We are making progress.
I understand that you have some users that are able to use the ISP VDSL device for wifi which is great.
However the MT router also needs to be able to access the ISP VDSL connection to establish the proton tunnel.
This is fine.
I just need to know how you are connected to the ISP VDSL.
Do you simply set the WANIP via IP address ( since its private you dont need to hide it)
Probably something like 192.168.1.2 ??
/ip address
add address=192.168.1.2/24 interface=ether1 network=192.168.1.0
or via IP DHCP client
add interface=ether1 set peer dns=no
+++++++++++++++++++++++++++++++++++++++++++++++++
Assuming something like the above we can make progress.
I think the important thing is to ensure the DNS of the users going out wireguard does not leak out to ISP VDSL.
We will handle that. Also for now please change ip address of bridge to .1 instead of .9
One major error is making your bridge the IP DHCP client → this is fundamentally wrong
Ether1 is the interface connected to the ISP VDSL not the bridge. The bridge is natted behind the router and has nothing to do with WANIP termination.
You failed to remove the bad routes, please do so.
Added mangle rule which helps better performance accessing sites thru 3rd party wireguard.
/interface bridge
add name=bridge
/interface wireguard
add listen-port=13231 mtu=1420 name=P-CH-159 private-key=
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/routing table
add disabled=no fib name=useWG
/interface bridge port
add bridge=bridge interface=ether1
add bridge=bridge interface=ether2
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add interface=ether1 list=WAN
add interface=bridge list=LAN
add interface=P-CH-159 list=WAN
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=149.88.27.232 endpoint-port=51820 interface=P-CH-159 name=peer-P-CH-159 persistent-keepalive=25s public-key=
/ip address
add address=10.2.0.2/30 interface=P-CH-159 network=10.2.0.0
add address=192.168.88**.1/**24 interface=bridge network=192.168.88.0
/ip dhcp-client
add add-default-route=no interface=ether1 use-peer-dns=no
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=10.2.0.1 gateway=192.168.88.1
/ip dns
set servers=1.1.1.1,10.2.0.1
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
add chain=dstnat action=dst-nat src-address=192.168.88.0/24 dst-port=53 protocol=udp to-address=10.2.0.1
add chain=dstnat action=dst-nat src-address=192.168.88.0/24 dst-port=53 protocol=tcp to-address=10.2.0.1
/ip firewall mangle
add action=change-mss chain=forward comment=“Clamp MSS to PMTU for Outgoing packets” new-mss=clamp-to-pmtu out-interface=P-CH-159 passthrough=yes protocol=tcp tcp-flags=syn
/ip firewall service-port
set ftp disabled=yes
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip route
add dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=main
add dst-address=0.0.0.0/0 gateway=P-CH-159 routing-table=useWG
/routing rule
add action=lookup-only-in-table comment=“allow local traffic” min-prefix=0
table=main
add action=lookup-only-in-table src-address=192.168.88.0/24 table=useWG
/system identity
set name=test-RB750Gr3
/system note
set show-at-login=no
