So this is an update.
As I was Missed the PMTUD I also Needed to use DOH to bypass the DNS filtering and as CF does not have any AS in this region the latency was F up. so I decided to not use the DOH in the Client MT and move the DNS queries to the WG peer.
mangle
/ip firewall mangle
add action=mark-connection chain=prerouting comment="VIA WG DNS" dst-port=53 new-connection-mark=via-wg-dns passthrough=yes protocol=tcp src-address-list=VPN
add action=mark-connection chain=prerouting dst-port=53 new-connection-mark=via-wg-dns passthrough=yes protocol=udp src-address-list=VPN
add action=mark-routing chain=prerouting connection-mark=via-wg-dns new-routing-mark=via-wg passthrough=no
add action=mark-connection chain=prerouting comment="VIA WG Route" dst-address-list=!LOCO new-connection-mark=via-wg passthrough=yes src-address-list=VPN
add action=mark-routing chain=prerouting connection-mark=via-wg new-routing-mark=via-wg passthrough=no src-address-list=VPN
add action=change-mss chain=forward connection-mark=via-wg new-mss=clamp-to-pmtu passthrough=yes protocol=tcp tcp-flags=syn
NAT
/ip firewall nat
add action=masquerade chain=srcnat comment="M VIA WAN" ipsec-policy=out,none out-interface-list=WAN
add action=src-nat chain=srcnat comment="SRC-NAT Modem" dst-address=192.168.1.1 out-interface-list=DSL to-addresses=192.168.1.2
add action=src-nat chain=srcnat comment="SRC-NAT VPN - VIA WG" out-interface-list=WG to-addresses=10.10.12.240
add action=dst-nat chain=dstnat comment="DST-NAT VIA WG" connection-mark=via-wg-dns src-address-list=VPN to-addresses=10.10.12.1
address-list
/ip firewall address-list
add address=192.168.88.3 list=VPN
add address=192.168.88.2 disabled=yes list=VPN
add address=192.168.88.0/24 list=LOCO
export.txt (17.8 KB)