Hi. I’m having trouble setting up a site-to-site wireguard network.
I am slowly learning the MikroTik world for my home network.
I’ve followed various guides, and I’ve gotten to the point where I can ping between all the devices on the two lanes.
The problem I can only ping, I can’t do anything else. if I try for example to access a web page from a pc connected to the main router to a server in the remote network, I don’t see the page.
If I try to remotely access via winbox to the router of network B from network A, it connects but I display all empty pages, no data in any page.
If I try to connect via ssh to a server in network B, no connection occurs. But the ping is perfect 
Same problems if I am in network B and try to connect to network A services.
I paste my router configuration from network A, anonymized, cleared of what is not needed.
The configuration of network B is similar, same firewall rules, same routes (obviously changing the ip address class)
Router A: ax3
local network 192.168.188.0/24
wireguard network 192.168.100.0/24
Router B: 5009
local network 192.168.128.0/24
ip on wireguard network 192.168.100.11/32
I also thank you only if you have read this far.
Francesco
/interface bridge
add name=bridgeLAN port-cost-mode=short
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface list
add name=WAN
add comment=defconf name=LAN
/ip pool
add name=dhcp_pool ranges=192.168.188.2-192.168.188.99
/ip dhcp-server
add address-pool=dhcp_pool interface=bridgeLAN name=dhcp1
/ip smb users
set [ find default=yes ] disabled=yes
/ipv6 dhcp-server option
add code=23 name=dnsserver value="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
/interface bridge port
add bridge=bridgeLAN interface=ether2 internal-path-cost=10 path-cost=10
add bridge=bridgeLAN interface=ether4 internal-path-cost=10 path-cost=10
add bridge=bridgeLAN interface=ether5 internal-path-cost=10 path-cost=10
add bridge=bridgeLAN interface=ether3
/ip firewall connection tracking
set udp-timeout=10s
/interface detect-internet
set detect-interface-list=WAN internet-interface-list=WAN
/interface list member
add interface=ether1 list=WAN
add comment=defconf interface=bridgeLAN list=LAN
/interface wireguard peers
add allowed-address=192.168.100.2/32 interface=wireguard1 name="xxxxx" \
public-key="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
add allowed-address=192.168.100.3/32 interface=wireguard1 name="xxxxxx" \
private-key="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" public-key=\
"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
add allowed-address=192.168.100.11/32,192.168.128.0/24 client-address=\
192.168.100.11/32 interface=wireguard1 name="SITE_B" public-key=\
"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
/ip address
add address=192.168.188.1/24 interface=bridgeLAN network=192.168.188.0
add address=192.168.100.1/24 interface=wireguard1 network=192.168.100.0
/ip dhcp-client
add interface=ether1
/ip dhcp-server network
add address=192.168.188.0/24 dns-server=192.168.188.101 gateway=192.168.188.1
/ip dns
set allow-remote-requests=yes servers=192.168.188.101
/ip firewall address-list
add address=xxxxxxxxx.xxxxx.xxxx list=WANs
add address=192.168.188.0/24 list=LANs
/ip firewall filter
add action=accept chain=forward dst-address=192.168.128.0/24 src-address=\
192.168.188.0/24
add action=accept chain=forward dst-address=192.168.188.0/24 src-address=\
192.168.128.0/24
add action=accept chain=input comment="allow WireGuard" dst-port=13231 \
protocol=udp
add action=accept chain=input in-interface=wireguard1
add action=accept chain=input connection-state=new in-interface-list=LAN
add action=accept chain=input dst-port=xxxxxx in-interface-list=LAN protocol=\
tcp
add action=accept chain=input connection-state=established,related,untracked
add action=accept chain=input protocol=icmp
add action=drop chain=input log-prefix=DROP
add action=fasttrack-connection chain=forward connection-state=\
established,related hw-offload=yes
add action=accept chain=forward comment="port forwarding" \
connection-nat-state=dstnat
add action=accept chain=forward connection-state=\
established,related,untracked
add action=drop chain=forward connection-state=invalid
/ip firewall nat
add action=masquerade chain=srcnat comment="tcp masquerade" \
out-interface-list=WAN protocol=tcp to-ports=1050-16383
add action=masquerade chain=srcnat comment="udp masquerade" ipsec-policy=\
out,none out-interface-list=WAN protocol=udp to-ports=1050-16383
add action=masquerade chain=srcnat comment="portless masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="Hairpin NAT" dst-address=\
192.168.188.100 src-address=192.168.188.0/24
add action=dst-nat chain=dstnat comment=xxxx dst-port=0000 protocol=tcp \
to-addresses=192.168.188.106 to-ports=0000
add action=dst-nat chain=dstnat comment="xxxxx" dst-port=0000 \
protocol=tcp to-addresses=192.168.188.100 to-ports=0000
add action=dst-nat chain=dstnat comment=xxxxx dst-port=00000 protocol=tcp \
to-addresses=192.168.188.100 to-ports=0000
add action=dst-nat chain=dstnat comment=xxxx dst-port=000000 \
in-interface-list=WAN protocol=tcp to-addresses=192.168.188.101 to-ports=\
00000
/ip route
add disabled=no distance=1 dst-address=192.168.128.0/24 gateway=wireguard1 \
routing-table=main scope=30 suppress-hw-offload=no target-scope=10