Nice diagram!
So yes to be able to use the mikrotik as wireguard server for the handshake, there must be a public IP in the mix.
In this case you need two conditions
a. the fritzbox gets a public I P
b. you have access to the fritzbox at least for port forwarding purposes.
If so, the you need to port forward the listening port ( 13321) to LANIP of the MT router on the fritz private LAN.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Observations:
(1) Do not use vlan1 change it to VLAN11 (including ip address, ip dhcp-server, interface list member, vlan interface etc…)
(2) SInce using normal wifi on your MT device get rid of assigning vlans in wifi setups.
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
(3) Change to LOOSE and NO
/ip settings
set rp-filter=strict tcp-syncookies=yes
(4) Corrected interface list members!
/interface list member
add comment=defconf interface=ether1 list=WAN
add comment=defconf interface=vlan20 list=LAN
add comment=defconf interface=vlan10 list=LAN { covers both wired ports and WLANS }
add comment=defconf interface=vlan30 list=LAN { covers both guest wlans }
add interface=vlan11 list=LAN
add interface=IoT list=LAN
add interface=Management list=LAN
add interface=wireguard-vpn list=LAN
(5) your firewall chain is disorganized making it harder to read and spot errors.
Put all input chain rules together and then all forward chain rules etc…
Here is an example where lack of organization leads to perfectly good rules made useless…
add action=drop chain=input log-prefix=“[drop]”
add action=accept chain=input comment=“defconf: accept ICMP after RAW”
protocol=icmp
add action=accept chain=input comment=
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
in-interface-list=!LAN
How much LAN traffic do you think will be able to access Router Services for such things like DNS?
Answer → NONE except for wireguard traffic and of course the one subnet you identify with this src-address-list=allowed_to_router
(6) You have duplication in your input chain rules… ( also the input chain icmp allow rule is duplicated, but getting tired of it really)
add action=accept chain=input comment=“allow WireGuard traffic” src-address=
192.168.40.0/24
add action=accept chain=input in-interface=wireguard-vpn log-prefix=“[FW]”
(7) Forward chain rules are also a mess…
(8) An interface is not an etherport or wlan port ??
add bridge=vlan-bridge frame-types=admit-only-vlan-tagged interface=
Management
(9) Some work to do to illuminate where vlan1 is going?? and used for… now vlan11…
(10) It would appear you have a Management interface list member but have not defined anywhere its origins, there is no vlan? or subnet?
(11) According to /interface bridge vlans, you have at least two hybrid ports caused by vlan1, changing this to VLAN11, would make senses if vlan11 is your management vlan.
So you would only have trunk ports to your switches etc…
(12) What is the purpose of this rule ???
add action=dst-nat chain=dstnat disabled=yes dst-port=13231 out-interface=
vlan20 protocol=udp to-addresses=192.168.40.1
(13) First thing I would do is wean off raw rules, like all of them.
(14) Do you use ipv6? if not simply disable it.
https://forum.mikrotik.com/viewtopic.php?t=180838