Allowing DNS from the wireguard interface worked well. I still wasn’t able to access Winbox over the tunnel with the src-address rule, but I can look into that later. I’m not against adding the wireguard interface to the LAN list. I was more just curious why it wasn’t working the other way and which method was preferred. Thank you for your help!