Not trying to be abrasive, but your firewall rules are kind of a mess. It's very typical of what newcomers produce on their first try, so if you're willing to learn, you'll get there. Just keep up trying/learning/reading. Just be careful: there are *lots* of "tutorials" on youtube and other places that are of *very* bad quality.
Group your chains! Only a specific chain is executed for a packet (at a time) so separating and intermixing rules doesn't hinder the router from doing its job, but it makes it much harder for us, anyone or even yourself to understand exactly what's going on.
A good start for an input firewall ruleset is the following:
1. drop connection state invalid
2. accept connection state established/related
3. accept all traffic with in-interface lo (loopback traffic)
4. accept all icmp
5. accept external connections that you want to enable - in your case udp 13231 for wireguard
*** This was the global part. From now on we do local traffic filtering.
6. accept udp 7 from LAN (this is echo service udp - you may not want or need this)
7. accept tcp 7 from LAN (this echo service tcp - you may not want or need this)
8. accept udp 53 from LAN (dns udp)
9. accept tcp 53 from LAN (dns tcp)
10. accept tcp 22 from LAN (ssh config)
11. accept tcp 80 from LAN (webfig config)
12. accept tcp 8291 from LAN (winbox config)
*** And now we drop *everything* that we didn't allow
13. drop (everything, unconditionally) - you might want to have this rule disabled when you set it, and then enable it using safe mode, so you don't get locked out of your router
Of course you might (should, probably) want to adjust these according to what exactly you want/need. For example it's generally a good idea to disable webfig, if you don't use it to configure your router. If you need additional things allowed, those have to be added as well.
Also, it's very good practice to add some short but descriptive comment for all your rules, so you can come in later and see at a glance what everything does.
A note about the echo service on port 7. Some programs and apps - especially on smartphones - like to use this to detect network access. It's mostly harmless to allow it and may help them provide a more consistent interface. All things that I have seen work without it too
So it's basically a preference.
EDIT: It seems Mikrotiks don't support the echo protocol at all. Wouldn't have thought.
).
