Kleshki, one needs to actually read the OPs post, he stated that in the end he disabled the rule, so it should be no surprize to find it ‘disabled’.
I would tend to find other things’out of the ordinary’
1 - Being a DNS idiot, but this looks funny to me…
/ip dns
set allow-remote-requests=yes use-doh-server=https://dns.google/dns-query
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
add address=8.8.8.8 name=dns.google type=A
add address=8.8.4.4 name=dns.google type=A
Assuming that for google DOH, one needs to reach the unencrypted google DNS service first and thus the reason for the 2nd, 3rd static rules ???
But why do you need the first rule for 192.168.88.1 ???
2. Why is your rule structured like this…
add action=accept chain=input dst-address-list=myIP **dst-port=8291,**443
protocol=tcp
You have an IP address for the WANIP of the router, so I assumed its a fixed/static Private IP???
If its not then it should be entered via IP DHCP client or pppoe client etc…
Why do you open up your winbox port open to the internet??? Not a good idea, it should be accessed locally from the LAN or after reaching the router through a VPN.
I mean why have back to home Wireguard and then do this??
- Possible winner! Your fastrack rule makes sense to me in that you have added no-mark, so I expect to find some mangling.
But why on earth are you butchering the standard forward chain accept established,related,untracked rule ???
add action=accept chain=forward comment=
“defconf: accept established,related, untracked” connection-mark=no-mark
connection-state=established,related,untracked routing-mark=main
- Looking at your mangling it looks like you want all traffic heading out the WAN for anything other than specific WANIPs, to use the special table instead.
Okay thats reasonable. Adjusted slightly in order and changed/removed some things ( no need for output chain )!! Misconfiguration also may cause some issues.
/ip firewall mangle
add action=change-mss chain=forward comment=“clamp to pmtu” new-mss=
clamp-to-pmtu out-interface=l2tp-out1 passthrough=yes protocol=tcp
tcp-flags=syn
add action=mark-connection chain=forward connection-mark=no-mark
dst-address-list=!XX dst-address-type=!local in-interface-list=LAN
new-connection-mark=conn_ipsec1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=conn_ipsec1
new-routing-mark=ipsec1 passthrough=no
(no requirement for new connection on mark-connection rule and forward chain is more accurate)
(no requirement for in-interface–list=LAN on mark-routing rule)
(passthrough=no for mark-routing rule)
-
Distance on the Special Table route rule is meaningless ( in fact for both route rules ) as there are no other routes available for either table.
-
Not critical but if IVP6 is not being used.
/ipv6 settings
set disable-ipv6=yes
Then copy ipv6 firewall rules and address lists to a file for potential later use and REMOVE. Replace with
add chain=input action=drop
add chain=forward action=drop
-
Same with insecure protocol access (mac-server only) to winbox modify the below to:
/tool mac-server
set allowed-interface-list=NONE
/tool mac-server mac-winbox
set allowed-interface-list=LAN
-
Other observations, confirming that you are connecting to a router service https (www=ssl) I suppose to supplement wireguard connectivity to configure the router maybe ???
