A. You are mistaken, remember each WIFI instance should be considered an interface, just like a port. But just like ports, if they are on the bridge, they need not be listed, only the bridge ( assuming no vlans of course )
Secondly, you may have mis-identified the instance on the interface list, it is correctly identified as
wifi2-virtual2 ( not virtual1 )
You should note that is particular wifi instance (port), is NOT on the bridge and thus you have correctly given it an IP address, and pool and dhcp-server etc....
Therefore, it needs to be identified separately from the bridge on the LAN interface list. Thusly it gets DNS, and access to internet through associated filter rules.
B. ????? Its an interface, that should not have any access other than to DNS and internet. To separate it from the other subnet, we ensure by good security practices/layers that its not permitted to do what other subnets can do. Sorry, I dont reduce security approaches for anyone.
C. See above, your choice, I will only provide secure approaches in configs. { rant on } Not interested in what you believe, ( security is not a religion) but more interested in the facts, and the facts are that routers are hacked all the time, not on purpose, but by vendor firmware screwups or design screwups (rare) to config errors by admins ( very common ), and further by mixing IOT equipment on trusted networks, devices that phone home may do other things, so we dont give them that opportunity, and lastly assuming all ones users will not click on 'bad links/sites" or emails, is just wishful thinking and naive. By ensuring a layered defense approach and shutting down what is not used, one reduces vectors for exploitation. { rant off } Common Sense!
D. Please provide more exact detail of what you mean you cannot ping from ax3 to ax2 or ac2.
Please provide more exact detail of what you mean you cannot connect to ax2 or ac2 from ax3.
From which IP address on ax3 to what Ip addresses, on ax2, ac2 for connecting.
From which device on ax3, to which IP addresses for pinging.
Finally, one would have to see the state of affairs since you have probably made changes, aka all three configs again, to determine why this is the case.
E. Again, sparse on details. It would appear you are saying you have incoming traffic on AX3 destined for the main LAN, 192.168.1.0/24, but from which source IP address on R2 ax2 and which source IP address on R3 ac2. In other words, need more info to investigate.
I may have a mistake in the configs or flaw in logic, but this is my thinking.
Lets recap on AX3.
MAIN vlan is all allowed entry into wg1 and any return traffic from ax2 or ac3 does not require additional firewall rules.
add action=accept chain=forward comment="LAN to Wireguard" in-interface-list=LAN src-address=192.168.1.0/24 out-interface=wg1
As far as I understand, there are no other USERS on LANS from ax2 or ac2 that require access to main lan on router1 (ax3). Yes, the admin does but that is already provided on this rule.
add action=accept chain=forward comment="Authorized to LAN" in-interface-list=TRUSTED src-address-list=Authorized out-interface-list=LAN
Where these following addresses are allowed to reach the LAN ( and the router for config for that matter (input chain)
/ip firewall address-list
add address=192.168.1.XX list=Authorized comment="admin wired local"
add address=192.168.1.YY list=Authorized comment="admin wifi local"
add address=192.168.100.5 list=Authorized comment="remote admin laptop"
add address=192.168.100.6 list=Authorized comment"remote admin smartphone"
add address=192.168.2.AA list=Authorized comment="remote router2 admin lanIP"
add address=192.168.3.BB list=Authorized comment="remote router3 admin lanIP"
Lets recap on ax2
My understanding here is similar to that of AX3, that no users need to visit AX2 for any reason.
The AX2 LAN is allowed to go out the wireguard tunnel as per:
add action=accept chain=forward comment="LAN to Wireguard" in-interface-list=LAN src-address=192.168.2.0/24 out-interface=wg2
Lets recap on ac2
My understanding here is is that unlike the other two routers, USERS do need to visit Router 3 ac2 ( from both R1 and R2 )
The ac2 LAN is allowed to go out the wireguard tunnel as per ( and in this case is simply for the admin to do so):
add action=accept chain=forward comment="LAN to Wireguard" in-interface-list=LAN src-address=192.168.3.0/24 out-interface=wg3
Furthemore we detailed the following two rules to permit users to access the server on the LAN
add action=accept chain=forward comment="RRouter1 LAN to local LAN" in-interface=wg3 src-address=192.168.1.0/24 dst-address=192.168.3.0/24
add action=accept chain=forward comment="RRouter2LAN to local LAN" in-interface=wg3 src-address=192.168.2.0/24 dst-address=192.168.3.0/24
So so far I see no issues for any traffic via wireguard??
As to ac2 above I would consolidate the two rules into one rule after looking at it again.
/firewall address-list ( on ac2)
add address=192.168.1.0/24 list=Users-4-Server
add address=192.168.2.0/24 list=Users-4-Server
add action=accept chain=forward comment="RR1 & RR2 to local Server" in-interface=wg3 \
src-address-list=Users-4-Server dst-address=192.168.3.0/24
