Access LAN through WG+L2TP tunnel

RouterOS General
1

Hi, I’m trying to confiigure mikrotik as it presented in the network diagram below.
I’ve already managed some of the main setting but there are a few I’m stuck with.

  1. L2TP+IPSec tunnel between Main Office and Office2 with access to local networks behind routers. - Done
  2. WireGuard interface (wg-snet) to access Main Office and Office2 local networks ONLY (without tunneling other data) for the remote user (WG SNET USER). - Partitialy done, I have access to Main Office local network but can’t connect to Office2.
  3. WireGuard interface (wg-vpn) for tunneling all data through Main Office WAN ONLY (without access to local networks) for the remote user (WG VPN USER). - Done
  4. Access to MT1 from specific WG SNET USER. - Done
  5. Access to MT2 from specific WG SNET USER.
  6. Isolate WG peers from each other. - Done

So looks L2TP+IPSec tunnel and WG interfaces are working well and the main problem is connecting to Office2 local network from WG SNET USER. I would really appreciate if you could help me with it.

You can find MT1, MT2 and WG peers configs below.

MT1

2024-01-07 15:08:06 by RouterOS 7.11.2

software id = 38WX-HX7F

model = RBD52G-5HacD2HnD

serial number = XXXXXXXXXX

/interface bridge
add admin-mac=48:XX:XX:XX:XX:1B auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether2 ] comment=d
/interface l2tp-server
add comment=snet name=l2tp-in1 user=snet
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX
country=xxx disabled=no distance=indoors frequency=auto installation=
indoor mode=ap-bridge ssid=mainoffice wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX
country=xxx disabled=no distance=indoors frequency=auto installation=
indoor mode=ap-bridge ssid=mainoff1ce wireless-protocol=802.11
/interface pppoe-client
add add-default-route=yes comment=isp disabled=no interface=ether1 name=
pppoe-out1 use-peer-dns=yes user=v41701542
/interface wireguard
add listen-port=22522 mtu=1420 name=wg-snet
add listen-port=13531 mtu=1420 name=wg-vpn
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=
dynamic-keys supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
add name=l2tp_pool ranges=10.10.5.1-10.10.5.100
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=1m name=defconf
/ppp profile
add local-address=l2tp_pool name=l2tp remote-address=l2tp_pool
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4
add bridge=bridge comment=defconf ingress-filtering=no interface=ether5
add bridge=bridge comment=defconf ingress-filtering=no interface=wlan1
add bridge=bridge comment=defconf ingress-filtering=no interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface l2tp-server server
set authentication=mschap2 default-profile=l2tp enabled=yes use-ipsec=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
/interface wireguard peers
add allowed-address=10.11.12.13/32 comment=d-laptop interface=wg-snet persistent-keepalive=25s public-key=
“4i+kXXXXXXXXXYXOEI=”
add allowed-address=10.9.8.7/32 comment=d-laptop interface=wg-snet persistent-keepalive=25s public-key=
“BuKMXITRXXXXXXRAQ=”
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=
192.168.88.0
add address=10.11.12.1/24 interface=wg-snet network=10.11.12.0
add address=10.9.8.1/24 interface=wg-vpn network=10.9.8.0
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=
192.168.88.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=accept chain=input comment=l2tp dst-port=1701,500,4500
in-interface-list=WAN protocol=udp
add action=accept chain=input comment=wg-snet dst-port=22522 in-interface-list=
WAN protocol=udp
add action=accept chain=input comment=wg-vpn dst-port=13531 in-interface-list=
WAN protocol=udp
add action=accept chain=input comment=“Access MT from d-laptop” dst-port=
22,23,80,8291 in-interface=wg-snet protocol=tcp src-address=
10.11.12.13
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=
“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
in-interface-list=!LAN
add action=accept chain=forward comment=“defconf: accept in ipsec policy”
ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy”
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=
“defconf: accept established,related, untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=
invalid
add action=drop chain=forward comment=“defconf: drop all from WAN not DSTNATed”
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=drop chain=forward comment=“Block Internet for WG-SNet”
out-interface-list=WAN src-address=10.11.12.0/24
add action=drop chain=forward comment=“Block LAN for WG-VPN”
out-interface-list=LAN src-address=10.9.8.0/24
add action=reject chain=forward comment=“Isolating wg-snet peers” in-interface=wg-snet out-interface=wg-snet reject-with=
icmp-network-unreachable
add action=reject chain=forward comment=“Isolating wg-vpn peers” in-interface=wg-vpn out-interface=wg-vpn reject-with=
icmp-network-unreachable
/ip firewall mangle
add action=mark-packet chain=prerouting connection-state=new dst-address=
111.111.111.111 in-interface=bridge new-packet-mark=nat-loopback
passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade” ipsec-policy=
out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment=“NAT Loopback replace address”
packet-mark=nat-loopback
/ip route
add disabled=no distance=1 dst-address=192.168.111.0/24 gateway=l2tp-in1
pref-src=192.168.88.1 routing-table=main scope=30 suppress-hw-offload=no
target-scope=10
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=bridge type=internal
add interface=pppoe-out1 type=external
/ppp secret
add name=skynet profile=l2tp service=l2tp
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/system clock
set time-zone-name=Europe/Athens
/system note
set show-at-login=no
/system package update
set channel=testing
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

MT2

MT2

jan/07/2024 15:36:47 by RouterOS 6.49.6

software id = BGGS-1Q5G

model = 951Ui-2nD

serial number = XXXXXXXX

/interface bridge
add admin-mac=64:XX:XX:XX:XX:D6 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] comment=ISP
set [ find default-name=ether2 ] comment=LTE
/interface l2tp-client
add allow=mschap2 comment=snet connect-to=111.111.111.111 disabled=no name=l2tp-out1 use-ipsec=yes
user=snet
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX disabled=no distance=indoors
frequency=auto installation=indoor mode=ap-bridge ssid=Office2 wireless-protocol=802.11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys supplicant-identity=
MikroTik
/ip pool
add name=dhcp ranges=192.168.111.10-192.168.111.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add list=LAN
add interface=ether2 list=WAN
/ip address
add address=192.168.111.1/24 comment=defconf interface=bridge network=192.168.111.0
/ip dhcp-client
add add-default-route=no comment=“Primary WAN” disabled=no interface=ether1
add add-default-route=no comment=“Redundant WAN” disabled=no interface=ether2
/ip dhcp-server network
add address=192.168.111.0/24 comment=defconf dns-server=1.1.1.1,1.0.0.1
gateway=192.168.111.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,1.0.0.1
/ip dns static
add address=192.168.111.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=“defconf: accept established,related,untracked”
connection-state=established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=“defconf: accept to local loopback (for CAPsMAN)” dst-address=
127.0.0.1
add action=drop chain=input comment=“defconf: drop all not coming from LAN” in-interface-list=!LAN
add action=accept chain=forward comment=“defconf: accept in ipsec policy” ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy” ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=
established,related
add action=accept chain=forward comment=“defconf: accept established,related, untracked”
connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=drop chain=forward comment=“defconf: drop all from WAN not DSTNATed” connection-nat-state=
!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade” ipsec-policy=out,none
out-interface-list=WAN
add action=masquerade chain=srcnat disabled=yes out-interface=*9
/ip route
add comment=“primary gateway” distance=2 gateway=192.168.1.1
add comment=“secondary gateway” distance=3 gateway=192.168.222.1
add distance=1 dst-address=8.8.8.8/32 gateway=192.168.1.1
add distance=1 dst-address=192.168.88.0/24 gateway=l2tp-out1 pref-src=192.168.111.1
/ip service
set ssh disabled=yes
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=bridge type=internal
add interface=ether1 type=external
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Athens
/system package update
set channel=long-term
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

WG SNET USER

[Interface]
PrivateKey = XXXXXXXX=
Address = 10.11.12.13/32

[Peer]
PublicKey = XXXXXXX=
AllowedIPs = 10.11.12.0/24, 192.168.88.0/24, 192.168.111.0/24
Endpoint = 111.111.111.111:22522
PersistentKeepalive = 25
network.png

2

The order of firewall rules matters. The rules are enforced from top to bottom.
On the MT1 router side, in the firewall Forward section, the last rule should be -

add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" \
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN

There are no entries for L2tp on the MT2 router side. How can you work correctly in the tunnel? https://docs.sim-cloud.net/en/operations/vpn-configurations/ipsec-site-to-site/mikrotik-behind-nat.html
L2tp vpn still needs src-nat rules on both routers, which need to be moved over “Masquarade”

add action=accept chain=input comment=L2TP dst-port=500,1701,4500 protocol=udp
add action=accept chain=input comment="IKE IPSec" protocol=ipsec-esp
3

I’ve moved rule “defconf: drop all from WAN not DSTNATed” to the bottom, added entries for L2TP on the MT2 router side and src-nat rules on both routers but still can’t connect to 192.168.111.0/24 from WG SNET USER.

MT1

[admin@MikroTik] > /ip firewall/filter/ print
Flags: X - disabled, I - invalid; D - dynamic
0 D ;;; special dummy rule to show fasttrack counters
chain=forward action=passthrough

1 ;;; defconf: accept established,related,untracked
chain=input action=accept connection-state=established,related,untracked

2 ;;; L2TP
chain=input action=accept protocol=udp in-interface-list=WAN dst-port=1701,500,4500 log=no log-prefix=“”

3 ;;; IKE IPSec
chain=input action=accept protocol=ipsec-esp

4 ;;; wg-snet
chain=input action=accept protocol=udp in-interface-list=WAN dst-port=22522 log=no log-prefix=“”

5 ;;; wg-vpn
chain=input action=accept protocol=udp in-interface-list=WAN dst-port=13531 log=no log-prefix=“”

6 ;;; Access MT from d-laptop
chain=input action=accept protocol=tcp src-address=10.11.12.13 in-interface=wg-snet-server dst-port=22,23,80,8291 log=no log-prefix=“”

7 ;;; defconf: drop invalid
chain=input action=drop connection-state=invalid log=no log-prefix=“”

8 ;;; defconf: accept ICMP
chain=input action=accept protocol=icmp

9 ;;; defconf: accept to local loopback (for CAPsMAN)
chain=input action=accept dst-address=127.0.0.1

10 ;;; defconf: drop all not coming from LAN
chain=input action=drop in-interface-list=!LAN log=no log-prefix=“”

11 ;;; defconf: accept in ipsec policy
chain=forward action=accept ipsec-policy=in,ipsec

12 ;;; defconf: accept out ipsec policy
chain=forward action=accept ipsec-policy=out,ipsec

13 ;;; defconf: fasttrack
chain=forward action=fasttrack-connection hw-offload=yes connection-state=established,related

14 ;;; defconf: accept established,related, untracked
– [Q quit|D dump|down]

15 ;;; defconf: drop invalid
chain=forward action=drop connection-state=invalid log=no log-prefix=“”

16 ;;; Block Internet for WG-SNet
chain=forward action=drop src-address=10.11.12.0/24 out-interface-list=WAN log=no log-prefix=“”

17 ;;; Block LAN for WG-VPN
chain=forward action=drop src-address=10.9.8.0/24 out-interface-list=LAN log=no log-prefix=“”

18 ;;; Isolating wg-snet peers
chain=forward action=reject reject-with=icmp-network-unreachable in-interface=wg-snet-server out-interface=wg-snet-server log=no log-prefix=“”

19 ;;; Isolating wg-vpn peers
chain=forward action=reject reject-with=icmp-network-unreachable in-interface=wg-vpn-server out-interface=wg-vpn-server log=no log-prefix=“”

20 ;;; defconf: drop all from WAN not DSTNATed
chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN log=no log-prefix=“”

[admin@MikroTik] > /ip firewall/nat/ print
Flags: X - disabled, I - invalid; D - dynamic
0 chain=srcnat action=accept src-address=192.168.88.0/24 dst-address=192.168.111.0/24

1 ;;; defconf: masquerade
chain=srcnat action=masquerade out-interface-list=WAN ipsec-policy=out,none

2 ;;; NAT Loopback replace address
chain=srcnat action=masquerade packet-mark=nat-loopback log=no log-prefix=“”

MT2

[admin@MikroTik] /ip firewall filter> print
Flags: X - disabled, I - invalid, D - dynamic
0 D ;;; special dummy rule to show fasttrack counters
chain=forward action=passthrough

1 ;;; defconf: accept established,related,untracked
chain=input action=accept connection-state=established,related,untracked log=no log-prefix=“”

2 ;;; L2TP
chain=input action=accept protocol=udp dst-port=500,1701,4500

3 ;;; IKE IPSec
chain=input action=accept protocol=ipsec-esp

4 ;;; defconf: drop invalid
chain=input action=drop connection-state=invalid log=no log-prefix=“”

5 ;;; defconf: accept ICMP
chain=input action=accept protocol=icmp log=no log-prefix=“”

6 ;;; defconf: accept to local loopback (for CAPsMAN)
chain=input action=accept dst-address=127.0.0.1 log=no log-prefix=“”

7 ;;; defconf: drop all not coming from LAN
chain=input action=drop in-interface-list=!LAN log=no log-prefix=“”

8 ;;; defconf: accept in ipsec policy
chain=forward action=accept log=no log-prefix=“” ipsec-policy=in,ipsec

9 ;;; defconf: accept out ipsec policy
chain=forward action=accept log=no log-prefix=“” ipsec-policy=out,ipsec

10 ;;; defconf: fasttrack
chain=forward action=fasttrack-connection connection-state=established,related log=no log-prefix=“”

11 ;;; defconf: accept established,related, untracked
chain=forward action=accept connection-state=established,related,untracked log=no log-prefix=“”

12 ;;; defconf: drop invalid
chain=forward action=drop connection-state=invalid log=no log-prefix=“”

13 ;;; defconf: drop all from WAN not DSTNATed
chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN log=no log-prefix=“”

[admin@MikroTik] > /ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat action=accept src-address=192.168.111.0/24 dst-address=192.168.88.0/24

1 ;;; defconf: masquerade
chain=srcnat action=masquerade out-interface-list=WAN ipsec-policy=out,none

4

I thought I had a solution but then ran up against the MAIN ISSUE.
I see conflict in attempt to tell the R1 router how to route traffic headed towards theR2 subnet.
a. L2TP for R1 subnet to R2 subnet
b. Wireguard for remote users to same R2 subnet.

Why not send R1 Subnet users ALSO over wireguard to R2 subnet… and vice versa
OR
Why not take remote wireguard clients landed at R1 and then add them to the L2TP tunnel going to subnet on R2??

Which is your preference…

OKAY I have another option.
KEEP EXISTING L2TP route for local R1 subnets to reach R2 subnets.
add disabled=no distance=1 dst-address=192.168.111.0/24 gateway=l2tp-in1
pref-src=192.168.88.1 routing-table=main scope=30 suppress-hw-offload=no
target-scope=10

We will use two Routes to R2 subnet… primary l2tp and failover wg. With this setup, if l2tp fails your local R1 subnet can reach R2 over wireguard.
/ip route
add distance=1 dst-address=192.168.111.0/24 gateway=l2tp-in1
pref-src=192.168.88.1 routing-table=main scope=30 suppress-hw-offload=no
target-scope=10
add distance=2 dst-address=192.168.111.0/24 gateway=wg-MAIN routing-table=MAIN

We will add a new table, iP route, and routing rule to allow remote WG user access without conflict, all the time.
/routing table add fib name=useWG-Remote
/ip route
add dst-address=192.168.111.0/24 gateway=wg-MAIN routing-table=useWG-Remote
/routing rule add dst-address=192.168.111.0/24 src-address=10.11.12.13/32 action=lookup-only-in-table table=useWG-Remote

In this regard, If L2TP goes down, R1 subnet has an alternate path via WIREGUARD to R2 Subnet.
The question is did you want this backup to go both ways, R2 Subnet to reach R1 subnet via WG if L2TP is not available??

BIGGER ISSUE → Upgrade firmware on R2 office router to latest stable ver7 or at least same version as Main router. Wireguard started with Version 7 !!!

Once you answer the above questions and methods, I can pump out a config..

5

The problem solved by adding a route on MT2 “add distance=1 dst-address=10.11.12.0/24 gateway=l2tp-out1 pref-src=192.168.111.1” now I have access to MT2 LAN from WG SNET USER .

I have several reasons for using LT2P instead of WG:

  1. MT2 locates in a place where OVPN\WG etc can be blocked one day (actually it’s already partly blocked by some ISPs)
  2. MT2 (RB951Ui-2nD) has quite old HW and I’m not sure WG will work well on it (I had problems on RB750 before)
  3. MT2 is quite far away from me ATM and I’d prefer not to experiment with remote upgrading.

But I consider using L2TP as a redundant tunnel in the near future and use WG as the main instead but with the star topology (something like MT1 <–WG–> VPS <–WG–> MT2) to have access to MT2 LAN if MT1 is offline. So I would really appreciate if you could help with some basics for this “scenario”.

6

Okay glad you got it sorted, will provide what I did next just for your viewing pleasure LOL.

7

  1. You dont need to create two wireguard interfaces to isolate users.
    There are two easy options.
    a. Use firewall rules at R1, simply do not create an allow rule from one wg peer to the other wg peer.....
    b. Assign two different WG addresses on R1, one address schema for WG USER SN and another address schema for WG VPN.
    I will use the latter in this case for fun. Only changes and main items involved kept.

  2. The server for handshake in this case M1 has no need for persistent-keep-alive (remove) its the requirement for client devices........

  3. Mac-Server by itself is not a secure access method, set it to NONE!

  4. Why are you using UPNP??

  5. Added Wireguard to the LAN list

  6. Your addition of one wireguard user to access input chain aka the router is funny, in that you allow the entire LAN access to router as well.
    Much better to create an authorized firewall address list and only let LAN users access DNS.....

  7. The key to allowing WIREGUARD user to reach MT is to realize that WG connections are peer to peer. In other words from user to M1 and from M1 to M2.
    Thus we have to account for traffic exiting the router at M1 from the user and then having to re-enter a tunnel to M2. (forward chain)

  8. Upgrade router to latest stable firmware.

  9. Fixed chain rules by changing focus to allow only traffic and automatically drop all else, much simpler and efficient.

  10. What is the reason for mangling, and associated srcnat rule, not seen that before and looks non-standard.???

  11. Lots of work on IP routes and added table and routing rule discussed in previous post!!


    2024-01-07 15:08:06 by RouterOS 7.11.2

model = RBD52G-5HacD2HnD

/interface bridge
add admin-mac=48:XX:XX:XX:XX:1B auto-mac=no comment=defconf name=bridge
/interface pppoe-client
add add-default-route=yes comment=isp disabled=no interface=ether1 name=
pppoe-out1 use-peer-dns=yes user=v41701542
/interface wireguard
add listen-port=22522 mtu=1420 name=wg-MAIN
/routing table
add fib name=useWG-RemoteUser
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=wg-MAIN list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
/interface wireguard peers
add allowed-address=10.11.12.13/32 comment=d-laptop interface=wg-MAIN public-key=
"4i+kXXXXXXXXXYXOEI=" comment="SN USER"
add allowed-address=10.9.8.7/32 comment=d-laptop interface=wg-MAIN public-key=
"BuKMXITRXXXXXXRAQ=" comment="VPN USER"
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=
192.168.88.0
add address=10.11.12.1/24 interface=wg-MAIN network=10.11.12.0
add address=10.9.8.1/24 interface=wg-MAIN network=10.9.8.0
/ip firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
++++++++++++++++++++++++++++++++++
add action=accept chain=input comment=l2tp dst-port=1701,500,4500
in-interface-list=WAN protocol=udp
add action=accept chain=input comment="wireguard handshake" dst-address=22522 protocol=udp
add action=accept chain=input comment="Admin access" src-address-list=Authorized
add action=accept chain=input comment="DNS LAN" in-interface-list=LAN dst-port=53 protocol=udp
add action=accept chain=input comment="DNS LAN" in-interface-list=LAN dst-port=53 protocol=tcp
add action=drop chain=input comment="Drop All Else" { Make this the last rule you enter to not lock yourself out }
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=forward comment="internet" in-interface-list=LAN out-interface-list=WAN { also allows VPN user out internet }
add action=accept chain=forward in-interface=wg-MAIN src-address=10.11.12.13 dst-address=192.168.88.0/24 comment="SN user to lan subnet"
add action=accept chain=forward in-interface=wg-MAIN out-interface=wg-MAIN comment="relay traffic to M2 for SN user"
add action=accept chain=forward src-address=192.168.88.0/24 out-interface=wg-MAIN comment="backup path to R2 if required"
add action=accept chain=forward comment="port forwarding" connection-nat-state=dstnat
add action=drop chain=forward comment="Drop All Else"

/ip route
add disabled=no distance=1 dst-address=192.168.111.0/24 gateway=l2tp-in1
pref-src=192.168.88.1 routing-table=main scope=30 suppress-hw-offload=no
target-scope=10
add distance=2 dst-address=192.168.111.0/24 gateway=wg-MAIN routing-table=MAIN comment="failover to R2 subnet"
add dst-address=192.168.111.0/24 src-address=10.11.12.13/32 action=lookup-only-in-table table=useWG-Remote

/routing rule
add src-address=10.11.12.13/32 dst-address=192.168.111.0/24 action=lookup-only-in-table table=useWG-RemoteUser

/tool mac-server
set allowed-interface-list=NONE
/tool mac-server mac-winbox
set allowed-interface-list=LAN

R2

Get rid of empty entry in interface list members
add list=LAN

Dont manually add netmask 24 on dchp server-network -not required may cause issues

Not sure what you were doing with 8.8.8.8 in one of your routes, but if attempting recursive routing it was very incomplete so removed.

MT2

model = 951Ui-2nD

serial number = XXXXXXXX

/interface bridge
add admin-mac=64:XX:XX:XX:XX:D6 auto-mac=no comment=defconf name=bridge
/interface wireguard
add listen-port=5656 mtu=1420 name=wg-office
/ip address
add address=192.168.111.1/24 comment=defconf interface=bridge network=192.168.111.0
/ip address=10.11.12.2/24 comment=wireguard interface=wg-office network=10.11.12.0
/interface wireguard peers
add allowed-address=10.11.12.0/24,192.168.88.0/24 comment="peer main router" interface=wg-office public-key=
"" endpoint=111.111.111.111 endpointport=22522 persistent-keep-alive=45s
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,1.0.0.1
/ip dns static
add address=192.168.111.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked"
connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=
127.0.0.1
add action=accept chain=input comment="Admin access" src-address-list=Authorized
add action=accept chain=input comment="DNS LAN" in-interface-list=LAN dst-port=53 protocol=udp
add action=accept chain=input comment="DNS LAN" in-interface-list=LAN dst-port=53 protocol=tcp
add action=drop chain=input comment="Drop All Else" { Make this the last rule you enter to not lock yourself out }
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=
established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked"
connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=forward comment="internet" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward in-interface=wg-office src-address=10.11.12.13/32 dst-address=192.168.111.0/24 comment="SN user to lan subnet"
add action=accept chain=forward in-interface=wg-office src-address=192.168.88.0/24 dst-address=192.168.111.0/24 comment="backup r1 to r2 subnets"
add action=accept chain=forward src-address=192.168.111.0/24 dst-address=192.168.88.0/24 out-interface=wg-office comment="backup path to R1 if required"
add action=accept chain=forward comment="port forwarding" connection-nat-state=dstnat
add action=drop chain=forward comment="Drop All Else"
/ip route
add comment="primary gateway" distance=2 gateway=192.168.1.1
add comment="secondary gateway" distance=3 gateway=192.168.222.1
add distance=1 dst-address=192.168.88.0/24 gateway=l2tp-out1 pref-src=192.168.111.1
add distance=2 dst-address=192.168.88.0/24 gateway=wg-office comment="backup if L2TP down"
/tool mac-server
set allowed-interface-list=NONE
/tool mac-server mac-winbox
set allowed-interface-list=LAN

FIREWALL ACCESS LIST TO only allow Admin to CONFIG ROUTER - used on Both R1 and R2.

/ip firewall address-list { mostly from static DHCP leases at local routers and remote wg addresses }
add address=192.168.88.AB list=Authorized comment="admin desktop MAIN local at router R1 - wired"
add address=192.168.88.CD list=Authorized comment="admin laptop MAIN local at router R1 -wifi "
add address=192.168.88.EF list=Authorized comment="admin ipad/smartphone MAIN local at router R1 - wifi"
add address=192.168.111.GH list=Authorized comment="admin desktop local OFFICE local at router R2 - wired"
add address=192.168.111.JK list=Authorized comment="admin laptop OFFICE local at router R2 -wifi "
add address=192.168.111.LM list=Authorized comment="admin ipad/smartphone OFFICE local at router R2 - wifi"
add address=10.11.12.13/32 list=Authorized comment="REMOTE admin SN user"