• One IP address and one UDP port on the Hub is sufficient to get the WireGuard working
• When both devices have public IP and port, anyone can establish the tunnel
• When a device (a MikroTik router that participates on the tunnel) is hidden (it doesn't have a public IP and port because it's behind a NAT), the VPN tunnel can be established only by triggering the communication from the "hiden device" to the "public device"
• The tunnel is only established when there's some communication pointed/routed to it, therefore it's good to use persistent-keepalive on the "hidden device", so that it keeps the tunnel active and the "public device" can access the other side at any time (more in the example below)
• One WireGuard interface (a Hub) can handle multiple Peers but the allowed-address play a key role in where the traffic will go. If more than one Peers is configured with allowed-address=0.0.0.0/0, only the first one in the list will get all the traffic routed to it and the other Peers will be inaccessible.
• Use pref-src in routes on Peers that have dst-address other than 0.0.0.0/0 (Kindergarten and Mom in my case). Without it, the ping or DNS requests from the Peer to the Hub won't work. (I don't know why exactly. Someone here will surely be able to explain )
• Firewall rules can block the WireGuard communication
• Add the WireGuard interface to the LAN interface list if you use the default "defconf: drop all not coming from LAN" firewall rule
• Keep track of the IPs you have used in the WireGuard network (10.254.254.0/24 in my case) so you don't assign already used IP to a new device

/interface wireguard
add listen-port=8360 mtu=1420 name=wireguard-out

/interface wireguard peers
add allowed-address=10.254.254.2/32 comment=iPhone interface=wireguard-out public-key="xxx="
add allowed-address=192.168.88.0/24,10.254.254.4/32 comment=Mom interface=wireguard-out public-key="yyy="
add allowed-address=192.168.150.0/24,10.254.254.3/32 comment=Kindergarten interface=wireguard-out public-key="zzz="

/interface list member
add interface=wireguard-out list=LAN

/ip address
add address=192.168.111.1/24 comment=my_net interface=bridge network=192.168.111.0
add address=192.168.17.24/24 interface=ether1 network=192.168.17.0 comment=WAN
add address=10.254.254.1/24 interface=wireguard-out network=10.254.254.0 comment=WireGuard

/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.17.1 pref-src="" routing-table=main suppress-hw-offload=no comment=WAN
add disabled=no distance=1 dst-address=192.168.150.0/24 gateway=wireguard-out pref-src=192.168.111.1 routing-table=main suppress-hw-offload=no comment=Kindergarten
add disabled=no distance=1 dst-address=192.168.88.0/24 gateway=wireguard-out pref-src=192.168.111.1 routing-table=main suppress-hw-offload=no comment=Mom

/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1

/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=public_IP_address_of_my_ISP endpoint-port=8360 interface=wireguard1 persistent-keepalive=2m public-key="aaa="
# my ISP forwards UDP port 8360 to my router

/interface list member
add interface=wireguard1 list=LAN

/ip address
add address=192.168.88.1/24 comment=my_net interface=ether2 network=192.168.88.0
add address=10.254.254.4/24 interface=wireguard1 network=10.254.254.0
# WAN IP obtained from DHCP

/ip route
# default route as per DHCP
add disabled=no distance=1 dst-address=192.168.111.0/24 gateway=wireguard1 pref-src=192.168.88.1 routing-table=main suppress-hw-offload=no

/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1

/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=public_IP_address_of_my_ISP endpoint-port=8360 interface=wireguard1 persistent-keepalive=2m public-key="aaa="
# my ISP forwards UDP port 8360 to my router

/interface list member
add interface=wireguard1 list=LAN

/ip address
add address=192.168.150.1/24 comment=my_net interface=ether2 network=192.168.150.0
add address=192.168.50.16/24 comment=WAN interface=ether1 network=192.168.50.0
add address=10.254.254.3/24 interface=wireguard1 network=10.254.254.0

/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=192.168.50.100 comment=WAN
add disabled=no distance=1 dst-address=192.168.111.0/24 gateway=wireguard1 pref-src=192.168.150.1 routing-table=main suppress-hw-offload=no

Perhaps a better way to handle your limitation of only allowing full internet access to one peer.
Lets say you have you have 20 iphones you need to have access to the internet through the Main Server Router.
give one an IP of 192.168.50.5/32 and the following one 192.168.50.10/32 and so on.........
Each one is allowed 0.0.0.0/0 on their settings.......

On the wireguard SERVER the IP address of the interface would be 192.168.50.1/24 network 192.168.50.0
On Wireguard Server on peer settings Allowed address would be 192.168.50.0/24
In this way every smartphone should be able to reach the internet through the wireguard tunnel.

@jvan can you email me sometime, I reached a brick wall trying to setup zerotier and need some assistance.....

/interface wireguard peers
add allowed-address=10.254.254.2/32 comment=iPhone interface=wireguard-out public-key="xxx="

- You should add 10.254.254.x addresses of peers to their allowed-address on hub, so that they too can pass through tunnel.
- Using gateway=10.254.254.x on hub for remote subnets is not necessary. You can simply use gateway=wireguard-out, because to which peer it will go is determined by allowed-address. You already have this on clients.

Using gateway=10.254.254.x can be in fact slightly confusing, even though it's correct. But you can't do dst-address=192.168.150.0/24 gateway=10.254.254.4 (wrong gateway, belongs to different peer), which is obvious, but maybe not to everyone, so if it's simple config like this, I'd probably use gateway=<WG interface>. With some more complex config, e.g. if you'd have alternative route to target subnet and you'd need WG route with check-gateway=ping, then address would be required.