A very messy config. I wouldnt bother with regex layer7 attemtps to block social media, waste of time.
Also more rules disabled then enabled and the config should be removed of all noise that is not used.
Makes it very hard to spot errors.
-
Dont forget to add persistent-keep-alive to proton wireguard peer settings.
2 No clue as to you WAN situation, it would appear you have two wans but not sure.
PPPOE client and IP DHCP Client on ether2… -
You have weird MTU settings all over the map and then a script for MTU that I dont understand under ppp profile.
-
You seem to have a subnet spread over two ports, ether5 and ether4, not even sure if this is legal LOL.
-
You have a set of complex firewall rules, that I cannot fathom so cannot help you there either.
-
In terms of routes I see the proton route, but not sure why you have any distance associated with it as its in its own table??
-
You have two mangle rules for proton VPN
add action=mark-routing chain=prerouting comment=RotaVPN dst-address-list=
RotaVPN new-routing-mark=RotaProtonVPN
add action=mark-routing chain=prerouting comment=“RotaVPN Full”
dst-address-list=!RedeLocal new-routing-mark=RotaProtonVPN
src-address-list=VPN
However to be clear the first rule captures a small bit of traffic, to specific URLs to go through wireguard. It only states traffic heading towards
add address=abs.twimg.com comment=X list=RotaVPN
add address=api.x.com comment=X list=RotaVPN
add address=video.twimg.com comment=X list=RotaVPN
Can you confirm that the router in the source address list resolves these to IP addresses?
In other words, under the firewall address table there should be two entries, the one you entered and right below an associated resolved address!
MYWAN ADDRESS:xxbYYce5866.sn.mynetname.net
(D) MYWAN ADDRESS: 145.23.236.15
If SO, then that would seem to be okay. If an URL doesnt resolve, it should be removed.
THe second entry seems to state only a few IPs in the subnet need to go out wireguard. Seems to be okay, just added passthough=no for each rule.
I would do the following
add action=mark-routing chain=prerouting comment=RotaVPN dst-address-list=
RotaVPN new-routing-mark=RotaProtonVPN passthrough=no
add action=mark-routing chain=prerouting comment=“RotaVPN Full”
dst-address-list=!RedeLocal new-routing-mark=RotaProtonVPN
src-address-list=VPN passthrough=no
++++++++++++++++++++++++++++++
Overall Summary. You should scrap your entire config, its overly cooked and should be simplified starting from scratch. Unless its very clear and working for you of course.
a. draw a network diagram of devices and planned subnets (use vlans when it makes sense to do so and I believe it does in your case → http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1 )
b. IDENTIFY all user(s)/devices, internal and external and admin
c. IDENTIFY all the traffic they require to pass.
Provide details on WAN(s), type, throughput, static/dynamic, public/private etc. and any external traffic coming in.
Provide details on router services being used