap — DNS logs are stored locally on the router but not yet shipped to the portal.

Router Security Cleanup (Jul 9, 2026)

Removed:

6 duplicate firewall rules (WG rules pasted multiple times during troubleshooting)
Remote Winbox SSTP client + scheduler + script (RWB_IP_RESOLVER)
Stale user 52a95oKcepCRctu (last login March 2026)
shonuff L2TP PPP secret (WG covers server access now)
PAP/MSCHAP1 L2TP auth (hardened to CHAP+MSCHAP2 only)
API-SSL service (disabled)
SSH/API address restrictions added

Added:

Established/related INPUT chain rule (required for SMTP, outbound DNS)

Notes

The router is behind AT&T residential fiber with CGNAT. WireGuard tunnel with 25s keepalive survives NAT rebinds.
The wisp_rsa SSH key (comment "wisp-backup") is the key with tunnel access.
WireGuard keys: server private is KkXVsdKyiYQVBbA5HbC9sF4dMX16WSmVOkVPYTq8mh8= (pub: WTwbuq3gwQDKaE8bdpBo/tFuO8fRcBlKX7ajSn5ry2k=). Router private key may have been regenerated since initial setup — always verify actual public key via /interface/wireguard/print detail where name=wg-itpp, never trust an old config export.
L2TP client to-core is still configured but disabled since WG handles it. Remove if/when L2TP is fully decommissioned.

4.6 KiB Raw Blame History