Mikrotik How to separate wan and lan traffic to send one via wireguard?

Question

Mikrotik

Hello, I need to separate devices to access the Internet through a secure tunnel, but in order to save traffic, I need to let through wireguard the output of only those devices that are connected via lan ...
What actions need to be taken so that all connected devices via Wi-Fi go out directly?

Answer 1

Make a separate bridge for Wi-Fi and a separate DHCP with a separate address pool.
Exclude the wlan interface/sy from the bridge which is for LAN and add them to the bridge which is for Wi-Fi Configure
NAT
In the firewall settings, use Mangle to mark the traffic from the LAN and wrap only it in wireguard