Do NOT disable fastrack!!
Post your wireguard config and will have a look.
/export file=anynameyou wish.
Assuming the VPN site gave you
a. endpoint IP
b. endpoint port
c. Ip address for you to use as client probably something like 172.24.20.2/32
d. public Key to stick into the MT Peer settings for the VPN service.
Assuming you passed to the VPN site
a. your public key from the wireguard interface definition (name=wireguard1) to give to the peer setting on the remote site, in this case the VPN provider.
++++++++++++++++++++++++++++++++++++
On your PEER Settings on the MT
a.- Allowed IPs 0.0.0.0/0
b.- KEEP alive, use something like 40 seconds.
++++++++++++++++++++++++++++++++++
On the MT router (assuming the subnet needing internet is 192.168.10.0/24)
(1) ADD IP address 172.24.20**.2/24** interface=wireguard1
(2) Firewall Rules add chain=forward action=accept src=address=192.168.10.0/24 out-interface=wireguard1
(3) IP ROUTES.
Assuming you already either have a existing dynamic default route for your ISP (due to on IP DHCP client stating add default route=yes), or a manually created route.
dst-address=0.0.0.0/0 gateway=ISP gwy IP table=main.
You need an additional Route and an associated table and as many route rules as subnets…
Create table
/routing table add name=useWG fib
Create additional route
/ip route
dst-address=0.0.0.0/0 gwy=wireguard1 table=useWG
Create Route rules.
/route rule add src-address=subnet-1 action=lookup table=useWG
/route rule add scr-address=subnet-2 action=lookup table=useWG
…
/route rule add src-address=subnet-last action=lookup table=useWG
Note1: Using action=lookup means, that if the wireguard tunnel is down the router will look at the main table and find a route so users could go out normal ISP for internet.
Note2: if you use action=lookup-only-in-table, if the wireguard tunnel is not working, then no internet will be found as the router will not look for an alternative route.
(4) Finally the tricky part, and the most often overlooked part. SOURCE-NAT
Think about this, what do you think the ALLOWED IP PEER setting is at the server… What source IP addresses is it expecting to come from your side…
The answer is 172.24.20.2
Answer the next question… What source IPs do you have at the moment hitting tunnel.
answer IPs from subnets 1,2… Last (a gazillion IPs and none of the what the server is expecting.
What will be the result? The third party Wireguard Crypto processing will drop all your traffic.
SOLUTION: we have to source nat all the subnet traffic.
So your source nat rules would look like.
Option 1:
/interface list
add name=WAN
add name=LAN
/interface list members
add interface=bridge list=LAN
add interface=ether1 list=WAN
add interface=wireguard1 list=WAN
/ip firewall nat
add chain=srcnat action=masquerade out-interface-list=WAN
…
OR if you dont add the wireguard interface to the WAN interface list
Option 2:
/ip firewall nat
add chain=srcnat action=masquerade out-interface=ether1 ( assuming ether1 is the name of your WAN interface, it could be pppoe-1, or a vlan etc.)
add chain=srcnat action=masquerade out-interface=wireguard1