Wireguard traffic issue, what didn't I notice?

RouterOS Beginner Basics
1

Hi All,
I have a basic home network setup but none of the remote clients in Wireguard network can’t reach or ping local devices or the internet (not even the router). I already read this great article, but I didn’t find the solution. https://forum.mikrotik.com/viewtopic.php?t=182340
Please help me what haven’t I noticed? I assume something is wrong with the routing as WG connection established.

Any help is greatly appreciated!

HW: RB4011 + hap ac2 (managed by capsman), ROS: 7.7

Routing

DST-ADDRESS      GATEWAY       DISTANCE
DAd 0.0.0.0/0        PUBLIC_IP_GW         1
DAc PUBLIC_SUBNET/21  ether1               0
DAc 192.168.90.0/24  wireguard1           0
DAc 192.168.95.0/24  bridge1              0

Wireguard Config:

/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface wireguard peers
add allowed-address=192.168.90.7/24 comment="my_laptop" interface=wireguard1 public-key="fancy_public_key"

Firewall rules:

/ip firewall filter
add action=accept chain=input comment="allow WireGuard" dst-port=13231 protocol=udp
add action=accept chain=input comment="allow WireGuard traffic" log=yes log-prefix=Wireguard_ALLOW src-address=192.168.90.0/24
/ip firewall nat
add action=masquerade chain=srcnat src-address=192.168.95.0/24
add action=masquerade chain=srcnat comment="bridge configuration" out-interface=bridge1
add action=masquerade chain=srcnat src-address=192.168.90.0/24

Remote peer config:
Screenshot 2023-03-07 131718.png

2

Would need to see the full config, but for starters the allowed IP on the peer settings and the address on the wG client should be /32 NOT /24
Which means you didnt really pay attention when reading the article.

3

You are absolutely right!
Beside this I had to add my local DNS servers to interface config on the remote site and finally it’s working. Thanks!

4

No problem, good feeling to get success!!!