Once again, thank you so much for taking so much time and the thorough response.
Let me just first clarify the background: I would like the VPN (wireguard) server to be available from everywhere, no matter if internal or external networks, internet under 192.0.2.222:51820. To add a bit complication, the actual IP of the router is actually 192.0.2.210. However, there is/will be a backup router 192.0.2.211 which operates with VRRP on 192.0.2.222.
Indeed I studied the old thread again and this is how I got things working before I started with all of this VRF mess.
Having said that, it's not that I want to use/abuse the MACVLAN solution for this, but I was thinking it's the only way it can work.
I actually got something very similar to your first suggestion working already, even without SNAT but the issue is that it's just not the public IP then.
Unfortunately with your second solution, I am still not able to make it work. In fact, I run into the same issue from the original post In this thread: I see the response packet going out of vrf-as but nothing more:
/tool/sniffer/quick
Columns: INTERFACE, TIME, NUM, DIR, SRC-MAC, DST-MAC, VLAN, SRC-ADDRESS, DST-ADDRESS, PROTOCOL, SIZE, CPU
INTERFACE TIME NUM DIR SRC-MAC DST-MAC VLAN SRC-ADDRESS DST-ADDRESS PROTOCOL SIZE CPU
ether1 5.514 1 <- 70:8C:F2:C8:1A:F9 00:00:5E:00:01:03 3 10.227.79.104:62090 192.0.2.222:51820 ip:udp 194 2
br-main 5.514 2 <- 70:8C:F2:C8:1A:F9 00:00:5E:00:01:03 3 10.227.79.104:62090 192.0.2.222:51820 ip:udp 194 2
vlan3 5.514 3 <- 70:8C:F2:C8:1A:F9 00:00:5E:00:01:03 10.227.79.104:62090 192.0.2.222:51820 ip:udp 190 2
vrrp3 5.514 4 <- 70:8C:F2:C8:1A:F9 00:00:5E:00:01:03 10.227.79.104:62090 192.0.2.222:51820 ip:udp 190 2
xvrf-main2 5.514 5 -> 42:AF:7F:C1:F3:F7 C2:0E:AD:A6:FF:A4 172.18.1.21:62090 192.0.2.222:51820 ip:udp 190 2
br-xvrf 5.514 6 <- 42:AF:7F:C1:F3:F7 C2:0E:AD:A6:FF:A4 172.18.1.21:62090 192.0.2.222:51820 ip:udp 190 2
xvrf-as 5.514 7 <- 42:AF:7F:C1:F3:F7 C2:0E:AD:A6:FF:A4 172.18.1.21:62090 192.0.2.222:51820 ip:udp 190 2
vrf-as 5.515 8 -> BA:B9:5F:2D:46:9F BA:B9:5F:2D:46:9F 192.0.2.222:51820 172.18.1.21:62090 ip:udp 134 3
The logs show that wireguard responds:
And this is the conntrack table:
/ip/firewall/connection/print where dst-port=51820
Flags: S - SEEN-REPLY; A - ASSURED; C - CONFIRMED; s - SRCNAT
Columns: PROTOCOL, SRC-ADDRESS, SRC-PORT, DST-ADDRESS, DST-PORT, TIMEOUT, ORIG-RATE, REPL-RATE, ORIG-PACKETS, REPL-PACKETS, ORIG-BYTES, REPL-BYTES
PROTOCOL SRC-ADDRESS SRC-PORT DST-ADDRESS DST-PORT TIMEOUT ORIG-RATE REPL-RATE ORIG-PACKETS REPL-PACKETS ORIG-BYTES REPL-BYTES
0 SACs udp 172.18.1.21 62090 192.0.2.222 51820 2m57s 0bps 0bps 15 15 2 640 1 800
1 SACs udp 10.227.79.104 62090 192.0.2.222 51820 2m57s 0bps 0bps 15 15 2 640 1 800
I am aware that with this setup I have the ECMP route that you mentioned to avoid because 192.0.2.222 is also /32 on the VRRP interface. However, I removed it and it made no change. I don't think it's related to this.
So I think there must be something else wrong.
Now, if I think about it, I believe your second proposal is pretty much the same as the proposal in my initial post. The only difference is that your solution avoids the pref-src issue.
I am not sure which other thread you are referring to (this one?) but I think this doesnt apply here: As explained in that linked thread, there are two route lookups, an initial one (which sets pref-src) and a route adjustment step. The latter one is used for policy routing. In my original question I had the issue that the route was picked at the route adjustment stage (due to complex routing scenarios) but at this point the source address was already selected.
Now, #4 in original post of this thread does generate a route which is indeed consulted in the very initial routing step which is used to set the source address. You can see that it works, in original post wireguard is indeed answering from 192.0.2.222, as expected.
I tried removing that route and/or pref-src and it stopped working, so I'm pretty sure that's doing its job.
The issue that's left in both our cases is the same: Wireguard's response packet from 192.0.2.222 to 172.18.1.21 is stuck somewhere and does not proceed beyond vrf-as in both cases.
Have you tried out your proposal and did it work? If so, there must still be something wrong with my config.
If not, I am afraid hitting yet another RouterOS bug, possibly what you were saying here already:
To avoid unnecessary guesswork, I am sharing attached my full config for reference.
# 2026-08-02 18:03:59 by RouterOS 7.23.2
#
/interface bridge add name=br-main vlan-filtering=yes
/interface bridge add comment="XVRF Hack 1: Mikrotik" name=br-xvrf protocol-mode=none
/interface ethernet set [ find default-name=ether1 ] disable-running-check=no
/interface vlan add comment=FTTH interface=br-main name=vlan2 vlan-id=2
/interface vlan add comment=LAN interface=br-main name=vlan3 vlan-id=3
/interface vlan add comment=SRV interface=br-main name=vlan4 vlan-id=4
/interface vlan add comment=WWAN interface=br-main name=vlan33 vlan-id=33
/interface vlan add comment=DMZ44 interface=br-main name=vlan44 vlan-id=44
/interface vlan add comment=ADM interface=br-main name=vlan99 vlan-id=99
/interface macvlan add comment="XVRF Hack 2: Wireguard" interface=br-xvrf mac-address=C2:0E:AD:A6:FF:A4 name=xvrf-as
/interface macvlan add comment="XVRF Hack 1: Mikrotik" interface=br-xvrf mac-address=42:1F:9F:D0:56:08 name=xvrf-fiber
/interface macvlan add comment="XVRF Hack 1: Mikrotik" interface=br-xvrf mac-address=72:F1:22:8D:C8:A1 name=xvrf-main
/interface macvlan add comment="XVRF Hack 2: Wireguard" interface=br-xvrf mac-address=42:AF:7F:C1:F3:F7 name=xvrf-main2
/interface vrrp add interface=vlan3 name=vrrp3 sync-connection-tracking=yes vrid=3
/interface vrrp add interface=vlan4 name=vrrp4 vrid=4
/interface vrrp add interface=vlan44 name=vrrp44 vrid=44
/interface vrrp add interface=vlan99 name=vrrp99 vrid=99
/interface list add name=LAN
/interface list add comment="Admin Interfaces" name=ADM
/interface list add name=DMZ
/interface list add name=SRV
/interface list add name=WAN
/interface list add include=ADM,DMZ,LAN,SRV name=trusted
/interface list add name=routing_peers
/interface list add name=WANAS
/interface list add name=ISP
/interface list add comment="Interfaces with lower MTU, to fix MSS" name=mss_fix
/interface list add name=VLAN_33
/interface list add name=MOBILE
/interface list add comment="All interfaces that have 192.0.2 subnets" include=DMZ,WANAS name=MY_PREFIX
/interface list add include=LAN,SRV name=mdns_interfaces
/ip vrf add interfaces=vlan2,xvrf-fiber name=vrf-fiber
/ip vrf add interfaces=vlan33 name=vrf-lte
/interface wireguard add listen-port=51820 mtu=1360 name=wg-mobile vrf=vrf-as
/interface bridge port add bridge=br-main interface=ether1
/ip firewall connection tracking set enabled=yes
/ip neighbor discovery-settings set discover-interface-list=none lldp-med-net-policy-vlan=1
/interface bridge vlan add bridge=br-main tagged=br-main,ether1 vlan-ids=2
/interface bridge vlan add bridge=br-main tagged=br-main,ether1 vlan-ids=3
/interface bridge vlan add bridge=br-main tagged=br-main,ether1 vlan-ids=4
/interface bridge vlan add bridge=br-main tagged=br-main,ether1 vlan-ids=44
/interface bridge vlan add bridge=br-main tagged=br-main,ether1 vlan-ids=33
/interface bridge vlan add bridge=br-main tagged=br-main,ether1 vlan-ids=99
/interface detect-internet set internet-interface-list=static lan-interface-list=static wan-interface-list=static
/interface list member add interface=vlan3 list=LAN
/interface list member add interface=vlan99 list=ADM
/interface list member add interface=vlan2 list=WAN
/interface list member add interface=vlan44 list=DMZ
/interface list member add interface=vrrp3 list=LAN
/interface list member add interface=vlan4 list=SRV
/interface list member add interface=vlan2 list=ISP
/interface list member add interface=vlan33 list=ISP
/interface list member add interface=vrrp44 list=DMZ
/interface list member add interface=vrrp99 list=ADM
/interface list member add interface=vrrp4 list=SRV
/interface list member add interface=wg-mobile list=mss_fix
/interface list member add interface=wg-mobile list=MOBILE
/interface wireguard peers add allowed-address=10.227.33.10/32 client-address=10.227.33.10/24 client-allowed-address=::/0 interface=wg-mobile name=client1 public-key="Z1HVcPkTEdfVoDdgQmiBVzCqHY1+qZowPuRWeZr8gQQ=" responder=yes
/ip address add address=10.227.1.2/24 interface=vlan99 network=10.227.1.0
/ip address add address=10.227.4.2/24 interface=vlan4 network=10.227.4.0
/ip address add address=10.227.79.2/24 interface=vlan3 network=10.227.79.0
/ip address add address=192.0.2.210/28 interface=vlan44 network=192.0.2.208
/ip address add address=10.227.79.254 interface=vrrp3 network=10.227.79.254
/ip address add address=10.227.33.1/24 interface=wg-mobile network=10.227.33.0
/ip address add address=10.227.1.254 interface=vrrp99 network=10.227.1.254
/ip address add address=10.227.4.254 interface=vrrp4 network=10.227.4.254
/ip address add address=192.168.5.102/24 interface=vlan33 network=192.168.5.0
/ip address add address=192.0.2.222 interface=vrrp44 network=192.0.2.222
/ip address add address=172.18.0.20/24 comment="XVRF Hack 1: Mikrotik" interface=xvrf-main network=172.18.0.0
/ip address add address=172.18.0.21/24 comment="XVRF Hack 1: Mikrotik" interface=xvrf-fiber network=172.18.0.0
/ip address add address=192.0.2.222 interface=xvrf-as network=192.0.2.222
/ip address add address=172.18.1.21/24 interface=xvrf-main2 network=172.18.1.0
/ip arp add address=172.18.0.22 comment="VRF crossing: update" interface=xvrf-fiber mac-address=72:F1:22:8D:C8:A1
/ip arp add address=172.18.1.20 comment="#Hack Wireguard" interface=xvrf-main2 mac-address=C2:0E:AD:A6:FF:A4
/ip dhcp-client add check-gateway=ping default-route-tables=vrf-lte !dhcp-options interface=vlan33 name=client-lte use-peer-dns=no use-peer-ntp=no
/ip dhcp-client add check-gateway=ping default-route-tables=vrf-fiber interface=vlan2 name=client-fiber use-peer-ntp=no
/ip firewall address-list add address=10.227.0.0/16 list=own_hosts
/ip firewall address-list add address=192.0.2.0/24 list=own_hosts
/ip firewall address-list add address=0.0.0.0/8 comment="defconf: RFC6890" list=no_forward_ipv4
/ip firewall address-list add address=169.254.0.0/16 comment="defconf: RFC6890" list=no_forward_ipv4
/ip firewall address-list add address=224.0.0.0/4 comment="defconf: multicast" list=no_forward_ipv4
/ip firewall address-list add address=255.255.255.255 comment="defconf: RFC6890" list=no_forward_ipv4
/ip firewall address-list add address=127.0.0.0/8 comment="defconf: RFC6890" list=bad_ipv4
/ip firewall address-list add address=192.0.0.0/24 comment="defconf: RFC6890" list=bad_ipv4
/ip firewall address-list add address=192.0.2.0/24 comment="defconf: RFC6890 documentation" list=bad_ipv4
/ip firewall address-list add address=198.51.100.0/24 comment="defconf: RFC6890 documentation" list=bad_ipv4
/ip firewall address-list add address=203.0.113.0/24 comment="defconf: RFC6890 documentation" list=bad_ipv4
/ip firewall address-list add address=240.0.0.0/4 comment="defconf: RFC6890 reserved" list=bad_ipv4
/ip firewall address-list add address=0.0.0.0/8 comment="defconf: RFC6890" list=not_global_ipv4
/ip firewall address-list add address=10.0.0.0/8 comment="defconf: RFC6890" list=not_global_ipv4
/ip firewall address-list add address=100.64.0.0/10 comment="defconf: RFC6890" list=not_global_ipv4
/ip firewall address-list add address=169.254.0.0/16 comment="defconf: RFC6890" list=not_global_ipv4
/ip firewall address-list add address=172.16.0.0/12 comment="defconf: RFC6890" list=not_global_ipv4
/ip firewall address-list add address=192.0.0.0/29 comment="defconf: RFC6890" list=not_global_ipv4
/ip firewall address-list add address=192.168.0.0/16 comment="defconf: RFC6890" list=not_global_ipv4
/ip firewall address-list add address=198.18.0.0/15 comment="defconf: RFC6890 benchmark" list=not_global_ipv4
/ip firewall address-list add address=255.255.255.255 comment="defconf: RFC6890" list=not_global_ipv4
/ip firewall address-list add address=224.0.0.0/4 comment="defconf: multicast" list=bad_src_ipv4
/ip firewall address-list add address=255.255.255.255 comment="defconf: RFC6890" list=bad_src_ipv4
/ip firewall address-list add address=0.0.0.0/8 comment="defconf: RFC6890" list=bad_dst_ipv4
/ip firewall address-list add address=224.0.0.0/4 comment="defconf: RFC6890" list=bad_dst_ipv4
/ip firewall address-list add address=10.227.0.0/16 list=private_lans
/ip firewall address-list add address=192.168.0.0/16 list=private_lans
/ip firewall address-list add address=10.227.4.10 list=hairpin_dst
/ip firewall address-list add address=10.227.4.20 list=hairpin_dst
/ip firewall address-list add address=10.227.0.0/16 list=hairpin_src
/ip firewall address-list add address=192.0.2.210 list=localhost_as
/ip firewall address-list add address=192.0.2.222 list=localhost_as
/ip firewall filter add action=accept chain=input comment="defconf: accept ICMP after RAW" protocol=icmp
/ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
/ip firewall filter add action=accept chain=input comment="SSH access from everywhere" dst-port=1983 protocol=tcp
/ip firewall filter add action=accept chain=input comment="Wireguard server" dst-port=51820 protocol=udp
/ip firewall filter add action=accept chain=input comment=Winbox dst-port=8291 protocol=tcp src-address-list=private_lans
/ip firewall filter add action=accept chain=input comment="DNS server for own hosts" dst-port=53 protocol=udp src-address-list=own_hosts
/ip firewall filter add action=accept chain=input dst-port=53 protocol=tcp src-address-list=own_hosts
/ip firewall filter add action=accept chain=input comment="API (checkmk)" dst-port=8728 in-interface-list=SRV protocol=tcp src-address=10.227.4.12
/ip firewall filter add action=accept chain=input comment="SNMP (checkmk)" dst-port=161,162 in-interface-list=SRV protocol=udp src-address=10.227.4.12
/ip firewall filter add action=reject chain=input comment="defconf: drop all not coming from trusted" in-interface-list=!trusted reject-with=icmp-port-unreachable
/ip firewall filter add action=drop chain=input comment="Log & block everything else" log=yes log-prefix="[BLOCKED-IN]"
/ip firewall filter add action=accept chain=forward comment="XVRF: Allow ssh access from vrf-as" dst-port=1983 out-interface=vrf-main protocol=tcp src-address=192.0.2.0/24
/ip firewall filter add action=accept chain=forward comment="XVRF: Allow dns access from vrf-as" dst-port=53 out-interface=vrf-main protocol=udp src-address=192.0.2.0/24
/ip firewall filter add action=accept chain=forward comment="XVRF: Allow wireguard access from vrf-main. TODO: restrict again" dst-port=51820 protocol=udp
/ip firewall filter add action=accept chain=forward comment="XVRF: Allow wireguard access from vrf-main. TODO: restrict again" protocol=udp src-port=51820
/ip firewall filter add action=accept chain=forward comment="XVRF Hack 1: Mikrotik" dst-address=159.148.147.0/24
/ip firewall filter add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
/ip firewall filter add action=jump chain=forward comment=traffic_zones connection-state=new jump-target=traffic_zones
/ip firewall filter add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid log=yes log-prefix=INVALID
/ip firewall filter add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall filter add action=drop chain=forward comment="defconf: drop bad forward IPs" src-address-list=no_forward_ipv4
/ip firewall filter add action=drop chain=forward comment="defconf: drop bad forward IPs" dst-address-list=no_forward_ipv4
/ip firewall filter add action=accept chain=forward comment="Check if counters >0. If not, DROP here" log=yes log-prefix="[ACPT]"
/ip firewall filter add action=accept chain=traffic_zones comment=LAN->VPN in-interface-list=LAN out-interface-list=MOBILE
/ip firewall filter add action=accept chain=traffic_zones comment=LAN->SRV in-interface-list=LAN out-interface-list=SRV
/ip firewall filter add action=accept chain=traffic_zones comment="LAN->ADM (ToBeRestricted!!)" in-interface-list=LAN out-interface-list=ADM
/ip firewall filter add action=accept chain=traffic_zones comment=VPN->LAN in-interface-list=MOBILE out-interface-list=LAN
/ip firewall filter add action=accept chain=traffic_zones comment=VPN->SRV in-interface-list=MOBILE out-interface-list=SRV
/ip firewall filter add action=accept chain=traffic_zones comment="VPN->ADM (ToBeRestricted!!)" in-interface-list=MOBILE out-interface-list=ADM
/ip firewall mangle add action=mark-routing chain=output comment="XVRF PortFW: ssh" new-routing-mark=vrf-as out-interface=vrf-as protocol=tcp src-port=1983
/ip firewall mangle add action=mark-routing chain=output comment="XVRF PortFW: dns" new-routing-mark=vrf-as out-interface=vrf-as protocol=udp src-port=53
/ip firewall mangle add action=change-mss chain=forward comment="MSS/MTU fix for wg" new-mss=1380 out-interface-list=mss_fix protocol=tcp tcp-flags=syn tcp-mss=1381-65535
/ip firewall nat add action=dst-nat chain=dstnat comment="XVRF: Access ssh from vrf-as as 192.0.2.210" dst-address=192.0.2.222 dst-port=1983 in-interface-list=MY_PREFIX protocol=tcp src-address=192.0.2.0/24 to-addresses=10.227.4.254
/ip firewall nat add action=dst-nat chain=dstnat comment="XVRF: Access dns from vrf-as as 192.0.2.210" dst-address=192.0.2.222 dst-port=53 in-interface-list=MY_PREFIX protocol=udp src-address=192.0.2.0/24 to-addresses=10.227.4.254
/ip firewall nat add action=src-nat chain=srcnat comment="XVRF Hack 1: main VRF to fiber" out-interface=xvrf-main to-addresses=172.18.0.22
/ip firewall nat add action=masquerade chain=srcnat comment="XVRF Hack 1: main VRF to fiber" src-address=172.18.0.22
/ip firewall nat add action=masquerade chain=srcnat comment="Hairpin all PortFWs" dst-address-list=hairpin_dst src-address-list=hairpin_src
/ip firewall nat add action=masquerade chain=srcnat comment="defconf: masquerade WAN interface" out-interface=vlan2
/ip firewall nat add action=masquerade chain=srcnat comment="defconf: masquerade WAN interface" out-interface=vlan33
/ip firewall nat add action=src-nat chain=srcnat comment="srcnat WAN interface" out-interface-list=WANAS src-address=!192.0.2.0/24 to-addresses=192.0.2.210
/ip firewall raw add action=accept chain=prerouting comment="defconf: enable for transparent firewall"
/ip firewall raw add action=accept chain=prerouting comment="defconf: accept DHCP discover" dst-address=255.255.255.255 dst-port=67 in-interface-list=LAN protocol=udp src-address=0.0.0.0 src-port=68
/ip firewall raw add action=drop chain=prerouting comment="defconf: drop bogon IP's" src-address-list=bad_ipv4
/ip firewall raw add action=drop chain=prerouting comment="defconf: drop bogon IP's" dst-address-list=bad_ipv4
/ip firewall raw add action=drop chain=prerouting comment="defconf: drop bogon IP's" src-address-list=bad_src_ipv4
/ip firewall raw add action=drop chain=prerouting comment="defconf: drop bogon IP's" dst-address-list=bad_dst_ipv4
/ip firewall raw add action=drop chain=prerouting comment="defconf: drop non global from WAN" in-interface-list=WAN src-address-list=not_global_ipv4
/ip firewall raw add action=drop chain=prerouting comment="defconf: drop forward to local lan from WAN" dst-address-list=private_lans in-interface-list=WAN
/ip firewall raw add action=drop chain=prerouting comment="defconf: drop local if not from default IP range" in-interface-list=LAN src-address=!10.227.79.0/24
/ip firewall raw add action=drop chain=prerouting comment="defconf: drop bad UDP" port=0 protocol=udp
/ip firewall raw add action=jump chain=prerouting comment="defconf: jump to ICMP chain" jump-target=icmp4 protocol=icmp
/ip firewall raw add action=jump chain=prerouting comment="defconf: jump to TCP chain" jump-target=bad_tcp protocol=tcp
/ip firewall raw add action=accept chain=prerouting comment="defconf: accept everything else from LAN" in-interface-list=trusted
/ip firewall raw add action=accept chain=prerouting comment="defconf: accept everything else from WAN" in-interface-list=WAN
/ip firewall raw add action=drop chain=prerouting comment="defconf: drop the rest"
/ip firewall raw add action=drop chain=bad_tcp comment="defconf: TCP flag filter" protocol=tcp tcp-flags=!fin,!syn,!rst,!ack
/ip firewall raw add action=drop chain=bad_tcp comment=defconf protocol=tcp tcp-flags=fin,syn
/ip firewall raw add action=drop chain=bad_tcp comment=defconf protocol=tcp tcp-flags=fin,rst
/ip firewall raw add action=drop chain=bad_tcp comment=defconf protocol=tcp tcp-flags=fin,!ack
/ip firewall raw add action=drop chain=bad_tcp comment=defconf protocol=tcp tcp-flags=fin,urg
/ip firewall raw add action=drop chain=bad_tcp comment=defconf protocol=tcp tcp-flags=syn,rst
/ip firewall raw add action=drop chain=bad_tcp comment=defconf protocol=tcp tcp-flags=rst,urg
/ip firewall raw add action=drop chain=bad_tcp comment="defconf: TCP port 0 drop" port=0 protocol=tcp
/ip firewall raw add action=accept chain=icmp4 comment="defconf: echo reply" icmp-options=0:0 limit=5,10:packet protocol=icmp
/ip firewall raw add action=accept chain=icmp4 comment="defconf: net unreachable" icmp-options=3:0 protocol=icmp
/ip firewall raw add action=accept chain=icmp4 comment="defconf: host unreachable" icmp-options=3:1 protocol=icmp
/ip firewall raw add action=accept chain=icmp4 comment="defconf: protocol unreachable" icmp-options=3:2 protocol=icmp
/ip firewall raw add action=accept chain=icmp4 comment="defconf: port unreachable" icmp-options=3:3 protocol=icmp
/ip firewall raw add action=accept chain=icmp4 comment="defconf: fragmentation needed" icmp-options=3:4 protocol=icmp
/ip firewall raw add action=accept chain=icmp4 comment="defconf: echo" icmp-options=8:0 limit=5,10:packet protocol=icmp
/ip firewall raw add action=accept chain=icmp4 comment="defconf: time exceeded " icmp-options=11:0-255 protocol=icmp
/ip firewall raw add action=drop chain=icmp4 comment="defconf: drop other icmp" protocol=icmp
/ip route add comment="To reach LM1500" disabled=no distance=1 dst-address=192.168.5.1/32 gateway=vlan33@vrf-lte routing-table=vrf-main scope=30 target-scope=10
/ip route add disabled=no distance=1 dst-address=10.227.1.0/24 gateway=vlan99@vrf-main routing-table=vrf-fiber scope=30 target-scope=10
/ip route add disabled=no distance=1 dst-address=10.227.4.0/24 gateway=vlan4@vrf-main routing-table=vrf-fiber scope=30 target-scope=10
/ip route add disabled=no distance=1 dst-address=10.227.33.0/24 gateway=wg-mobile@vrf-main routing-table=vrf-fiber scope=30 target-scope=10
/ip route add disabled=no distance=1 dst-address=10.227.79.0/24 gateway=vlan3@vrf-main routing-table=vrf-fiber scope=30 target-scope=10
/ip route add comment="VRF crossing: Mikrotik" disabled=no distance=1 dst-address=159.148.147.0/24 gateway=172.18.0.21%xvrf-main routing-table=main scope=30 target-scope=10
/ip route add disabled=no distance=1 dst-address=10.227.4.0/24 gateway=vlan4@vrf-main routing-table=vrf-as scope=30 target-scope=10
/ip route add disabled=no distance=1 dst-address=10.227.33.0/24 gateway=wg-mobile@vrf-main routing-table=vrf-as scope=30 target-scope=10
/ip route add disabled=no distance=1 dst-address=10.227.79.0/24 gateway=vlan3@vrf-main routing-table=vrf-as scope=30 target-scope=10
/ip route add comment="TODO: replace by dynamic route leaking (all 192.0.2/24)" disabled=no distance=1 dst-address=192.0.2.208/28 gateway=vlan44@vrf-as routing-table=vrf-main scope=30 target-scope=10
/ip route add comment="For making watchdog work" disabled=no distance=1 dst-address=8.8.8.8/32 gateway=vlan2@vrf-fiber routing-table=main scope=30 target-scope=10
/ip route add comment="For making watchdog work" disabled=no distance=10 dst-address=8.8.8.8/32 gateway=vlan33@vrf-lte routing-table=main scope=30 target-scope=10
/ip route add disabled=no distance=1 dst-address=10.227.1.0/24 gateway=vlan99@vrf-main routing-table=vrf-lte scope=30 target-scope=10
/ip route add disabled=no distance=1 dst-address=10.227.4.0/24 gateway=vlan4@vrf-main routing-table=vrf-lte scope=30 target-scope=10
/ip route add disabled=no distance=1 dst-address=10.227.33.0/24 gateway=wg-mobile@vrf-main routing-table=vrf-lte scope=30 target-scope=10
/ip route add disabled=no distance=1 dst-address=10.227.79.0/24 gateway=vlan3@vrf-main routing-table=vrf-lte scope=30 target-scope=10
/ip route add comment="XVRF: Access services@vrf-main from vrf-as" disabled=no distance=1 dst-address=10.227.4.2/32 gateway=vrf-main@vrf-main routing-table=vrf-as scope=30 target-scope=10
/ip route add comment="XVRF: Access services@vrf-main from vrf-as" disabled=no distance=1 dst-address=10.227.4.254/32 gateway=vrf-main@vrf-main routing-table=vrf-as scope=30 target-scope=10
/ip route add disabled=no dst-address=172.18.2.1/32 gateway=vrf-as@vrf-as routing-table=vrf-main
/ip route add disabled=no dst-address=172.16.10.0/30 gateway=vrf-as@vrf-as routing-table=vrf-main
/ip route add disabled=no distance=1 dst-address=172.18.1.0/24 gateway=xvrf-as@vrf-as routing-table=vrf-as scope=30 target-scope=10
/ip route add comment="XVRF: Access services@vrf-as from vrf-main (wireguard)" disabled=no distance=1 dst-address=192.0.2.222/32 gateway=xvrf-main2@vrf-main routing-table=vrf-main scope=30 target-scope=10
/ip route add disabled=no distance=1 dst-address=10.227.79.104/32 gateway=xvrf-as@vrf-as routing-table=vrf-as scope=30 target-scope=10
/ip vrf add interfaces=vlan99,vlan4,vlan3,vrrp3,wg-mobile,vrrp99,vrrp4,xvrf-main2 name=vrf-main
/ip vrf add interfaces=vlan44,vrrp44,xvrf-as name=vrf-as
/routing rule add action=lookup disabled=no min-prefix=0 table=main
/routing rule add action=lookup chain=custom_vrf_main disabled=no dst-address=0.0.0.0/0 interface=vrf-main table=vrf-main
/routing rule add action=lookup chain=custom_vrf_main disabled=no dst-address=0.0.0.0/0 interface=vrf-main table=vrf-fiber
/routing rule add action=lookup chain=custom_vrf_main disabled=no dst-address=0.0.0.0/0 interface=vrf-main table=vrf-lte
/routing settings set policy-rules=mangle,custom_vrf_main,vrf-lookup,vrf-unreach,local,user,main