[Edit] replaced original post because it was too general - try again more specific 
Hi,
I’m new to this board and I recently bought a hAP ac2.
After some struggling with the fiber-adapter & my ISP-settings (I do need a specific vlan-tagging for all outgoing traffic…), it now works like a charm.
My next project is to use a specific VLAN to route every traffic through a wireguard tunnel.
I already configured a separate VLAN (30) for these ports and my wireguard tunnel is up and running.
I tested ether3 with a device and it already gets a 192.168.80.0/24 address and has access to the internet.
But I do need help with the last step - how to route the whole VLAN30 traffic through the wireguard tunnel.
I tried with some firewall and routing rules, but I just bricked the VLAN30 traffic without success.
Thank you for your help!
Here’s my config:
# 2024-07-05 12:43:42 by RouterOS 7.15.2
# software id = MRVG-J4JI
#4
# model = C52iG-5HaxD2HaxD
# serial number = ***
/interface bridge
add admin-mac=48:A9:8A:DA:A7:5D auto-mac=no comment=defconf name=bridge \
vlan-filtering=yes
/interface wireguard
add listen-port=26840 mtu=1420 name=wireguard1
/interface vlan
add interface=ether1 name=ether1.1 vlan-id=2
add interface=bridge name=vlan30 vlan-id=30
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1.1 name=pppoe-out1 \
use-peer-dns=yes user=4036121000
/interface list
add name=WAN
add name=LAN
add name=WAN2
/interface wifi datapath
add bridge=bridge comment=defconf disabled=no name=capdp
/interface wifi
set [ find default-name=wifi1 ] configuration.mode=ap .ssid=P-Wave datapath=\
capdp disabled=no security.connect-priority=0
set [ find default-name=wifi2 ] configuration.mode=ap .ssid=P-Wave datapath=\
capdp disabled=no security.connect-priority=0
/ip ipsec policy group
add name=Philipp
/ip pool
add name=dhcp ranges=192.168.88.0/24
add name=dhcp_vlan30 ranges=192.168.80.2-192.168.80.254
/ip dhcp-server
add address-pool=dhcp interface=bridge name=defconf
add address-pool=dhcp_vlan30 interface=vlan30 name=dhcp_vlan30
/interface bridge port
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3 pvid=30
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
/interface bridge settings
set use-ip-firewall=yes use-ip-firewall-for-vlan=yes
/interface bridge vlan
add bridge=bridge tagged=bridge vlan-ids=30
/interface list
add include=LAN,*2000012 name=INTERN
/interface list member
add comment=defconf interface=ether1 list=WAN
add interface=bridge list=LAN
add interface=pppoe-out1 list=WAN
add interface=vlan30 list=LAN
/interface wifi cap
set discovery-interfaces=bridge enabled=yes slaves-datapath=capdp
/interface wireguard peers
add allowed-address=192.168.1.0/24 endpoint-address=\
***.myfritz.net endpoint-port=59599 interface=wireguard1 \
name=peer2 persistent-keepalive=25s preshared-key="****" public-key=\
"***"
/ip address
add address=192.168.88.1/24 interface=bridge network=192.168.88.0
add address=192.168.80.1/24 interface=vlan30 network=192.168.80.0
add address=10.255.255.1/30 interface=*D network=10.255.255.0
/ip dhcp-client
add comment=defconf interface=bridge use-peer-dns=no
/ip dhcp-server network
add address=0.0.0.0/24 dns-server=0.0.0.0 gateway=0.0.0.0 netmask=24
add address=192.168.80.0/24 comment=vlan30 dns-server=192.168.80.1 gateway=\
192.168.80.1
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.88.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!INTERN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: acept our ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATED" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=change-mss chain=forward log-prefix=MSS new-mss=1420 \
out-interface=pppoe-out1 passthrough=yes protocol=tcp tcp-flags=syn
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN src-address=192.168.88.0/24
add action=masquerade chain=srcnat comment="gerasdorf: vlan" \
out-interface-list=WAN src-address=192.168.80.0/24
/ip service
set ftp disabled=yes
set api disabled=yes
set winbox disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=Europe/Vienna
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
