No problems…
(1) One does not need input chain rule on the routers that are Client for Handshake. Only the Server for handshake requires input chain rule.
No issues with the single wireguard interface having three addresses either.
(2) One question did you want the two other routers to access each others shares?
(3) Did you want to add a remote client ( the admin for example PC or smartphone or both ) to be able to reach all three routers via wireguard for configuration access??
(4) Your whole bridge and vlan structure is hosed… Suggest you only use one bridge
all subnets should be vlans, the single bridge should not do any DHCP.
check out → http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1 for some ideas…
(5) You failed to mention another device a maplite?? It has a local LAN subnet of 10.201.19.0/24 which you identified in the first set of Wireguard Peer settings.
(6) The second wireguard peer is setup incorrectly as though the MAIN router was a client not a server for handshake.
From:
add allowed-address=172.16.1.2/32,10.201.1.0/24 comment=SKL
endpoint-address=2.2.2.2 endpoint-port=13231 interface=wgEDI
public-key=“2222…”
TO:add allowed-address=172.16.1.2/32,10.201.1.0/24 comment=SKL
interface=wgEDI public-key="2222…"
(7) The third device you have included the WANIP subnet of the third router ( the LANIP subnet of the ISP router ) as an allowed IP. Why??
(8) Why do you have a forward chain rule for to allow WG to 10.201.25.0/24 and NOT 10.201/22.0/24???
(9) Your firewall rules also need much work overall.
(10) Okay so you want to be able to wireguard and reach an ISP router LAN subnet Ip address on the third network device.
If thats the case then you want to be sure on the third device to sourcnat the wg traffic out the WAN, as the ISP router knows nothing about any of the remote subnets.
(11) You are missing the IP route for the maplite 10.201.19.0/24
+++++++++++++++++++++++++++++++++++++++++++++++++++++
Second device:
(12) Peer Settings
From:
/interface wireguard peers
add allowed-address=172.16.1.1/32,10.201.25.0/24,10.201.22.0/24
endpoint-address=1.1.1.1 endpoint-port=13231 interface=wgSKL
public-key=“1111…”
TO:
/interface wireguard peers
add allowed-address=172.16.1**.0/24**,10.201.25.0/24,10.201.22.0/24
endpoint-address=1.1.1.1 endpoint-port=13231 interface=wgSKL
public-key=“1111…” persistent-keep-alive=35s
(13) No need for input chain rule for wireguard handshake..
Third device:
(14) Peer Settings: same issue with format on wg adddress and missing keep alive, plus WRONG endpoint address!!
from:
/interface wireguard peers
add allowed-address=172.16.3.1/32,10.201.25.0/24,10.201.22.0/24 endpoint-address=
24.124.23.66 endpoint-port=13231 interface=
wgHOD public-key=“1111…”
TO:
/interface wireguard peers
add allowed-address=172.16.3.0/24,10.201.25.0/24,10.201.22.0/24 endpoint-address=
1.1.1.1 endpoint-port=13231 interface=
wgHOD public-key=“1111…” persistent-keep-alive=30s
(15) Okay good you have WG as part of the LAN interface. That should suffice to ensure the traffic exiting the tunnel for a 192.168.100.x address goes out
your WANIP of 192.168.100.2. Thus the ISP router will know where to send the response and the mikrotik will unsourcenat it back to the proper wireguard address for destination handling…
(16) you can remove the input chain rule for wireguard handshake, not done on this router.