General • Lan-Lan connection going out WAN

# 2024-03-07 08:40:39 by RouterOS 7.14# software id = ########### model = C53UiG+5HPaxD2HPaxD# serial number = #########/interface bridgeadd ingress-filtering=no name=BR1 port-cost-mode=short vlan-filtering=yes/interface ethernetset [ find default-name=ether1 ] name=ether1-Lan_Out poe-out=offset [ find default-name=ether2 ] disabled=yes name=ether2-Spareset [ find default-name=ether3 ] name=ether3-WAN-Sparkset [ find default-name=ether4 ] name=ether4-TRUNKset [ find default-name=ether5 ] name=ether5-Spare/interface wireguardadd listen-port=13827 mtu=1420 name=WG-1add listen-port=13820 mtu=1420 name=WG-2/interface vlanadd interface=ether4-TRUNK name=v30.wifi vlan-id=30add interface=ether4-TRUNK name=v40.guest vlan-id=40add interface=ether4-TRUNK name=v50.docker vlan-id=50add interface=ether4-TRUNK name=v66.unit vlan-id=66add interface=ether4-TRUNK name=v99.lan vlan-id=99/interface listadd name=wanadd name=lan/ip pooladd name=guest_pool ranges=192.168.40.2-192.168.40.254add name=docker_pool ranges=10.21.21.2-10.21.21.127/ip dhcp-serveradd address-pool=guest_pool interface=v40.guest name=guest_dhcpadd address-pool=docker_pool interface=v50.docker name=docker_dhcp/ip smb usersset [ find default=yes ] disabled=yes/routing tableadd disabled=no fib name=sparkadd disabled=no fib name=WGadd disabled=no fib name=WG-2add disabled=no fib name=unit/interface bridge portadd bridge=BR1 interface=ether5-Spare internal-path-cost=10 path-cost=10add bridge=BR1 interface=AC_2.4 internal-path-cost=10 path-cost=10add bridge=BR1 interface=AX_5 internal-path-cost=10 path-cost=10add bridge=BR1 disabled=yes interface=tempadd bridge=BR1 interface=ether1-Lan_Outadd bridge=BR1 interface=v30.wifiadd bridge=BR1 interface=v99.lan/ip firewall connection trackingset tcp-established-timeout=1h tcp-syn-received-timeout=10s \    tcp-syn-sent-timeout=10s udp-timeout=10s/ip neighbor discovery-settingsset discover-interface-list=lan/ip settingsset max-neighbor-entries=8192/ipv6 settingsset max-neighbor-entries=15360/interface list memberadd interface=BR1 list=lanadd interface=WG-1 list=wanadd interface=WG-2 list=wanadd interface=ether3-WAN-Spark list=wanadd interface=v66.unit list=wan/interface wireguard peersadd allowed-address=0.0.0.0/0 client-listen-port=51621 comment=150 \    endpoint-address=123.123.123.123 endpoint-port=51820 interface=WG-1 \    persistent-keepalive=26s public-key=\    "%%%%%%%%%%%%%%%%%%%%%%%%%%"add allowed-address=0.0.0.0/0 client-listen-port=51825 comment=225 \    endpoint-address=123.123.123.123 endpoint-port=51820 interface=WG-2 \    persistent-keepalive=25s public-key=\    "%%%%%%%%%%%%%%%%%%%%%%%"/ip addressadd address=10.20.20.1/24 interface=BR1 network=10.20.20.0add address=192.168.10.10/24 comment=WAN1 interface=ether3-WAN-Spark network=\    192.168.10.0add address=10.2.0.2/30 interface=WG-1 network=10.2.0.0add address=10.3.0.2/30 interface=WG-2 network=10.3.0.0add address=192.168.88.100/24 interface=v66.unit network=192.168.88.0add address=192.168.40.1/24 interface=v40.guest network=192.168.40.0add address=10.21.21.1/24 interface=v50.docker network=10.21.21.0/ip dhcp-serveradd address-pool=primary_pool interface=BR1 lease-time=1d name=primary_dhcp/ip dhcp-server networkadd address=10.20.20.0/24 comment=Main_DHCP dns-server=10.20.20.6,10.20.20.7 \    gateway=10.20.20.1add address=10.21.21.0/24 comment="Docker DHCP" dns-server=10.21.21.1 \    gateway=10.21.21.1add address=192.168.40.0/24 dns-server=192.168.40.1,1.0.0.1 gateway=\    192.168.40.1/ip dnsset allow-remote-requests=yes doh-timeout=10s max-udp-packet-size=512 \    use-doh-server=https://cloudflare-dns.com/dns-query verify-doh-cert=yes/ip dns staticadd address=1.1.1.1 name=cloudflare-dns.com/ip firewall address-listadd address=10.20.20.0/24 list=trusted_adminadd address=10.20.20.161 comment=Book list=my_devicesadd address=10.20.20.162 comment=Max list=my_devicesadd address=10.20.20.7 comment="PiHole Wireguard" list=my_devicesadd address=10.20.20.69 comment=nvr list=blocked_wanadd address=10.20.20.136 comment=reolink list=blocked_wan/ip firewall filteradd action=accept chain=input comment=\    "defconf: accept established,related,untracked" connection-state=\    established,related,untrackedadd action=drop chain=input comment="defconf: drop invalid" connection-state=\    invalid log=yes log-prefix=FI_D_Invalidadd action=accept chain=input comment="defconf: accept ICMP" protocol=icmp \    src-address-list=trusted_adminadd action=accept chain=input comment="defconf: allow admin to router" \    in-interface-list=lan log=yes log-prefix=FI_A_Lanadd action=accept chain=input comment="defconf: allow admin to router" \    in-interface=v50.docker log=yes log-prefix=FI_A_Dockeradd action=accept chain=input comment=\    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1add action=accept chain=input comment=\    "Allow lan DNS queries-UDP and NTP  services" dst-port=53,123 \    in-interface-list=lan log-prefix=DNS>> protocol=udpadd action=accept chain=input comment="Allow lan DNS queries - TCP" dst-port=\    53 in-interface-list=lan log-prefix=TCPDNS>> protocol=tcpadd action=drop chain=input comment="drop all else" log=yes log-prefix=\    FI_D_Otheradd action=fasttrack-connection chain=forward comment="defconf: fasttrack" \    connection-state=established,related hw-offload=yesadd action=accept chain=forward comment=\    "defconf: accept established,related, untracked" connection-state=\    established,related,untrackedadd action=drop chain=forward comment="defconf: drop invalid" \    connection-state=invalid log=yes log-prefix=FF_D_Invalidadd action=accept chain=forward comment="allow internet traffic" \    in-interface-list=lan out-interface-list=wanadd action=accept chain=forward comment="Docker Accept" in-interface=\    v50.docker log=yes log-prefix=FF_A_BR1-DOCKER src-address-list=\    my_devicesadd action=accept chain=forward comment="Guest Out" in-interface=v40.guest \    out-interface=v66.unitadd action=accept chain=forward comment="allow WG traffic" in-interface-list=\    lan log=yes log-prefix=FF_A_145 out-interface=WG-1add action=accept chain=forward comment="allow WG traffic" in-interface-list=\    lan log=yes log-prefix=FF_A_221 out-interface=WG-2add action=accept chain=forward comment="port forwarding" \    connection-nat-state=dstnat log=yes log-prefix=FF_A_PortFwdadd action=drop chain=forward comment="drop all else" log=yes log-prefix=\    FF_D_Other/ip firewall mangleadd action=mark-connection chain=prerouting comment="Spark Mark" \    connection-mark=no-mark in-interface=ether3-WAN-Spark \    new-connection-mark=spark_conn passthrough=yesadd action=mark-connection chain=postrouting connection-mark=no-mark \    new-connection-mark=spark_conn out-interface=ether3-WAN-Spark \    passthrough=yesadd action=mark-connection chain=prerouting comment="1WG Mark" \    connection-mark=no-mark in-interface=WG-1 new-connection-mark=1_WG_conn \    passthrough=yesadd action=mark-connection chain=postrouting connection-mark=no-mark \    new-connection-mark=1_WG_conn out-interface=WG-1 passthrough=yesadd action=mark-connection chain=prerouting comment="2WG Mark" \    connection-mark=no-mark in-interface=WG-2 new-connection-mark=2_WG_conn \    passthrough=yesadd action=mark-connection chain=postrouting connection-mark=no-mark \    new-connection-mark=2_WG_conn out-interface=WG-2 passthrough=yesadd action=mark-connection chain=prerouting comment="2D Mark" \    connection-mark=no-mark in-interface=ether2-Spare new-connection-mark=\    2d_conn passthrough=yesadd action=mark-connection chain=postrouting connection-mark=no-mark \    new-connection-mark=2d_conn out-interface=ether2-Spare passthrough=yesadd action=mark-connection chain=prerouting comment="wg Mark" \    connection-mark=no-mark in-interface=v66.unit new-connection-mark=\    unit_conn passthrough=yesadd action=mark-connection chain=postrouting comment="wg Mark" \    connection-mark=no-mark new-connection-mark=unit_conn out-interface=\    v66.unit passthrough=yesadd action=mark-routing chain=prerouting comment="Spark Return Mark" \    connection-mark=spark_conn disabled=yes in-interface-list=lan log-prefix=\    ServReturn>> new-routing-mark=spark passthrough=yesadd action=mark-routing chain=prerouting comment="2D Return Mark" \    connection-mark=2d_conn disabled=yes in-interface-list=lan log-prefix=\    ServReturn>> new-routing-mark=main passthrough=yesadd action=mark-routing chain=prerouting comment="WG Return Mark" \    connection-mark=wg_conn disabled=yes in-interface=*C log-prefix=\    WGReturn>> new-routing-mark=WG passthrough=yesadd action=mark-routing chain=output comment="Spark Return Traffic" \    connection-mark=spark_conn disabled=yes log-prefix=Spark-R>> \    new-routing-mark=spark passthrough=noadd action=mark-routing chain=output comment="2D Return Traffic" \    connection-mark=2d_conn disabled=yes log-prefix=2DReturn>> \    new-routing-mark=*401 passthrough=noadd action=mark-routing chain=output comment="WG Return Traffic" \    connection-mark=wg_conn disabled=yes log-prefix=WGReturn>> \    new-routing-mark=WG passthrough=no/ip firewall natadd action=masquerade chain=srcnat comment="MASQ Unit" log=yes log-prefix=\    NS_M_Unit out-interface=v66.unitadd action=masquerade chain=srcnat comment="MASQ Spark" connection-mark=\    spark_conn log=yes log-prefix=NS_M_Spark out-interface=ether3-WAN-Sparkadd action=masquerade chain=srcnat comment="MASQ WG45" log=yes log-prefix=\    NS_M_WG1 out-interface=WG-1add action=masquerade chain=srcnat comment="MASQ WG21" log=yes log-prefix=\    NS_M_WG2 out-interface=WG-2/ip pooladd name=primary_pool next-pool=primary_pool ranges=10.20.20.224/28/ip routeadd comment=WAN1 disabled=no distance=5 dst-address=0.0.0.0/0 gateway=\    192.168.10.254 pref-src="" routing-table=spark scope=30 \    suppress-hw-offload=no target-scope=10add comment=PrimaryRoute disabled=no distance=1 dst-address=0.0.0.0/0 \    gateway=192.168.10.254 pref-src="" routing-table=main scope=30 \    suppress-hw-offload=no target-scope=10add comment="WG 145" disabled=no distance=5 dst-address=0.0.0.0/0 gateway=\    10.2.0.1 pref-src="" routing-table=WG scope=30 suppress-hw-offload=no \    target-scope=10add comment="WG 221" disabled=no distance=5 dst-address=0.0.0.0/0 gateway=\    10.3.0.1 pref-src="" routing-table=WG-2 scope=30 suppress-hw-offload=no \    target-scope=10add comment=UNIT_WAN disabled=no distance=5 dst-address=0.0.0.0/0 gateway=\    192.168.88.1 pref-src="" routing-table=unit scope=30 suppress-hw-offload=\    no target-scope=10add disabled=yes distance=1 dst-address=192.168.10.0/24 gateway=\    192.168.10.254 pref-src="" routing-table=WG-2 scope=30 \    suppress-hw-offload=no target-scope=10/routing ruleadd action=lookup-only-in-table comment="Unit WG2" disabled=no dst-address=\    123.123.123.123/32 table=unitadd action=lookup-only-in-table comment="Unit WG1" disabled=no dst-address=\    123.123.123.123/32 table=unitadd action=lookup comment=IoT disabled=no src-address=10.20.20.128/27 table=\    WG-2add action=lookup comment=Personal disabled=no src-address=10.20.20.160/27 \    table=WG-2add action=lookup comment=TurtGamer disabled=no src-address=10.20.20.220/32 \    table=unitadd action=lookup comment="Gaming " disabled=no src-address=10.20.20.192/27 \    table=WGadd action=lookup comment=DHCP disabled=no src-address=10.20.20.224/28 table=\    unitadd action=lookup comment=SPare disabled=no src-address=10.20.20.240/28 \    table=WGadd action=lookup comment=GUEST_DHCP disabled=no src-address=192.168.40.0/24 \    table=unitadd action=lookup comment=Docker disabled=no src-address=10.21.21.0/24 table=\    WG-2/system clockset time-zone-name=Pacific/Auckland/system identityset name=AtlasV2/system loggingset 0 topics=info,!firewalladd action=Splunk prefix=MikroTik topics=!packet,!debug,!snmpadd topics=scriptadd action=MinervaSyslog disabled=yes prefix=MikroTik topics=\    !packet,!debug,!snmp/system noteset show-at-login=no/system ntp clientset enabled=yes/system ntp client serversadd address=101.100.146.146add address=202.68.92.244add address=43.252.70.34add address=162.159.200.123/tool bandwidth-serverset enabled=no/tool mac-serverset allowed-interface-list=lan/tool mac-server mac-winboxset allowed-interface-list=lan/tool snifferset filter-interface=v66.unit streaming-enabled=yes streaming-server=\    10.20.20.10:5555