There is no value in getting post numbers up, so not sure what you are alluding too.
Clearly you are liar thought as a condition of responding was predicated on arrogance, dont bother posting unless......................
I dont like BS and call it out when I see it. Political speak and niceties aside, truth hurts, too bad, grow a pair and next time just ask for help without constraints!!
Your situation is very common and there is nothing complex about it.
You want to setup the hex behind another router so as to be able to reach an internal network.
The one caveat is that you need to be able to port forward the mikrotik listening port from the ISP router to the HEX router ???
Assuming thats possible.
One can setup the hex as a bare bones routing device.
The one thing to be sure of is to have a source-nat rule to the WANport on the hex, so that all wireguard requests to the subnet look like they are coming from the WANIP of the hex ( also its LANIP on the subnet of the ISP modem/router ). Otherwise although the ISP modem router would have no way of directing any return traffic back to wireguard source addresses as they are not local to the ISP modem/router and would get dropped.
Wireguard understanding -->
viewtopic.php?t=182340
Example of Router Setup
.......
/interface bridge
add ingress-filtering=no name=bridgeWG
/interface ethernet
set [ find default-name=ether1 ] name=TO-ISP-ROUTER
set [ find default-name=ether2 ] name=emergaccess { to be able to access and config hex directly and off bridge }
/interface wireguard
add name=wireguard1 listening-port=51820
/interface list
add name=WAN
add name=LAN
/ip pool
add name=bridgepool range=192.168.20.10-192.168.20.50
/ip dhcp-server
add name=bridge-server interface=bridgeWG address-pool=bridgepool
/ip dhcp-server network
add address=192.168.20.0 dns-server=192.168.20.1 gateway=192.168.20.1
/interface bridge port
add bridge=bridgeWG interface=ether3
add bridge=bridgeWG interface=ether4
add bridge=bridgeWG interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/wireguard peers
add interface=wireguard1 allowed-addresses=110.50.50.2 comment=peer1 {public key etc. }
add interface=wireguard1 allowed-addresses=110.50.50.3 comment=peer2 { public key etc. }
/interface list member
add interface=bridgeWG list=LAN
add interface=emergaccess list=LAN
add interface=wireguard1 list=LAN { thus remote wg users will get sourcenatted out WAN } *****
add interface=TO-ISP-ROUTER list=WAN
/ip address
add address=192.168.100.250/24 interface=TO-ISP-ROUTER network=192.168.100.0 comment="WANIP_of_HEX" { make static entry }
add address=192.168.20.1/24 interface=bridge-WG network=192.168.100.0 comment="hex lan"
add address=192.168.55.1/24 interface=emergaccess network=192.168.55.0 comment="ether2 access off bridge"
add address=110.50.50.1/24 interface=wireguard1 network=110.50.50.0 comment="wireguard network1"
/ip dns
set allow-remote-requests=yes servers=192.168.100.1
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN *****
/ip route
add dst-address=0.0.0.0/0 gateway=192.168.100.1
/ip service
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Use of off bridge access is optional but it avoids any hassles when configing any MT bridge and along with use of safe mode makes life much easier.
( just plug in laptop to ether2 put in 192.168.55.5 for example on ipv4 settings and you will be in )
NOTE: I have not included any firewall rules and thus
ALL traffic will pass.
+++++++++++++++++++++++++++++++++++++++++++
Regarding Clients.................... This is really messed up!!
(1) The address of the wireguard client is the address on the WG network thus it should be
110.50.50.2/32
If you had another client you could give it.
110.50.50.3/32
(2) The allowed IPs is missing the wireguard Ips..........
You can choose
allowed-ips= 110.50.50.
0/24,192.168.10
0.0/24 ( which allows you to ping any other wg device (useful if other client routers in the mix) and of course the subnet in question
OR
allowed-ips=
0.0.0.0/0 which includes all of the above and in case you wanted remote users
to use internet of ISP router.
(3) The endpoint shown in your illustration is not correct. The endpoint is the
PUBLIC IP of the ISP router.
How do you propose to provide that?
Is the WANIP of the ISP modem router a fixed/static or dynamic WANIP.
One option is to use the IP CLOUD function on the hex router for the dynamic case if you dont already have an existing dyndns name/provider.
