It depends, what throughput is your ISP, if its 1gig, the HEX is underpowered for that and better to stick with USG.
As long as you can forward ports and set manual routes on the USG, it should work !!!
I can provide a hex setup AS a router that will work, not as a basic switch though.
Your IP address, on the hex, for the fritz Wireguard is INCORRECT on your config should be 192.168.178.X NOT 0
I will assume 2.
In terms of Sourcenat, It would appear you want to sourcenat all traffic going out the tunnel to WORK or to FRITZ and give that traffic the IP address of the HEX on the applicable wireguard interface.
Thats fine, as it makes it easier at those devices to return traffic without having to create any routes. The way tis done though is incorrect.’
model = RB760iGS
/interface list
add name=WAN
add name=LAN
add name**=MANAGE**
/routing table
add fib name=thr_WG
/interface bridge port
add bridge=bridge1 interface=ether1 disabled =yes
add bridge=bridge1 interface=ether3 disabled=yes
add bridge=bridge1 interface=ether4 disabled=yes
add bridge=bridge1 interface=sfp1 disabled=yes
/ip neighbor discovery-settings
set discover-interface-list=MANAGE
/interface list member
add interface=ether2 list=WAN
add interface=bridge1 list=LAN
add interface=ether5 list=LAN
add interface=WG-PRV-SERVER list=LAN
add interface=ether2 list=MANAGE comment=“so can access config from USG subnet”
add interface=ether5 list=MANAGE comment=“so can access config from ether5”
add interface=WG-PRV-SERVER list=MANAGE comment=“so can access config from wireguard”
/interface wireguard peers
add allowed-address=192.168.5.2/32 comment=“MacMini” interface=
WG-PRV-SERVER public-key=“xxxxxxxxx”
add allowed-address=192.168.5.3/32 comment=“DS Phone” interface=
WG-PRV-SERVER public-key=“xxxxxxxx”
add allowed-address=192.168.5.4/32 comment=MacBook interface=WG-PRV-SERVER
public-key=“xxxxxxxx”
add allowed-address=192.168.111.0/24 comment=WG-COMP endpoint-address=
11.11.11.11 endpoint-port=13231 interface=WG-COMP persistent-keepalive=25s
public-key=“xxxxxxxxxxx”
add allowed-address=0.0.0.0/0 client-dns=192.168.178.1 comment=
“WG PL Fritz!Box” endpoint-address=homffff.ddns.net endpoint-port=55014
interface=WG-PL-FritzBox persistent-keepalive=25s preshared-key=
“xxxxxxxx” private-key=
“xxxxxxxxx=” public-key=
“r/eX/xxxxxxxxxxxxx”
/ip address
add address=192.168.2.5/24 interface=ether2 network=192.168.2.0 comment=“WAN PORT”
add address=192.168.5.1/24 interface=WG-PRV-SERVER network=192.168.5.0
add address=192.168.113.60**/24** interface=WG-COMP network=192.168.113.0
add address=192.168.178.2/24 interface=WG-PL-FritzBox network=192.168.178.0
add address=192.168.88.1/24 interface=bridge1 network=192.168.88.0 comment=“unused LAN on HEX”
add address=192.68.55.1/24 interface=ether5 network=192.168.55.0 comment=“local off bridge access to router”
/ip dns
set servers=192.168.2.1
/ip firewall address-list
add address=192.168.5.0/24 list=Authorized comment=“Remote private wg access”
add address=192.168.2.X list=Authorized comment=“admin PC on USG LAN”
add address=192.168.55.0/24 list=Authorized comment=“off bridge local access”
/ip firewall filter
{default rules to keep}
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
{admin rules}
add action=accept chain=input dst-port=13232 protocol=udp comment=“private server handshake”
add action=accept chain=input comment=“admin access” in-interface-list=MANAGE src-address=Authorized
add action=accept chain=input dst-port=53 protocol=udp in-interface-list=LAN
add action=accept chain=input dst-port=53 protocol=tcp in-interface-list=LAN
add action=drop chain=input comment=“Drop all Else” { ensure you put this rule in LAST }
+++++++++++++++++++++++++++++++++++++++++++
{default rules to keep}
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
{admin rules}
add action=accept chain=forward in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward src-address=192.168.2.115 out-interface=WG-PL-FritzBox
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether2
add action=masquerade chain=srcnat out-interface=WG-COMP
add action=masquerade chain=srcnat out-interface=WG-PL-FritzBox
/ip route
add dst-address=0.0.0.0/0 gateway=192.168.2.1 routing-table=main
add dst-address=0.0.0.0/0 gateway=192.168.178.1 routing-table=thr_WG
/routing rule
add action=lookup-only-in-table src-address=192.168.2.115 table=
thr_WG
WHAT IS MISSING ( not clearly stated in your requirements thus far )
traffic accounted for FROM USG LAN that needs to go out COMPANY WIREGUARD SERVER ???
Any traffic originating from company wireguard heading to USG LAN ???
Any traffic originating from fritzbox wireguard heading to USG LAN ???
Any traffic originating from private wg heading to USG LAN ??? ( I already assumed at least to HEX for config purposes )
Any traffic originating from private wg heading to either company or fritzbox WG
