Note3: IS IT MANDATORY? That users going out the VPN tunnel are source-natted? If SO you would fail to sourcnat the WG user(s) because your list excludes them.Īdd action=masquerade chain=srcnat comment='masqarade - VPN-TV' out-interface=VPN-TV src-address-list=VPN-TV-list Note2: UNKNOWN -> Just not sure if you need a firewall rule for WG to enter VPN tunnel in forward chain as well ?:? If you never wanted the WG warrior to access the local internet in case VPN went down, then change action=lookup-only-in-table Note1: If the VPN tunnel is not available the wg user will then go out the local internet as per the firewall rules. routing rule add src-address=192.168.20.2 action=lookup table=table=VPN-TV-route

I would get rid off the mangle attempt and do this instead. I dont like your firewall rule structure but if it works for you fine. We can ensure that WG traffic goes out the VPN tunnel if the VPN tunnel is working. To be clear you cannot have internet to both local WAN and VPN WAN for your incoming WG road warrior at the same time.

Routeros wireguard