I'm going to assume that this is a continuation of this question: VPN to Add Address Range
It's always polite to include a diagram, which is useful for your own internal documentation as well, or a short description of your scenario.
The problem with your current config is that you're trying to assign an address to the vpn client from the target (machine) subnet. Although this is ultimately possible, this is not the idiomatic configuration - wireguard is usually set up as a purely routed configuration.
So, these are the steps I'd suggest:
- Remove the VPNPool. It could stay, but it's useless.
- Select another subnet just for the VPN, and an address on it for the Mikrotik and for the client. Let's choose 172.22.0.0/24 for the subnet, 172.22.0.1 for the router and 172.22.0.11 for this client.
- Add the address
/ip address add address=172.22.0.1/24 interface=WireGuard - Correct the router-side wg peer config to allowed-address=172.22.0.11/32
- Correct the client-side wg config to address=172.22.0.11, and allowed ips to 10.10.1.0/24,172.22.0.0/24 (the latter subnet is only recommended for a neater config). Also, ensure that you have a PersistentKeepalive=25 in the [Peer] section.
Now you should be able to ping 172.22.0.1 and 10.10.1.1 from the client. If all is well, you should also be able to ping the devices.
An additional masquerade rule may be needed: /ip firewall nat add chain=srcnat action=masquerade out-interface=LAN3 src-address=172.22.0.0/24 This is to make the devices think that all connections to them are initiated from their own subnet, instead of through a vpn. Some devices need this, some don't.
EDIT: This is based on your posted configuration, without the added bridge or firewall rules. Both are good ideas, but the bridge is not strictly necessary, and the firewall (if needed) is something you can afford to figure out after basic connectivity is established and verified.