There are several options.
One can rent a server in the cloud, for like $7 US a month to tie everyone together ( the CHR is the host for the wireguard handshake ).
THe other option as you described is to host wireguard at your location and then all link up through your router instead. I will look more at this later.
Okay, Using your router will be secure and clear for all. We ensure his connections ( your friend on the road or at thome with: laptop/smartphone/ipad , and the office workers in the US as well from their client device( they may require laptop and pc etc) , do not have any path to any devices on your Router, or to your router.
ON YOUR ROUTER
Interface wg-EXTERNAL listening port 53222
/ip address
add address=10.50.70.1/24 interface=wg-EXTERNAL network=10.50.70.0 comment="worker vpn"
add address=10.0.20.1/24 interface=wg-EXTERNAL network=10.0.20.0 comment="friend/boss vpn"
/ip firewall
add chain=input action=accept comment="External hand shake" dst-port=53222 \
protocol=udp
add chain=forward action=accept comment="Relay" in-interface=wg-EXTERNAL \
out-interface=wg-EXTERNAL
The relay rule is just an efficient firewall rule for passing through the wireguard traffic. Since wg is point to point, we have to allow for the incoming point to point connection to occur and then to go back out the tunnel to the actual destination address.
/interface wireguard peers
add allowed-addresses=10.0.20.2 interface=wg-EXTERNAL public-key="-----" \
comment="remote laptop-friend"
add allowed-addresses=10.0.20.3 interface=wg-EXTERNAL public-key="-----" \
comment="remote PC friend"
add allowed-addresses=10.0.20.4 interface=wg-EXTERNAL public-key="-----" \
comment="remote smartphone/tablet friend"
add allowed address=10.50.70.2 interface=wg-EXTERNAL public-key="++++" \
comment="worker 1"
add allowed address=10.50.70.3 interface=wg-EXTERNAL public-key="+-+-+" \
comment="worker 2"
add allowed address=10.50.70.4 interface=wg-EXTERNAL public-key="*-+*-+" \
comment="worker 3"
add allowed address=10.50.70.10,routersubnetA,routersubnetB,routersubnetC \
interface=wg-EXTERNAL public-key="^^^^^" comment="To Office Router"
/ip route
add address=subnetA gateway=wg-EXTERNAL table=main
add address=subnetB gateway=wg-EXTERNAL table=main
add address=subnetC gateway=wg-EXTERNAL table=main
The routes ensure that the router knows any incoming destined for those subnets is routed through the wireguard interface.
ON REMOTE MIKROTIK ROUTER.
interface=wg-OFFICE listening port = 44789
/ip firewall
add chain=input action=accept comment="friend/boss access to office router" \
in-interface=wg-OFFICE src-address=10.0.20.0/24
add chain=forward action=accept comment="workers and boss to local subnets" \
in-interface=wg-OFFICE dst-address**={entire subnet, or specific server}
** you could use out-interface to include multiple subnets or dst-address-list for a a list of devices vice subnets etc....
/interface wireguard peers
add allowed addresses=10.0.20.0/24,10.50.70.0.24 interface=wg-OFFICE \
public-key="~~~~~" persistent-keep-alive=40s comment="To Host Router"
The idea here is that we are only expecting either the friend/boss or workers to arrive over the wireguard to this router. That is the gist of the config. Ensuring no access to your router means not adding anything to allow them to do so and if you have the correct approach of drop all else rules at the end of your input and forward chains, its done.