(1) The config report by the Router points you to a problem. That problem is you either assign an address to the WAN or your use IP DHCP CLIENT but not both…
Also your configuration for the network setting for IP address is wrong if IP address is the method you choose to stick with!
/ip address
…
…
add address=86.x.y.z/29 interface=ether1 network=86.x.y**.0**
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1
# DHCP client can not run on slave or passthrough interface
(2) Remove old default static address…
/ip dns static
add address=10.0.0.1 comment=defconf name=router.lan
(3) This rule in the input chain makes ZERO SENSE TO ME.
In your text you stated you are running an apache server ON THE LAN, at port 80. Why do you have wireguard coming in on the input chain TO ROUTER SERVICES for port 80??
Remove this rule.
add action=accept chain=input dst-port=80 in-interface=wireguard1 protocol=
tcp
I suspect what you want is to be able to reach the server from wireguard and that would be a forward chain rule!
(4) By the way if the router is server for handshake, then you dont need any wireguard rules in input chain (except for handshake port of course), because you allow all LAN traffic access to the router.
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
in-interface-list=!LAN
(5) Modify forward chain to be clearer and better for port forwarding. What you have by default rules is now inadequate.
Replace Rule:
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
WITH:
add action=accept chain=forward comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat
add action=accept chain=forward comment=“wg to subnets” in-interface=wireguard dst-address=10.0.0.0/16
add action=drop chain=forward comment=“Drop all else”
(6) SOURCENAT RULES
/ip firewall nat
add action=masquerade chain=srcnat dst-address=10.0.0.0/16 src-address=10.0.0.0/16 comment=“hairpin nat rule”
add action=masquerade chain=srcnat comment=“defconf: masquerade”
ipsec-policy=out,none out-interface-list=WAN
(7) DSTNAT RULES
The format as per your first rule is CORRECT!!!
add action=dst-nat chain=dstnat dst-address=86.x.y.z dst-port=2495
protocol=tcp to-addresses=10.0.0.4
All of them should be the same, in some cases you revert back to in-interface-list=WAN, they may or may not work,
but should be in the format for fixed static IP, and certainly any being accessed both internally by domain name must be in correct format.
For example, if you wanIP was dynamic, then you would create a firewall list to mimic a dst-address BY USING a dst-address-list entry!!
(8) Dont recomment unsecure access to the router
/ip service
set www port=8080
