/interface bridge add name=bridgelan
/interface ethernet set [ find default-name=ether5 ] comment=LAN mtu=1504
/interface ethernet set [ find default-name=ether1 ] name=wan1
/interface ethernet set [ find default-name=ether2 ] name=wan2
/interface wireguard add listen-port=13241 mtu=1420 name=wireguard1
/ip pool add name=dhcp_pool0 ranges=192.168.2.226-192.168.2.233
/ip dhcp-server add add-arp=yes address-pool=dhcp_pool0 bootp-support=none interface=bridgelan lease-time=15m name=dhcp1
/routing table add disabled=no name=to_wan2
/routing table add disabled=no name=to_wan1
/interface bridge port add bridge=bridgelan ingress-filtering=no interface=ether5
/interface wireguard peers add allowed-address=10.0.0.2/32 interface=wireguard1 public-key="KLUCZPUBLICZNYKLIENTA"
/ip address add address=192.168.2.11/24 interface=bridgelan network=192.168.2.0
/ip address add address=XXX.XXX.XXX.138/29 interface=wan2 network=XXX.XXX.XXX.136
/ip address add address=192.168.0.33/24 interface=wan1 network=192.168.0.0
/ip address add address=10.0.0.1/24 interface=wireguard1 network=10.0.0.0
/ip dns set allow-remote-requests=yes cache-size=512KiB servers=8.8.8.8
/ip firewall filter add action=accept chain=forward connection-state=established,related
/ip firewall filter add action=accept chain=forward connection-state=established,related,new in-interface=bridgelan out-interface=wan1 src-address=192.168.2.0/24
/ip firewall filter add action=accept chain=forward connection-state=established,related,new in-interface=bridgelan out-interface=wan2 src-address=192.168.2.0/24
/ip firewall filter add action=accept chain=forward connection-nat-state=dstnat
/ip firewall filter add action=accept chain=forward in-interface=wireguard1 out-interface=bridgelan
/ip firewall filter add action=drop chain=forward log=yes
/ip firewall filter add action=accept chain=output
/ip firewall filter add action=accept chain=input connection-state=established,related
/ip firewall filter add action=accept chain=input icmp-options=8:0-255 protocol=icmp
/ip firewall filter add action=accept chain=input icmp-options=3:4 protocol=icmp
/ip firewall filter add action=accept chain=input connection-state=established,related,new dst-address=192.168.2.11 dst-port=53 in-interface=bridgelan protocol=udp src-address=192.168.2.0/24
/ip firewall filter add action=accept chain=input connection-state=established,related,new dst-address=192.168.2.11 dst-port=53 in-interface=bridgelan protocol=tcp src-address=192.168.2.0/24
/ip firewall filter add action=accept chain=input connection-state=new dst-address=192.168.2.11 dst-port=8291 in-interface=bridgelan protocol=tcp src-address=192.168.2.0/24
/ip firewall filter add action=accept chain=input dst-address=XXX.XXX.XXX.138 dst-port=13241 in-interface=wan2 protocol=udp
/ip firewall filter add action=drop chain=input
/ip firewall mangle add action=mark-connection chain=input in-interface=wan1 new-connection-mark=wan1_conn passthrough=yes
/ip firewall mangle add action=mark-connection chain=input in-interface=wan2 new-connection-mark=wan2_conn passthrough=yes
/ip firewall mangle add action=mark-routing chain=output connection-mark=wan1_conn passthrough=yes
/ip firewall mangle add action=mark-routing chain=output connection-mark=wan2_conn passthrough=yes
/ip firewall nat add action=masquerade chain=srcnat out-interface=wan1
/ip firewall nat add action=masquerade chain=srcnat out-interface=wireguard1
/ip firewall nat add action=masquerade chain=srcnat out-interface=wan2
/ip route add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.0.1 pref-src="" routing-table=to_wan1 scope=30 suppress-hw-offload=no target-scope=10
/ip route add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=XXX.XXX.XXX.137 pref-src="" routing-table=to_wan2 scope=30 suppress-hw-offload=no target-scope=10
/ip route add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.0.1 pref-src="" routing-table=main scope=30 suppress-hw-offload=no target-scope=10
/ip route add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=XXX.XXX.XXX.137 pref-src="" routing-table=main scope=30 suppress-hw-offload=no target-scope=10