http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
Bridge should not normally do DHCP in a vlan setup… simply create another vlan, amend any associated config lines.
It is not clear yet what subnet or user(s) are supposed to go out wireguard.
I do see an attempt so sourcneat wireguard traffic but the rule is flawed in to aspects,
a. trying to use if for routing, NOT its purpose, by putting in a source address
b. the src address is wrong, and should have been one of the subnets that needs to be sourcenatted…
However, the rule is best in the form like so.
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade”
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment=Wireguard
In this way, at the UBUNTU all traffic coming through the tunnel will be seen as coming from 10.8.0.4
Which makes life simpler all the way round.
This old rule should be removed
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
Modify not clear firewall rules in forward chain from:
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
add action=drop chain=forward comment=“Drop VLAN Routing” dst-address-list=
Local-Networks src-address-list=Local-Networks
TO:
add action=accept chain=forward comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“wg outgoing traffic” SOURCE??? out-interface=WG_Interface
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat { disable or remove if not required }
add action=drop chain=forward comment=“drop all else”
If you need any intervlan traffic create an accept rule above the last rule.
Now I am assuming the ROUTE you have is for the subnet on ubuntu… that seems fine and coupled with the peer settings,
both internet and subnet access should be possible at least from the MT side of the house, the rest is up to ubuntu settings which is your issue to deal with.
MISSING:
The main problem I have with the config, is that you do not tell the router, WHO should go into the tunnel. Therefore the firewall rule created is not complete.
Further, it WILL be necessary to detail routing information so that the router knows which users/subnet need to be captured/forced into the WG tunnel.
One has to be careful in that once we push a certain subnet or IP address into the tunnel, it will use that tunnel for internet as well unless the WG tunnel is not working.
So its up to you do identify the number of user that will be using the tunnel etc…
If you have wifi its easy to do with SSID and vlan separation… wired, probably best to do with static dhcp leases