But the site from the list does not open by timeout. I made 3 logging mangle rules: on prerouting, input and forward. I see incomming packets only on prerouting rule. 2 others is empty.
But if I use just this instead of mangle and address-list:
Your first code block is backwards: the “/ip route add” block configures the wireguard1 interface as the default. What you’re asking for is the opposite: some other interface to be the default, but for the wireguard1 interface to be the proper route for certain target IPs.
Therefore, let the default gateway be set up normally (e.g. via DHCP) and then add static routes for the exceptions:
Why? I use routing table mark, not all traffic:
/ip route
add disabled=no distance=10 dst-address=0.0.0.0/0 gateway=wireguard1 routing-table=wg-my scope=30 suppress-hw-offload=no target-scope=10
Therefore, let the default gateway be set up normally (e.g. via DHCP) and then add static routes for the exceptions:
>
> Now all traffic to > [TEST-NET-1](https://datatracker.ietf.org/doc/html/rfc5735) > will go out the WireGuard VPN, and everything else will bypass it.
Okay, it works, but I need to use address lists. I don't want to generate lots of ip/route rules manually.
I don’t see a huge distinction between addresses in a list and a list of static routes, particularly given how many rules are required to set up connection marking, multiple routing tables, and such. Unless the number of address is huge, it may be shorter to do it my way.
However, if you insist on proceeding down that path, I think you need a second NAT rule, per this example. Without it, you get no NAT thru the WG link, thus no packet flow.
Why?
I already have main masquarade NAT rule thac includes all WAN interfaces (and WG too). It works with route rules. Do you think, it is not fit for address-list case?
I think you’re confusing the packet flow logic by putting “wireguard1” in “out-interface-list=WAN”. The WAN list should have only the raw (non-VPN) interface(s).
But rather than keep arguing, why not try it and see?
I’m not guaranteeing I’m right. What I am saying is:
If it works, it works.
If it doesn’t, you have a stronger counterargument than “but whhyyyyy?”
The problem here is that you need to establish a wan connection to the server and thus not ALL traffic can go out the wg tunnel.
There are ways around this which add complexity but should only be approached if necessary.
You have a conundrum in that you have multiple addresses that need to go out WG tunnel
a. create one route and a gazillion route rules to match on dst-address OR
b. create a firewall address list and add mangling
In terms of allowed IP addresses you can add all of them individually to the WG list, or use 0.0.0.0/0 but then you have to be cognizant of how this affects all other traffic intended for the regular internet.
Seems like you have solved a config error, and its working for you now?
Yes, I think it was early error in config that led me to this problem. Now it works, I can add required site to the list and it will route through my vpn.
