Hmmm, not much there.
(1) The mac-server by itself is not using a secure protocol and should be set to NONE.
/tool mac-server
set allowed-interface-list=LAN
(2) You are missing the fact that you need to send out your subnet through the tunnel.
I dont see any IP routes so assuming you set the route “add default route” in your IP DHCP client settings.
You need to uncheck that and make routes manually so it will all be clear.
something as simple as:
add dst-address=0.0.0.0/0 gwy=ISPgatewayIP
Then you need to add 3 thiings.
a. routing table
b. routing rule
c. route
/routing table add name=useWG fib
/routing rule add src-address=192.168.88.0/24 action=lookup table=useWG
note: If you used action=lookup-only-in-table, then if the wireguard connection was down, there would be no internet access at all. With the current setting I prescribed, the router if the wireguard is down, will go back to the main table and find the local route through the local WANIP and router users out to the internet.
YOUR ROUTES
add dst-address=0.0.0.0/0 gwy=ISPgatewayIP
add dst-address=0.0.0.0/0 gwy=wireguard-vpn table=useWG
(3) We also have to consider whether or not source nat is required for wireguard traffic.
WHERE ARE YOU SENDING THIS TRAFFIC TOO? If the mt router is a client what is the server???
a. if another mT router elsewhere and the allowed IPs include 192.168.88.0/24, no need for anything on sourcenat
b. if a third party VPN provider then they are expecting all traffic to have the IP 10.0.8.13 and thus you need this additional nat rule…
add chain=srcnat action=masquerade out-interface=wireguard-vpn
(4) As far as firewall rules go, there is nothing block your LAN to go out wireguard as the default rules are loosely goosey so its not clear what is or isnt allowed.
Better to be a tad more explicit at least in the forward chain.
FROM:
add action=accept chain=forward comment=“defconf: accept in ipsec policy”
ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy”
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=
“defconf: accept established,related, untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid”
connection-state=invalid
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
TO:
add action=accept chain=forward comment=“defconf: accept in ipsec policy”
ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy”
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=
“defconf: accept established,related, untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid”
connection-state=invalid
add action=accept chain=forward comment=“allow normal internet” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“to wg tunnel for internet” in-interface-list=LAN out-interface=wireguard-vpn
add action=accept chain=forward comment=“allow port forwarding” connection-nat-state=dstnat
add action=drop chain=forward comment=“drop all else”
