(1) REMOVE THIS RULE, no need for it.
add action=accept chain=output comment=“allow WireGuard” disabled=yes
dst-address=45.15.16.52 dst-port=51820 protocol=udp
(2) Add persistent keep alive to your peer settings lets say 35 seconds. ( oops I see you have one already, all good )
(3) For endpoint use se-sto.azirevpn.net
GO TO FIREWALL ADDRESS LIST and create one call it 3rdPartyVPN, so that you can see the resolve at any time
The address may change so using a fixed IP is not the best solution.
aka DO NOT USE the number!! The config you posted seems fine as it uses the address…
(4) Modify your DNS rules …
From:
/ip dhcp-server network
add address=192.168.10.0/24 comment=“VPN DNS Servers” dns-server=192.168.10.1
gateway=192.168.10.1
TO:
/ip dns
set allow-remote-requests=yes servers=
1.1.1.1, 9.9.9.9 { or whatever public DNS you prefer }
AND
From:
/ip dhcp-server network
add address=192.168.10.0/24 comment=“VPN DNS Servers” dns-server=192.168.10.1
gateway=192.168.10.1
TO:
/ip dhcp-server network
add address=192.168.10.0/24 comment=“VPN DNS Servers” dns-server= 91.231.153.2,192.211.0.2
gateway=192.168.10.1
NOTE: The router itself needs a proper DNS setting and we only need to ensure bridge entries use the DNS in question.
(5) FIXED FIREWALL RULES. Note, ORDER is important within a chain!!!
INPUT CHAIN
( got rid of output rule, not required , you had handshake input rule disabled??, block dns rules were redundant and removed, → allow all traffic from LAN then drop all else!! )
( your input rules for SSH and winbox were dangerous and removed, and also not required as LAN access is already available.)
FORWARD CHAIN
( added bridge to wan access, a proper separated allow port forwarding rule and then drop all else rule)
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input disabled=no dst-port=51820 in-interface=\
ether1-WAN protocol=udp
add action=accept chain=input comment="defconf: allow all coming from LAN" \
in-interface-list=LAN
add action=drop chain=input comment="drop all else"
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related disabled=yes hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=accept chain=forward in-interface=bridge out-interface=\
WAN
add action=accept chain=forward in-interface=bridge out-interface=\
wg-az-se-sto
add action=accept chain=forward comment="port forwarding" connection-nat-state=dstnat
add action=drop chain=forward comment="drop all else"
…
(6) NO MANGLING REQUIRED, remove all mangling rules concerning the connection, it seems like they are for other bogus reasons.
In order to troubleshoot your wireguard, disable mangling rules for now !!
(7) CLEANING UP NAT ( remove rule in orange )
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade”
ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment=“Google DNS Force” disabled=yes
dst-port=53 protocol=udp to-addresses=8.8.8.8 to-ports=53
add action=masquerade chain=srcnat out-interface=wg-az-se-sto
Okay I see you do have the critical rule, put it at the top so its visible. aka for nothing else organize the view of your config!!
(8) WHAT are these port forwarding rules for ???
add action=dst-nat chain=dstnat comment=Lox dst-port=6789 in-interface=
ether1-WAN log=yes log-prefix=Lox protocol=tcp to-addresses=
192.168.10.100 to-ports=6789
add action=dst-nat chain=dstnat comment=“Transmission BT” dst-port=
6665 in-interface=ether1-WAN log=yes protocol=tcp to-addresses=
192.168.10.101 to-ports=9911
Remember, if you have incoming traffic on the WAN, you are FORCING TRAFFIC into the TUNNEL.
Thus how do you expect the return traffic from bridge devices will then go back out WAN ??? See 12.
(9) WHERE IS WAN IP route. It will not be visible if you have selected default route in IP DHCP Client. So will assume you have, otherwise you need a manual IP route.
AND GET RID OF BOGUS ROUTE.
add dst-address=45.15.16.52 gateway=10.38.166.65
/ip route
add dst-address=0.0.0.0/0 gwy=ISP_gwy_IP routing-table=main { ex of manual route, probably not necessary if route already exists }
add dst-address=0.0.0.0/0 gwy=wg-az-se-sto routing-table=useWG
(11 ) ROUTING RULE IS WRONG
From:
add action=lookup disabled=no src-address=192.168.20.0/24 table=useWG
TO:
add action=lookup disabled=no src-address=192.168.10.0/24 table=useWG
(12)
Need two additional routing rules for your port fowarding to work… ORDER is key.
/routing rule
add action=lookup-only-in-table src-address=192.168.10.100 table=main
add action=lookup-only-in-table src-address=192.168.10.101 table=main
add action=lookup src-address=192.168.10.0/24 table=useWG
