I suspect you may need the MT to act as a router vice switch/bridge?

I presume that the XX.XX.XX.XX is not on the same network 10.8.0.0/24, right?
Can you ping successfully the XX.XX.XX.XX endpoint address from the router?
If not, which error do you get?

It sounds like the Mikrotik router may not have the correct routes or NAT configuration for WireGuard traffic.
Debug with `/log print` or `torch` to see if packets are leaving and returning correctly.

UNfortunately the "timeout" in the ping could be due to anything along the connection, including the remote 74.208.xx.xx prevented from replying to ICMP requests (newish windows as an example have a firewall rule that prevents replying from pings coming from outside the local lan), but it could as well be something in the local router settings.

I am still not convinced that the router can reach the endpoint.

/tool traceroute?

And tracert on windows?

Well it gets to 172.20.10.1 (and stops there) .
What is that address?
Your network gateway?
I don't really understand how it even gets there without a route (I was suspecting a ping error of "no route to host".).
Anyway, post the output of:

Code: Select all

/ip address print

and of

Code: Select all

/ip route print

so that we can check what is created dynamically.

# model = RB952Ui-5ac2nD
# serial number =
/interface bridge
add name=bridge1
/interface list
add name=WAN
add name=LAN
/interface list member
add interface=ether1 list=WAN
add interface=wg1 list=WAN
add interface=bridge1 list=LAN
/ip pool
add name=bridge-pool ranges=192.168.88.2-192.168.88.254
/ip dhcp-server
add address-pool=bridge-pool interface=bridge1 name=bridge-server
/interface wireguard
add listen-port=62220 mtu=1420 name=wg1
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
etc.
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=XX.XX.XX.XX endpoint-port=51820 \
interface=wg1 name=peer1 preshared-key="=" private-key="-=" public-key="="
/ip address
add address=10.8.0.7/24 interface=wg1 network=10.8.0.0
add address=192.168.88.1/24 interface=bridge1 network=192.168.88.0
/ip dns
set allow-remote-requests=yes servers=1.1.1.1
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1
/ip dhcp-client
add interface=ether1 default route=yes peer-dns=yes
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN