Some thoughts.
A rough outline of what I would do.
To hopefully create an approximation to what you appear to want.
(Sorry there will likely be errors in this)
This assumes somewhere near default config of the Mikrotiks.
With a LAN interface list.
The 192.168.169.0/24 is broken up into a bunch of /28 (or smaller) subnets.
Each router can have 1 or more subnets from this assigned to it.
(Ideally contiguous, but…)
Another address range 192.168.170.0/24 will be assigned to the wireguard interfaces.
(Mainly for diagnostic purposes)
R1 will have 192.168.169.1/28 assigned to its bridge.
Subnet range 192.168.169.64/28 will also be assigned to this router.
192.168.70.1/24 is assigned to Wireguard1
R2 will have 192.168.169.16/28 assigned to its bridge.
192.168.70.2/24 is assigned to Wireguard1
R3 will have 192.168.169.32/28 assigned to its bridge.
192.168.70.3/24 is assigned to Wireguard1
All routers will have the following static route added to them.
192.168.169.0/24 via wireguard1
(They will also have a 192.168.169.xx/28 via their bridge from their IP address setting)
All routers will have wireguard1 added to the LAN interface list.
(Later perhaps a different list with more restrictions on access to router services)
Allowed IP List:
Each router’s wireguard1 interface has an allowed IP list of
192.168.169.0/24 and 192.168.170.0/24
DHCP Server:
Each router’s bridge dhcp server will have one or more IP address pools covering its ranges
The subnet mask handed out is /24
The default gateway is itself
DNS is itself?
The router’s IP address netmask is not /24 normally will be /28
eg.
R1 bridge DHCP server
R1 bridge ip address = 192.168.169.1/28 ← Note /28
DHCP Subnet mask /24
ip pools 192.168.169.2-192.168.169.15 and 192.168.169.64-192.168.169.80
(because 2 subnets assigned to R1)
Default Gateway 192.168.169.1
DNS 192.168.169.1
R1 also needs a static route 192.168.169.64/28 via Bridge for the 2nd subnet.
R2 bridge DHCP server
R2 bridge ip address = 192.168.169.1/28
DHCP Subnet mask /24
ip pool 192.168.169.17-192.168.169.31
Default Gateway 192.168.169.16
DNS 192.168.169.17
** Bridge Proxy Arp **
Each router’s bridge will need to have proxy arp enabled. ** Important **
So for example when an arp request is made from 192.168.169.3 (connected to R1)
for 192.168.169.20 (connected to R2), then R1 answers the Arp, gets the
packet and forwards it to wireguard and to the Ubuntu server which then
forwards to R2, and similar for the reply email.
Ubuntu Server
R1 wireguard peer will have allowed addresses of 192.168.169.0/28 and 192.168.170.1/32
R2 wireguard peer will have allowed addresses of 192.168.169.16/28 and 192.168.170.2/32
R3 wireguard peer will have allowed addresses of 192.168.169.32/28 and 192.168.170.3/32
Ubuntu server wireguard ip address can be 192.168.170.254/24
If Ubuntu requires a local 192.168.169.x network, perhaps 192.168.169.240/28
May need routes for 192.168.169.0/24 via Wireguard
Ubuntu Firewall will likely cause issues.
Should initially be able to ping the 192.168.170.x ip addresses to at least know the wireguard links
are connected.
Once this is working, if you require some layer 2 stuff between the router’s lans you could look at the following.
HOW TO: mDNS and SSDP over Wireguard
http://forum.mikrotik.com/t/how-to-mdns-and-ssdp-over-wireguard/165473/1
The complete SSDP + mDNS solution for network segmentation
http://forum.mikrotik.com/t/the-complete-ssdp-mdns-solution-for-network-segmentation/167825/1