Hi.
After updating (I don't know exactly) to version 7.21.4, remote control via Wireguard of my Yamaha receiver stopped working. It works via the web interface (Wireguard On). Of course it works on the local network. I added some rules and still nothing.
Could someone take a look at this?
Thank you
MMM MMM KKK TTTTTTTTTTT KKK
MMMM MMMM KKK TTTTTTTTTTT KKK
MMM MMMM MMM III KKK KKK RRRRRR OOOOOO TTT III KKK KKK
MMM MM MMM III KKKKK RRR RRR OOO OOO TTT III KKKKK
MMM MMM III KKK KKK RRRRRR OOO OOO TTT III KKK KKK
MMM MMM III KKK KKK RRR RRR OOOOOO TTT III KKK KKK
MikroTik RouterOS 7.21.4 (c) 1999-2026 https://www.mikrotik.com/
Press F1 for help
# 2026-06-12 14:29:40 by RouterOS 7.21.4
# software id = xxxx-xxxx
#
# model = RBD53iG-5HacD2HnD
# serial number = xxxxxxxxxx
/interface bridge
add admin-mac=xx:2C:6E:xx:xx:xx auto-mac=no comment=defconf name=bridge port-cost-mode=short
add comment="Bridge for Guest WiFi" name=bridge-guest
/interface ethernet
set [ find default-name=ether5 ] poe-out=off
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi datapath
add bridge=bridge-guest client-isolation=yes name=guest-datapath
/interface wifi security
add authentication-types=wpa2-psk disable-pmkid=yes disabled=no encryption=ccmp,gcmp,ccmp-256,gcmp-256 group-encryption=ccmp group-key-update=5m name=sec1 wps=disable
add authentication-types=wpa2-psk disable-pmkid=yes disabled=no encryption=ccmp,gcmp,ccmp-256,gcmp-256 group-encryption=ccmp group-key-update=5m name=sec2 wps=disable
add authentication-types=wpa2-psk disable-pmkid=yes disabled=no encryption=ccmp,gcmp,ccmp-256,gcmp-256 group-encryption=ccmp group-key-update=5m multi-passphrase-group="" name=sec_guest wps=disable
/interface wifi
set [ find default-name=wifi1 ] channel.band=2ghz-n .frequency=2427-2447 .skip-dfs-channels=disabled .width=20/40mhz configuration.country="United States" .mode=ap .ssid=MT24 disabled=no security=sec1 \
security.authentication-types=wpa2-psk .connect-group=Grupe2 .connect-priority=0/1 .disable-pmkid=yes .encryption=ccmp .group-key-update=1h
set [ find default-name=wifi2 ] channel.band=5ghz-ac .frequency=5180-5320 .secondary-frequency=disabled .skip-dfs-channels=all .width=20/40/80mhz configuration.country="United States" .mode=ap .ssid=MT50 \
disabled=no security=sec2 security.authentication-types=wpa2-psk .connect-group=Grupe5 .connect-priority=0/1 .encryption=ccmp .group-encryption=ccmp .group-key-update=1h
add configuration.mode=ap .ssid=GuestWifi datapath=guest-datapath disabled=no mac-address=DE:2C:6E:35:7C:70 master-interface=wifi1 name=wifi3 security=sec_guest security.authentication-types=wpa2-psk \
.connect-group=Grupe2 .connect-priority=0/1 .encryption=ccmp .group-key-update=1h
/ip pool
add name=default-dhcp ranges=192.168.88.26-192.168.88.254
add name=pool-guest ranges=192.168.50.10-192.168.50.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=5m name=defconf
add address-pool=pool-guest interface=bridge-guest lease-time=1h name=dhcp-guest
/ip smb users
set [ find default=yes ] disabled=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf interface=ether3 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf interface=ether4 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf interface=ether5 internal-path-cost=10 path-cost=10
add bridge=bridge interface=wifi1
add bridge=bridge interface=wifi2
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface ovpn-server server
add auth=sha1,md5 mac-address=FE:34:02:12:44:14 name=ovpn-server1
/interface wireguard peers
add allowed-address=192.168.77.2/32 client-allowed-address=::/0 comment="Mobil Jenda" interface=wireguard1 name=peer1 public-key="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx="
add allowed-address=192.168.77.3/32 comment="Notebook HP" interface=wireguard1 name=peer2 public-key="xxxxxxxxxxxxxxxxxxxxxxxxxxx="
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
add address=192.168.77.1/24 interface=wireguard1 network=192.168.77.0
add address=192.168.50.1/24 interface=bridge-guest network=192.168.50.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=192.168.88.24 client-id=1:c8:6e:8:2b:8e:e6 mac-address=C8:6E:08:2B:8E:E6 server=defconf
/ip dhcp-server network
add address=192.168.50.0/24 dns-server=192.168.50.1 gateway=192.168.50.1
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,1.0.0.1
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=passthrough chain=comment-test comment="-- SECTION -- test and info rules"
add action=passthrough chain=comment-established comment="-- SECTION -- established rules"
add chain=forward comment="allow established forward" connection-state=established
add chain=forward comment="povol related forward" connection-state=related
add chain=input comment="Allow esatblished connections forward" connection-state=established
add chain=input comment="Allow related connections input" connection-state=related
add chain=output comment="Allow esatblished connections output" connection-state=established
add chain=output comment="Allow related connections output" connection-state=related
add action=accept chain=forward comment="LAN to Wireguard" dst-address=192.168.77.0/24 src-address=192.168.88.0/24
add action=accept chain=forward comment="SSDP WG" dst-port=1900 protocol=udp
add action=accept chain=forward comment="mDNS WG" dst-port=5353 protocol=udp
add action=accept chain=forward comment="WG to Broadcast" dst-address-type=broadcast src-address=192.168.77.0/24
add action=accept chain=forward comment="Broadcast to Wireguard" dst-address=192.168.77.0/24 src-address-type=broadcast
add action=accept chain=forward comment="WG to Multicast" dst-address-type=multicast src-address=192.168.77.0/24
add action=accept chain=forward comment="Multicast to WG" dst-address=192.168.77.0/24 src-address-type=multicast
add action=passthrough chain=comment-drop comment="-- SECTION -- drop rules"
add action=log chain=input comment="Drop invalid connections" connection-state=invalid log-prefix=drop_invalid
add action=drop chain=forward comment="Drop Guest wifi" dst-address=192.168.88.0/24 src-address=192.168.50.0/24
add action=drop chain=input comment="Drop invalid connections" connection-state=invalid
add action=log chain=output comment="Drop invalid connections" connection-state=invalid log-prefix=drop_invalid
add action=drop chain=output comment="Drop invalid connections" connection-state=invalid
add action=log chain=forward comment="drop all BANNED IPs" log-prefix=drop_banned src-address-list=all_banned
add action=drop chain=forward comment="drop all BANNED IPs" src-address-list=all_banned
add action=log chain=input comment="Block broadcasts packets" disabled=yes dst-address=255.255.255.255 log-prefix=255
add action=drop chain=input comment="Block broadcasts packets" dst-address=255.255.255.255
add action=drop chain=input comment="Block broadcasts packets" dst-address-type=broadcast,multicast
add action=passthrough chain=comment-VOIP comment="-- SECTION -- VOIP rules"
add action=passthrough chain=comment-DDOS comment="-- SECTION -- block ddos rules"
add action=log chain=input comment="drop ssh brute forcers for 10days" dst-port=22 log-prefix=drop-ssh-brute protocol=tcp src-address-list=ssh_blacklist
add action=drop chain=input comment="drop ssh brute forcers for 10days" dst-port=22 protocol=tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=2w6d chain=input comment="ssh black_list" connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=50m chain=input comment="ssh black_list" connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=20m chain=input comment="ssh black_list" connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=5m chain=input comment="ssh black_list" connection-state=new dst-port=22 protocol=tcp
add action=jump chain=forward comment=Jump_to_block-ddos disabled=yes dst-port=!53,514 jump-target=block-ddos protocol=udp
add action=jump chain=input comment=Jump_to_block-ddos disabled=yes dst-port=!53,514 jump-target=block-ddos protocol=udp
add action=return chain=block-ddos disabled=yes limit=16,32:packet
add action=log chain=block-ddos disabled=yes log-prefix=DDOS_ATTACK:
add action=drop chain=block-ddos disabled=yes limit=16,32:packet
add action=jump chain=input comment=Jump_to_block-ddos disabled=yes dst-port=!53 jump-target=block-ddos protocol=udp
add action=passthrough chain=comment-important-basic comment="-- SECTION -- important and basic rules"
add action=accept chain=input dst-port=8291,22 in-interface=!ether1 protocol=tcp
add chain=output comment="allow router DNS queries" dst-port=53 protocol=tcp
add chain=output comment="allow router DNS queries" dst-port=53 protocol=udp
add action=accept chain=input comment="allow router DNS queries" dst-port=53 in-interface=!ether1 protocol=udp
add action=accept chain=input comment="allow router DNS queries" dst-port=53 in-interface=!ether1 protocol=tcp
add action=accept chain=forward comment="allow router DNS queries" dst-port=53 in-interface=!ether1 protocol=udp
add action=accept chain=forward comment="allow router DNS queries" dst-port=53 in-interface=!ether1 protocol=tcp
add action=accept chain=output comment="allow router NTP queries" dst-port=123 protocol=udp
add action=accept chain=forward comment="allow router NTP queries" dst-port=123 in-interface=!ether1 protocol=udp
add chain=output comment="allow ping z routeru" protocol=icmp
add action=accept chain=forward comment="povol PING forward" in-interface=!ether1 protocol=icmp
add action=accept chain=input comment="povol PING input" in-interface=!ether1 limit=10,50:packet protocol=icmp
add action=passthrough chain=comment-VPNs comment="-- SECTION -- VPNs rules"
add action=accept chain=input comment=wireguard dst-port=13231 protocol=udp
add action=accept chain=input comment=wireguard src-address=192.168.77.0/24
add action=accept chain=forward comment=wireguard src-address=192.168.77.0/24
add action=accept chain=input comment="allow input PPTP" disabled=yes dst-port=1723 protocol=tcp src-port=1024-65535
add action=accept chain=input comment="allow input IPSEC" disabled=yes dst-port=500 protocol=udp src-port=1024-65535
add action=accept chain=input comment="allow input IPSEC" disabled=yes dst-port=4500 protocol=udp src-port=1024-65535
add action=accept chain=input comment="allow input L2TP" disabled=yes dst-port=1701 protocol=udp src-port=1024-65535
add action=accept chain=input comment="allow input PPTP" disabled=yes protocol=gre
add action=accept chain=input comment="allow input IPSEC-esp" disabled=yes protocol=ipsec-esp
add action=passthrough chain=comment-PUBLIC-DMZ comment="-- SECTION -- public DMZ, webserver etc rules"
add action=passthrough chain=comment-INET-access comment="-- SECTION -- Internet access RULES"
add action=accept chain=forward comment="povolene vse z LAN" in-interface=bridge out-interface=ether1
add action=accept chain=forward comment="povolene vse z WifiGuest" in-interface=bridge-guest out-interface=ether1
add chain=forward comment="povolene sluzby obecne TCP z LAN" disabled=yes out-interface=ether1 protocol=tcp
add chain=forward comment="povolene sluzby obecne UDP z LAN" disabled=yes out-interface=ether1 protocol=udp src-address-list=!servers_RANGE_vlan
add action=passthrough chain=comment-OTHER comment="-- SECTION -- other rules"
add action=passthrough chain=comment-DROP-FINAL comment="-- SECTION -- FINAL DROPs"
add action=log chain=forward comment="Drop everything all FORWARD" log-prefix=DROP_forward
add action=drop chain=forward comment="Drop everything all FORWARD"
add action=log chain=input comment="Drop everything all INPUT" log-prefix=DROP_input
add action=drop chain=input comment="Drop everything all INPUT"
add action=log chain=output comment="Drop everything all OUTPUT" log-prefix=DROP_output
add action=drop chain=output comment="Drop everything all OUTPUT"
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="WG full internet" out-interface-list=WAN src-address=192.168.77.0/24
/ip firewall service-port
set sip disabled=yes
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip service
set ftp disabled=yes
set telnet disabled=yes
set www-ssl disabled=no
set api disabled=yes
set api-ssl disabled=yes
/ip upnp interfaces
add interface=bridge type=internal
/ipv6 nd
set [ find default=yes ] advertise-dns=yes
/system clock
set time-zone-name=Europe/Prague
/system logging
add topics=firewall
add topics=wireguard
/system ntp client
set enabled=yes
/system ntp server
set enabled=yes
/system ntp client servers
add address=0.cz.pool.ntp.org
add address=1.cz.pool.ntp.org
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool sniffer
set file-limit=5000KiB file-name="sledov\E1n\ED" filter-dst-ip-address=192.168.88.8/32 filter-interface=all filter-src-ip-address=!192.168.88.9/32 memory-limit=5000KiB
/tool traffic-monitor
add interface=wifi1 name=tmon1