Le he pegado una vuelta a la config y medio me funciona.
He separado en dos bridges todo el tinglado, sobre uno te conectas directo y con el otro por la vpn con dos rangos 192.168.100.x sin vpn 192.168.101.x con vpn.
Ahora funciona bien, eso si he necesitado una regla de masquerade para el tráfico sin vpn y otra para el con, rangos de ip diferentes, si trato de hacer masquerade sin origen a WAN, solo funciona el tráfico sin vpn.
El único problema es que usando el bridge-wg, sale por el gateway a internet y la red remota, pero no puedo conectar con otras ip del mismo rango, no deja acceder a la gestión del router, pero si del router remoto. Parece que las IPs del rango 192.168.101.0/24 quedan al usar la tabla WG aisladas.
Te adjunto la export.
Código:
/interface bridge
add name=bridge
add name=bridge_wg
/interface wireguard
add listen-port=31221 mtu=1420 name=WG
/interface list
add name=WAN
add name=LAN
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n disabled=no frequency=2437 \
security-profile="WLAN1" ssid="WLAN1" wireless-protocol=\
802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
20/40/80mhz-XXXX country=spain disabled=no frequency=auto installation=\
indoor mode=ap-bridge security-profile=Viaxe ssid=Viaxe \
wireless-protocol=802.11 wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address=2E:C8:1B:C9:11:FD \
master-interface=wlan1 multicast-buffering=disabled name=Viaxe1 \
security-profile=Viaxe ssid=viaxe wds-cost-range=0 wds-default-cost=0 \
wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address=2E:C8:1B:C9:11:FE \
master-interface=wlan1 multicast-buffering=disabled name=Viaxe_WG1 \
security-profile=Viaxe ssid=Viaxe_WG wds-cost-range=0 wds-default-cost=0 \
wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address=2E:C8:1B:C9:11:FE \
master-interface=wlan2 multicast-buffering=disabled name=Viaxe_WG2 \
security-profile=Viaxe ssid=Viaxe_WG wds-cost-range=0 wds-default-cost=0 \
wps-mode=disabled
/ip pool
add name=dhcp ranges=192.168.100.50-192.168.100.200
add name=dhcp_wg ranges=192.168.101.50-192.168.101.200
/ip dhcp-server
add address-pool=dhcp interface=bridge name=lan
add address-pool=dhcp_wg interface=bridge_wg name=lan_wg
/routing table
add disabled=no fib name=WG
/interface bridge port
add bridge=bridge interface=ether2
add bridge=bridge interface=ether3
add bridge=bridge_wg interface=ether4
add bridge=bridge_wg interface=ether5
add bridge=bridge interface=Viaxe1
add bridge=bridge interface=wlan2
add bridge=bridge_wg interface=Viaxe_WG1
add bridge=bridge_wg interface=Viaxe_WG2
/interface list member
add interface=ether1 list=WAN
add interface=bridge list=LAN
add interface=wlan1 list=WAN
add list=WAN
add interface=bridge_wg list=LAN
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=wg.com endpoint-port=\
31221 interface=WG public-key=\
"xxxx"
/ip address
add address=192.168.100.1/24 comment=Lan interface=bridge network=\
192.168.100.0
add address=192.168.50.2/30 comment=WG interface=WG network=\
192.168.50.0
add address=192.168.101.1/24 comment=Lan_WG interface=bridge_wg network=\
192.168.101.0
/ip dhcp-client
add interface=ether1
add interface=wlan1
/ip dhcp-server network
add address=192.168.100.0/24 dns-server=208.67.222.222,208.67.220.220 \
gateway=192.168.100.1 netmask=24
add address=192.168.101.0/24 dns-server=208.67.220.220,208.67.220.220 \
gateway=192.168.101.1 netmask=24
/ip firewall filter
add action=accept chain=input comment="accept established,related,untracked" \
connection-state=established,related,untracked
add action=drop chain=input comment="drop invalid" connection-state=invalid
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=4w2d chain=input comment="Port scanners list" \
protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment="drop port scanners" src-address-list=\
"port scanners"
add action=accept chain=input comment="accept icmp" limit=10,5:packet \
protocol=icmp
add action=drop chain=input comment="drop all not coming from LAN" \
in-interface-list=!LAN
add action=fasttrack-connection chain=forward comment=fasttrack \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=drop chain=forward comment="drop all from WAN not DSTNATed" \
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment=WAN ipsec-policy=out,none \
out-interface-list=WAN src-address=192.168.100.0/24
add action=masquerade chain=srcnat comment=WG out-interface=WG \
src-address=192.168.101.0/24
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.50.1 \
pref-src=0.0.0.0 routing-table=WG scope=30 suppress-hw-offload=no \
target-scope=10
/routing rule
add action=lookup comment=WG disabled=no src-address=192.168.101.0/24 \
table=WG
EDITO:
Para más datos, desde la 192.168.101.X, puedo acceder a gestionar el router por la 192.168.100.1 pero no por la 192.168.101.1.
El comportamiento es como si aislaras las IPs de la subred 192.168.101.0/24, las rutas funcionan pero no se ven entre los clientes.
forum.mikrotik.com
