Would need to see the complete config,
but it sounds like you want the users on your subnets to use wireguard for specific WANIPs that exist, and where they are not static but dynamic WANIPs.
First, please do not use the same name for different RoS funcitonalites, aka the name of the list being the same as a special table entry “vpn”. Bad move.
examples…
list=vpn-external-IPs
table name=useWG
Approach. if it was some number less than 5 WANIPs I would be tempted to forgo any mangling and just use routing rules with the special table and route for the table.
If the list was to onerous, then I would go the mangle route. /ip firewall mangle.
add action=mark-routing dst-address-list=vpn-external-IPs
new-routing-mark=useWG
The firewall address list would look like
add address=domainnameA list=vpn-external-IPs
add address=domainnameB list=vpn-external-IPs
etc…
Typically the recommendation here is loose, not strict! /ip settings
set rp-filter=strict
Lack of decent set of firewall rules, plus should be organized together in chains and in a coherent order.
PLUS security infraction, one does not access winbox from external as you are attempting. Only arrive at the router via VPN and then use winbox.
SSH22 is a type of encrypted connection service on the router so that can remain. But if using the service on the router (input chain), then it has nothing to with any bridge lan entity.
I would never use default port by the way… for any config settings…
/ip firewall filter
{ default rules to keep } add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input dst-address=127.0.0.1
(admin rules) add action=accept chain=input comment=“SSH handshake” dst-port=20022 protocol=tcp
add action=accept chain=input comment=“LAN access to config and services” in-interface=bridge-lan
add action=drop chain=input comment=“drop all else” { insert this rule here last of all rules so you dont lock yourself out }
+++++++++++++++++++++
{ default rules to keep } add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward comment=“internet traffic” in-interface=bridge-lan out-interface=ether1
add action=accept chain=forward comment=“lan to wg” in-interface=bridge-lan dst-address=vpn-traffic out-interface=wireguard3
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat disabled=yes { enable if required or remove }
add action=drop chain=forward comment=“drop all else”
set ssh port=20022
Masquerade rule is incorrect, remove the to-address part, that is only when you use action=src-nat.
In this case we are correctly using masquerade so should look like… add action=masquerade chain=srcnat out-interface=wireguard3
You have two routes for Wireguard, you only need one.
A route on the main table is automatically created due to the IP address for wireguard.
Also assumes for ether1 a default route was selected in ip dhcp client as I see none on the config for that.
Thus should only have /ip route
add dst-address=0.0.0.0/0 gateway=wireguard3 routing-table=vpn-route
That did the magic I needed and now everything is working. To be honest, I will never find this.
/ip settings set rp-filter=loose
Fixed my issue
I will take look on it, I was living in piece only bridge-lan devices can access this MikroTik, so I keep default ports there. Ether1 (internet) is not part of the bridge-lan.
Rules are odered by traffic consumption - I was hoping is better for CPU usage.
This make sense - I don’t know how LAN devices was able to working without this rule.
