Good morning,
(1) Your wireguard settings on the Router are correct.
(2) As I mentioned on my first post, the settings on the Client ( Laptop ) for the router peer should only have one entry 0.0.0.0/0
That covers off both internet traffic and any remote traffic desired to reach the subnets at the router.
If you didnt want internet then the peer settings would be
10.11.0.1,192.168.88.0/24
(3) No additional routes are required, on the router, because the router creates one automatically
dst-address=10.11.0.0/24 gwy=MYVPN
(4) Due to the nature of the firewall rules, nothing should be blocking your traffic to the subnets either.
So its a bit of a mystery at this point.
+++++++++++++++++++++++++++++++++++++++++++++++++++
In any case we will do a few things..
(5) Add the wireguard interface as a LAN list member. Without changing firewall rules that will enable you to config the router
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=MYVPN list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
This is due to the input chain dropping anything not coming from the LAN. With wireguard included in the LAN list, you should be able to reach the router itself for configuration purposes.
(6) On the forward chain side we will be a bit more aggressive and take the one default rule and modify it etc…
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
TO:
add action=accept chain=forward in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat
add action=drop chain=forward comment=“drop all else”
What we have done is take a complex rule with implied functionality into much clearer and better security rules.
from stating drop all traffic from the WAN that is not meant for port forwarding ( and allow everything else )
We go to stating. allow internet traffic originating from the LAN, allow port forwarding, drop everything else ( allow only what we want and drop everything else )
(7) If you are still having issue after this, then I would look at windows based laptops as the problem ( w11 doesnt play nice and often they have firewalls that get in the way )
(