Block access to my LAN via WireGuard

RouterOS General
1

Hi,

I have no experince with WireGuard.

I create a tunnel and I want to do as follow:
My internal lan is 192.168.21.0/24, the other lan is 192.168.3.0/24.

I want to access to the 192.168.3.0/24, but I don’t want that the other network is accessing on my lan.
I’ve created a firewall rule, but if I block the source address 192.168.3.0/24, my lan is also blocked to acces 192.168.3.0/24

chain=forward action=accept src-address=192.168.21.0/24 dst-address=192.168.3.0/24 out-interface=WireGuard-VPN
chain=forward action=drop src-address=192.168.3.0/24 dst-address=192.168.21.0/24 in-interface=WireGuard-VPN

Obviously is something that I miss, but I don’t understand what.

Thanks

2

(1) Draw a diagram of your network.
(2) post config
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys, etc. )

Read through this → https://forum.mikrotik.com/viewtopic.php?t=191442

Then read the script below and attempt to understand what each line means.
Note that

  • lets assume ether1 is an interface that is defined as being part of the interface list called WAN
  • lets assume that the bridge is an interface that is defined as being part of the interface list called LAN

Thus under each line, your task is to write what you think each rule is doing… ( except for the 127.0.0.1 rule as thats a grey area not fully explained - just to state the router needs it to do some internal work depending upon functionalities being used (capsman, wireguard etc…)

…
/ip firewall filter
{Input Chain}
add action=accept chain=input comment=“defconf: accept established,related,untracked” connection-state=established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
add action=accept chain=input in-interface-list=LAN
add action=drop chain=input comment=“drop all else” *****
{forward chain}
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related
add action=accept chain=forward comment=“defconf: accept established,related, untracked” connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=forward comment=“allow internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“allow port forwarding” connection-nat-state=dstnat disabled=yes { enable if required }
add action=drop chain=forward comment=“drop all else”
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade” out-interface-list=WAN