Hi,
I am finding it difficult to understand what you are saying, but I will assume the mikrotik has 3 public ip addresses on it.
And the incoming wg packets all come into the mikrotik via either the 2.249 or 2.253 interfaces but directed at the .210 address.
Normally for this, I would use routing rules to send the return packets out the correct port based on source address.
But in this case the source address is always .210
I think in this case you can use a dst-nat rule that should (maybe) work.
From: Wireguard in 2nd WAN - #18 by sciensys
/ip firewall nat
chain=dstnat dst-address-type=local in-interface=WAN2 protocol=udp dst-port=wg-port action=dst-nat to-addresses=ip.of.wan.1
WAN2 has the higher route metric.
and from
Perhaps the following, (sorry not tested).
/ip firewall nat
chain=dstnat dst-address-type=local in-interface=WAN2 protocol=udp dst-port=wg-port action=dst-nat to-addresses=ip.of.wan.2
Then some routing rules.
/routing rule
add action=lookup comment="min-prefix=0, all except 0.0.0.0/0" disabled=no min-prefix=0 table=main
add action=lookup comment="return path for wg/openvpn into WAN2" disabled=no src-address=ip.of.wan.2 table=viawan2
rest fall through to default behaviour.
Then a route for viawan2.
/route
add comment="viawan2" disabled=no distance=50 dst-address=0.0.0.0/0 gateway=192.?.?.? routing-table=viawan2