I continued to debug and the issue is, as I stated, that RouterOS uses the wrong source address which should be handled via pref-src. Since this is a new topic, I started a new thread: http://forum.mikrotik.com/t/routeros-blatantly-ignores-pref-src-can-this-really-be-a-bug/180360/1
it’s obviously re written somewhere. either you have source nat on your interface or something else?
No, I describe it in the post above. I assume it’s a bug (or at least very bad implementation) of wireguard that does not set source address properly when generating local packets. For local packets without explicit source address, if there are multiple IP addresses, the operating system needs to decide which one to use. And RouterOS decides to use the wrong one (and ignores my request to use the correct one)
for your wireguard problem - why don’t you just make it to listen on the wan interface ip? just for simplicity because you hated nat?
Oh gosh, I wish life (RouterOS) would be so hassle free.
This was my first obvious idea but if I don’t miss anything simple, that’s not possible: RouterOS does not allow wireguard to “bind” or “listen” on a specific interface. It just listens on every interface on the router! Crazy, but yeah, that’s sadly how it is. “Bugfixes” are to use firewall filters but this clearly doesn’t fix the issue I am seeing.