Hello, I’ve been trying several approaches but haven’t found a working solution for my setup: I have 2 WAN IPs from my ISP: WAN1 (ether1) – public IP, should accept incoming WireGuard connections from outside. WAN2 (ether2) – behind CGNAT, should be used for normal internet traffic from lo…

Update: 7.22rc3 has been released that fixes the issue below, downgrade to 7.21.3 is no longer required. ▶ Old warning because of issues with 7.22beta1-7.22rc2 Once you've downgraded to 7.21.3 upgraded to 7.22rc3, you can try this idea (that does not require any NAT workaround or the new WireGuard V…

Additional diagram to clarify this case [image]

Hi Something like the following might work. /routing table add disabled=no fib name=VIA-WAN1 /routing rule add action=lookup disabled=no min-prefix=0 table=main add action=lookup-only-in-table disabled=no src-address=WAN1_IP table=VIA-WAN1 /ip route add disabled=no distance=1 dst-address=0.0.0.0/…

Hi, @RPLANT and @CGGXANNX – thanks for the tips. I will first upgrade to 7.22rc3, since it is available, and then I will try the suggested solutions. WAN1 has a static public IP address. WAN2 is behind CGNAT and receives a dynamic IP from the ISP. I will inform you about the test results soon …

Update after testing: I upgraded to RouterOS 7.22rc3. As a first attempt, I applied the solution proposed by @CGGXANNX — creating a separate routing table for WAN1 and adding a routing rule to ensure that traffic sourced from the public IP uses that table. Also, I added NAT masquerade for both WA…

Hello again, One strange thing I found in test release 7.22rc4 – when I edit a routing rule in the UI, and I do not choose any chain, then apply any other changes, it assigns some empty chain (chain=""), which makes the rule invalid. Am I doing something wrong, or is it a bug in the UI rule editor…

[image] Timirsen: One strange thing I found in test release 7.22rc4 7.22 is already released as stable. [image] V7.22 [stable] is released! Announcements Before an upgrade: Remember to make backup/export files before an upgrade and save them on anothe…

It's a bug in the integration with WinBox (probably the specified default value sent to WinBox is wrongly set to "" instead of nothing), either use only the CLI to add/edit routing rules, or you can set the chain to user when adding/editing them with WinBox for now.

OK thanks . Can you share a link to place where can i find a simple explanation of how to use those chains ? BR Tim

This is the section in the document, but it's currently in a Frankenstein state: IP Routing - RouterOS - MikroTik Documentation You'll notice that it mentions "rule 3" and "rule 4" that you see nowhere. That's because a part that has not yet been updated. See my post in another thread . EDIT: Doc…

WireGuard on Mikrotik with 2 WANs (Public + CGNAT) – routing issue

RouterOS

ortazebra March 11, 2026, 8:11pm 9

7.22 is already released as stable.

Please check discussion for this bug.