Before Sindy takes a crack at it, did you try removing your responder entry.
I dont use that on any of my configs??
/interface wireguard peers
add allowed-address=192.168.166.2/32 comment=G interface=WGC name=peer1
public-key=“xxxxxxxxxxxxxxxxxxxxxx” responder=yes
add allowed-address=192.168.166.3/32 interface=WGC name=peer3-A
public-key=“vvvvvvvvvvvvvvvvvvvvvvvvvvvvv” responder=yes
As for the rest, this article is germane → http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
In there you will realize that going vlans, its best and standard practice to go all vlans.
In other words the bridge should not be doing any dhcp.
You will also note that using vlan1 only belongs as default entry on the bridge (for good reason) and should otherwise not be seen.
I have removed the associated datapath entry.
Also you never actually inform the reader if wifi30 is affiliated with wifi1 ( 2.4ghz) or wifi2 (5ghz) same with vlan40
Another issue is that you apply sec1 to both WLANS, which further made it impossible to connect a specific wlan to either 30 or 40.
At least put something in comments …
Thus I am just guessing at /interface bridge ports will use v30 for wifi1 and 5ghz and v40 for wifi2 and 2.4ghz
and also apply sec1 to wifi1 and sec2 to wifi2
Also I note you have fastpath set to no?? I have changed it back to the default YES. Any reason why you changed it??>
If not using IPV6 it should be disabled and most all related items removed.
It was clear that the one wg user was admin (.166.2) , but not the other wg user (.166.3), I’m assuming this user needs access to a particular VLAN or subnet, but it was not clear which.
I have altered the config with this in mind.
…
/interface bridge
add admin-mac=xx:xx:xx:xx:xx:xx auto-mac=no comment=defconf name=bridge \
port-cost-mode=short
/interface wireguard
add listen-port=46456 mtu=1350 name=WGC
/interface vlan
add interface=bridge name=VLAN30 vlan-id=30 comment="used with wifi1"
add interface=bridge name=VLAN40 vlan-id=40 comment="used with wifi2"
add interface=bridge name=VLANHome10 vlan-id=10
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN\
add name=TRUSTED
/interface wifi channel
add band=2ghz-n disabled=no frequency=2412 name=channel1 width=20mhz
/interface wifi security
add authentication-types=wpa2-psk disable-pmkid=yes disabled=no encryption=\
ccmp multi-passphrase-group=cgroup name=sec1
add authentication-types=wpa2-psk,wpa3-psk disable-pmkid=yes disabled=no \
encryption=ccmp,gcmp,ccmp-256,gcmp-256 name=sec2
/interface wifi
set [ find default-name=wifi1 ] channel.band=5ghz-ax .frequency=5180 \
.skip-dfs-channels=all .width=20mhz configuration.country=Italy .mode=ap \
.ssid=tris disabled=no security=sec1 security.authentication-types=\
wpa2-psk
set [ find default-name=wifi2 ] channel=channel1 channel.band=2ghz-n \
.frequency=2462 configuration.country=Italy .mode=ap .ssid=ire disabled=\
no security=sec2
/ip pool
add name=default-dhcp ranges=192.168.155.2-192.168.155.254
add name=dhcp_pool2 ranges=192.168.30.2-192.168.30.254
add name=dhcp_pool3 ranges=192.168.40.2-192.168.40.254
/ip dhcp-server
add address-pool=default-dhcp comment=defconf interface=VLANHome10 lease-time=12h \
name=defconf
add address-pool=dhcp_pool2 interface=VLAN30 lease-time=12h name=dhcp2
add address-pool=dhcp_pool3 interface=VLAN40 lease-time=12h name=dhcp3
/ip smb users
set [ find default=yes ] disabled=yes
/interface bridge port
add bridge=bridge ingress-filtering=yes frame-types=admit-only-untagged-and-priority interface=ether3 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-untagged-and-priority interface=ether4 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-untagged-and-priority interface=ether5 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-untagged-and-priority interface=wifi1 pvid=30
add bridge=bridge ingress-filtering=yes frame-types=admit-only-untagged-and-priority interface=wifi2 pvid=40
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=TRUSTED
/ip settings
set allow-fast-path=yes
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridge tagged=bridge,wifi1,wifi2 vlan-ids=30,40
/interface list member
add interface=ether1 list=WAN comment="ether1 disabled for now"
add interface=ether2 list=WAN
add interface=VLANHome10 list=LAN
add interface=VLAN30 list=LAN
add interface=VLAN40 list=LAN
add interface=WGC list=LAN
add interface=VLANHome10 list=TRUSTED
add interfac=WGC list=TRUSTED
/interface wifi security multi-passphrase
add disabled=no group=cgroup
add disabled=no group=cgroup isolation=yes vlan-id=30
/interface wireguard peers
add allowed-address=192.168.166.2/32 interface=WGC name=peer1 public-key="xx"
add allowed-address=192.168.166.3/32 interface=WGC name=peer3-A public-key="vv"
/ip address
add address=192.168.155.1/24 interface=VLANHome10 network=192.168.155.0
add address=192.168.166.1/24 interface=WGC network=192.168.166.0
add address=192.168.30.1/24 interface=VLAN30 network=192.168.30.0
add address=192.168.40.1/24 interface=VLAN40 network=192.168.40.0
/ip dhcp-client
add comment=defconf interface=ether1 disabled=yes
add interface=ether2 use-peer-dns=no use-peer-ntp=no
/ip dhcp-server config
set store-leases-disk=12h5m
/ip dhcp-server lease
add address=192.168.155.10 client-id=1:xx:xx:xx:xx:xx:xx mac-address=\
xx:xx:xx:xx:xx:xx server=defconf
add address=192.168.155.2 client-id=1:xx:xx:xx:xx:xx:xx mac-address=\
xx:xx:xx:xx:xx:xx server=defconf
/ip dhcp-server network
add address=192.168.30.0/24 gateway=192.168.30.1
add address=192.168.40.0/24 gateway=192.168.40.1
add address=192.168.155.0/24 comment=defconf dns-server=8.8.8.8,9.9.9.9 \
gateway=192.168.155.1
/ip dns
set servers=8.8.8.8,9.9.9.9
/ip firewall address-list
add address=192.168.166.2 list=Authorized comment="admin remote laptop"
add address=192.168.155.x list=Authorized comment="admin local PC"
/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input dst-address=127.0.0.1
add action=accept chain=input comment="wireguard handshake" dst-port=46456 protocol=udp
add action=accept chain=input comment="admin access" in-interface-list=TRUSTED src-address-list=Authorized
add action=accept chain=input comment="users to services" in-interface-list=LAN dst-port=53 protocol=udp
add action=accept chain=input comment="users to services" in-interface-list=LAN dst-port=53 protocol=tcp
add action=drop chain=input comment="drop all else" { insert this rule here, last of all rules, so you dont lock yourself out }
++++++++++++++++++++++++++++++++++++++++
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward comment="internet traffic" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="admin access" in-interface-list=TRUSTED src-address-list=Authorized out-interface-list=LAN
add action=accept chain=forward comment="wg user to LAN" in-interface=WGC dst-address=??local-subnet??
add action=accept chain=forward comment="port forwarding" connection-nat-state=dstnat disabled=yes { enable if required or remove }
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip smb shares
set [ find default=yes ] directory=/pub
/ipv6 firewall filter
add action=drop chain=input
add action=drop chain=forward
/system clock
set time-zone-name=Europe/Rome
/system identity
set name=CMW
/system leds settings
set all-leds-off=after-1min
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=TRUSTED