Hi,
Recently I upgraded my Mikrotik setup to a more advanced setup. I introduced multiple VLANs and did the configuration from scratch.
Ether 1 is my WAN, Ether 8 is the trunkport to the switch.
In my old setup with no VLANs and just one local address pool (192.168.88.0/0), I was able to route any client I wanted thorugh the WG Tunnel by following these steps:
Wireguard Setup for RouterOS with device Selection:
Add a Wireguard Interface and a Wireguard Peer using the config file given by the wireguard server
(Endpoint-Port == Listen-Port)Create a new Table /routing/table
Add a new rule (/routing/rule):
Src.Addr: device in the network which should use Wireguard
Action: lookup only in table
Table: Table which was created in step 2Add new IP address (/ip/addresses):
Address: Interface address as seen in the config file given by the wireguard server
Interface: Choose interface created in step 1
(This creates automatically a entry in /ip/routes)Create a new route (/ip/routes):
Dst. Address: 0.0.0.0/0
Gateway: Name of the Interface defined in step 1
Routing Table: Table which was created in step 2Firewall rulw (/ip/firewall/)
Chain: srcnat
Src.Address: 192.168.88.0/24
Out.Interface: Interface of step 1
Action: masquerade
Now I want the same with my more complex setup, but I am not able to get it to work.
This is my current config where I am trying to route 10.0.10.246 through the WG Tunnel, which is not working!
# 2025-01-31 09:42:21 by RouterOS 7.17
# software id = 6Y1M-YB75
#
# model = RB5009UG+S+
# serial number = <removed>
/interface bridge
add frame-types=admit-only-vlan-tagged name=BR1 vlan-filtering=yes
/interface wireguard
add comment="Mullvad WG1" listen-port=51820 mtu=1420 name=MullvadWG_1
/interface vlan
add interface=BR1 name=BASE_VLAN vlan-id=99
add interface=BR1 name=CAMERAS_VLAN vlan-id=30
add interface=BR1 name=GUEST_VLAN vlan-id=20
add interface=BR1 name=IOT_VLAN vlan-id=40
add interface=BR1 name=MAIN_VLAN vlan-id=10
/interface list
add name=WAN
add name=VLAN
add name=BASE
/interface wifi configuration
add country=**** disabled=no name=BASE security.authentication-types=wpa2-psk,wpa3-psk .encryption="" ssid=B1
add country=**** datapath.vlan-id=10 disabled=no name=MAIN security.authentication-types=wpa2-psk,wpa3-psk ssid=B2
add country=**** datapath.vlan-id=20 disabled=no name=GUEST security.authentication-types=wpa2-psk,wpa3-psk ssid=B3
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no name=SEC_IOT_CAMERAS
/interface wifi configuration
add country=**** datapath.vlan-id=40 disabled=no name=IOT security=SEC_IOT_CAMERAS ssid=CrossbonesGarden_I
add country=**** datapath.vlan-id=30 disabled=no name=CAMERAS security=SEC_IOT_CAMERAS ssid=CrossbonesGarden_C
/ip pool
add name=BASE_POOL ranges=192.168.112.10-192.168.112.254
add name=MAIN_POOL ranges=10.0.10.2-10.0.10.254
add name=GUEST_POOL ranges=10.0.20.2-10.0.20.254
add name=CAMERAS_POOL ranges=10.0.30.2-10.0.30.254
add name=IOT_POOL ranges=10.0.40.2-10.0.40.254
/ip dhcp-server
add address-pool=BASE_POOL interface=BASE_VLAN name=BASE_DHCP
add address-pool=MAIN_POOL interface=MAIN_VLAN name=MAIN_DHCP
add address-pool=GUEST_POOL interface=GUEST_VLAN name=GUEST_DHCP
add address-pool=CAMERAS_POOL interface=CAMERAS_VLAN name=CAMERAS_DHCP
add address-pool=IOT_POOL interface=IOT_VLAN name=IOT_DHCP
/routing table
add disabled=no fib name=MullvadWG_1_Table
/interface bridge port
add bridge=BR1 interface=ether2 pvid=99
add bridge=BR1 interface=ether3 pvid=10
add bridge=BR1 interface=ether4 pvid=20
add bridge=BR1 interface=ether5 pvid=30
add bridge=BR1 interface=ether6 pvid=40
add bridge=BR1 comment=Trunk frame-types=admit-only-vlan-tagged interface=ether8
/ip neighbor discovery-settings
set discover-interface-list=all discover-interval=5s
/interface bridge vlan
add bridge=BR1 tagged=BR1,ether8 untagged=ether2 vlan-ids=99
add bridge=BR1 tagged=BR1,ether8 untagged=ether3 vlan-ids=10
add bridge=BR1 tagged=BR1,ether8 untagged=ether4 vlan-ids=20
add bridge=BR1 tagged=BR1,ether8 untagged=ether5 vlan-ids=30
add bridge=BR1 tagged=BR1,ether8 untagged=ether6 vlan-ids=40
/interface list member
add interface=ether1 list=WAN
add interface=MAIN_VLAN list=VLAN
add interface=GUEST_VLAN list=VLAN
add interface=CAMERAS_VLAN list=VLAN
add interface=IOT_VLAN list=VLAN
add interface=BASE_VLAN list=BASE
/interface ovpn-server server
add mac-address=FE:6D:F2:68:A5:62 name=ovpn-server1
/interface wifi capsman
set enabled=yes package-path="" require-peer-certificate=no upgrade-policy=suggest-same-version
/interface wifi provisioning
add action=create-dynamic-enabled comment=EG_OG_PROVISIONING disabled=no identity-regexp=cAP112 master-configuration=BASE name-format=EG_OG_CONF_MASTER \
slave-configurations=MAIN slave-name-format=EG_OG_CONF_SLAVE
add action=create-dynamic-enabled comment=KG_PROVISIONING disabled=no identity-regexp=wAP112 master-configuration=IOT name-format=KG_CONF_MASTER \
slave-configurations=BASE,MAIN slave-name-format=KG_CONF_SLAVE
add action=create-dynamic-enabled comment=GUEST_PROVISIONING disabled=yes master-configuration=GUEST name-format=GUEST_CONF
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=185.209.196.76 endpoint-port=51820 interface=MullvadWG_1 name=MullvadWG_1_Peer persistent-keepalive=1m \
public-key="<Removed by me, because of privacy reasons>"
/ip address
add address=192.168.112.1/24 interface=BASE_VLAN network=192.168.112.0
add address=10.0.10.1/24 interface=MAIN_VLAN network=10.0.10.0
add address=10.0.20.1/24 interface=GUEST_VLAN network=10.0.20.0
add address=10.0.30.1/24 interface=CAMERAS_VLAN network=10.0.30.0
add address=10.0.40.1/24 interface=IOT_VLAN network=10.0.40.0
add address=10.73.250.17 interface=MullvadWG_1 network=10.73.250.17
/ip dhcp-client
add interface=ether1
/ip dhcp-server lease
add address=10.0.10.251 client-id=1:de:e5:7f:69:c2:12 mac-address=DE:E5:7F:69:C2:12 server=MAIN_DHCP
add address=10.0.10.246 client-id=1:80:e6:50:26:cb:8 mac-address=80:E6:50:26:CB:08 server=MAIN_DHCP
/ip dhcp-server network
add address=10.0.10.0/24 dns-server=192.168.112.1 gateway=10.0.10.1
add address=10.0.20.0/24 dns-server=192.168.112.1 gateway=10.0.20.1
add address=10.0.30.0/24 dns-server=192.168.112.1 gateway=10.0.30.1
add address=10.0.40.0/24 dns-server=192.168.112.1 gateway=10.0.40.1
add address=192.168.112.0/24 dns-server=192.168.112.1 gateway=192.168.112.1
/ip dns
set allow-remote-requests=yes servers=9.9.9.9
/ip firewall filter
add action=passthrough chain=forward comment="special dummy rule to show fasttrack counters"
add action=accept chain=input comment="Allow Estab & Related" connection-state=established,related
add action=accept chain=input comment="Allow VLAN" in-interface-list=VLAN
add action=accept chain=input comment="Allow Base_Vlan Full Access" in-interface-list=BASE
add action=accept chain=input comment="accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="Drop the rest"
add action=fasttrack-connection chain=forward comment=fasttrack connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="Allow Estab & Related" connection-state=established,related
add action=accept chain=forward comment="VLAN Internet access" connection-state=new in-interface-list=VLAN out-interface-list=WAN
add action=accept chain=forward comment="BASE_VLAN Internet access" connection-state=new in-interface-list=BASE out-interface-list=WAN
add action=drop chain=forward comment="Drop the rest"
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat out-interface=MullvadWG_1 src-address=0.0.0.0/0
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=MullvadWG_1 routing-table=MullvadWG_1_Table suppress-hw-offload=no
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.112.0/24 port=8080
set ssh address=192.168.112.0/24
set winbox address=192.168.112.0/24
/ip smb shares
set [ find default=yes ] directory=pub
/routing rule
add action=lookup-only-in-table disabled=no src-address=10.0.10.246 table=MullvadWG_1_Table
/system identity
set name=BBB
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=BASE
/tool mac-server mac-winbox
set allowed-interface-list=BASE
Would be awesome if you could help me!
Thanks 
Cheers