Thank you for all your help.
I got my home RB now sucessfully connected to my office RB via wireguard
If my home GW decides to route all traffic through WG furthermore I then would like to SRC-NAT the home network (192.168.10.0/24) to a certain outside IP which is on my office RB, and even port forward eg tcp,443 then to my home nas (192.168.10.10)
On the home device you want options and because one of them is to the internet, quite correct that changes the allowed-ips for the peer describing the office connection to be only 0.0.0.0/0
a. connect to offlce LAN
b. use Office MT internet.
ON home device decide which subnet you wish to push out the office WAN, call it subnetA.
then you need three things, table, route, routing rule. ( the route will need to be added not replace the default or manual IP route for standard local internet traffic)
/routing table add name=useOFFICE
/ip route
add dst-address=0.0.0.0/0 gwy=wireguard table=useOFFICE
/routing rule add src-address=SubnetA action=lookup table=useOFFICE
note:1 If you never want subnet A to use the home internet, even if the wireguard tunnel is down, change action=lookup-only-in-table
note2: if you have other subnets and users in A may need to reach them then you need additional rules, order counts… Due to the fact we are forcing
all subnetA traffic out the tunnel so we have to capture other needs prior to doing this…
/routing rule add dst-address=SubnetB action=lookup table=main
/routing rule add src-address=SubnetA action=lookup table=useOFFICE
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Regarding source-nat. Nothing special is required. Lets follow the bouncing ball.
AT HOME
a. wireguard settings allow all destination traffic to be pumped out single available peer, no issues there.
b. firewall rules, assuming you allow subnet A to go out the tunnel, great!
c. IP route, you force subnet A out the tunnel, fantastic.
AT OFFICE
a. wireguard settings. peer settings for home, have allowed-ips that include SUBNET A, good to go, as traffic will be filtered and permitted to exit the tunnel and sit on the router.
b. firewall rules will allow wireguard to internet trafffic either via a separate forward chain rule or included with in-interface-list=LAN out-interface-list=WAN rule automatically if you have included the wireguard interface as a LAN LIST MEMBER! Similarly you may have subnet A, to Office Subnet rule as well, or perhaps to specifiic devices like a printer.
on the input chain perhaps added both the admin IP address on subnet A, that you use as well as as a roadwarrior wireguard IIP address you use for laptop/ipad/iphone) on an address list, to a rule allowing access to the input chain to configure the office router.
C. Routing… nothing special here other than what you already noted which is a requirement to ensure a. or b. or perhaps both:
a. return traffic from remote subnet A ( so router knows where to send thiis traffic )
b. local originating traffic heading for subnet A
add dst-address=subnetA gwy=wireguard routing-table=main.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
In summary, the traffic from your home router goes smoothly to the office router.
Because the office router has a standard route, all its internet bound traffic has a route through the WAN port to the ISP.
Because the firewall rules allow wireguard traffic to exit the WAN, its allowed to.
Because the destination on the wireguard traffic is not local to the office ( aka not to office LAN ) and presumably legit traffic, this traffic does go out the office WAN.
Because all traffic is already source-natted by the default rule OUT-INTERFACE-LIST=WAN, then all local office internet bound traffic and remote home internet bound traffic will get sourcenatted with the WANIP of the office router…
