How to set up a WireGuard VPN on MikroTik

What WireGuard on MikroTik gives you

WireGuard is a modern, fast VPN protocol built into RouterOS 7. Setting up a wireguard mikrotik tunnel lets remote staff, laptops and phones reach your office network securely, and it can connect two sites together. It uses less CPU than IPsec or OpenVPN, reconnects instantly and is small enough to audit. This guide builds a road-warrior server so a single client device can dial in.

Before you start

• RouterOS 7.1 or newer. WireGuard is not available in RouterOS 6.
• A public IP or a stable DNS name on the router's WAN interface.
• WinBox, WebFig or an SSH terminal. Every command below is CLI.

Step 1. Create the WireGuard interface

The router generates its own key pair automatically. Pick a UDP port and open it in the firewall later.

/interface/wireguard add name=wg-vpn listen-port=51820
/interface/wireguard print

The print output shows the interface public key. Copy it; the client needs it.

Step 2. Give the tunnel an IP range

Assign a subnet that does not overlap your LAN. Here the router is 10.10.0.1 and clients live in 10.10.0.0/24.

/ip/address add address=10.10.0.1/24 interface=wg-vpn

Step 3. Open the firewall

Allow the WireGuard UDP port on the input chain. Place the rule above any drop rules.

/ip/firewall/filter add chain=input protocol=udp dst-port=51820 \
  action=accept comment="Allow WireGuard"

Step 4. Add the client as a peer

Generate a key pair on the client first; the WireGuard app does this for you. Paste its public key here and reserve one address inside the tunnel subnet.

/interface/wireguard/peers add interface=wg-vpn \
  public-key="CLIENT_PUBLIC_KEY_HERE" \
  allowed-address=10.10.0.2/32

Step 5. Let clients reach the internet and LAN

For a full tunnel, masquerade traffic leaving the WAN (here ether1) and confirm the client subnet can route to your LAN.

/ip/firewall/nat add chain=srcnat out-interface=ether1 \
  src-address=10.10.0.0/24 action=masquerade

Step 6. Configure the client

On the phone or laptop, create a tunnel with these values. The Endpoint is your router's public IP or DNS name plus the port from Step 1.

[Interface]
PrivateKey = CLIENT_PRIVATE_KEY
Address = 10.10.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = ROUTER_PUBLIC_KEY
Endpoint = your-router.example.com:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Set AllowedIPs to your LAN subnet only (for example 192.168.88.0/24) if you want a split tunnel instead of routing all traffic.

Troubleshooting

• No handshake: check the firewall rule order and that the UDP port is reachable from outside.
• Handshake but no traffic: the allowed-address on the router and AllowedIPs on the client must match the tunnel IPs.
• Behind CGNAT: the client needs PersistentKeepalive, and the router still needs a reachable public address.

Takeaway

Create the interface, give it an IP, open one UDP port, add a peer per device and masquerade for full-tunnel access. Keep each device on its own key and its own /32 so you can revoke one without touching the rest. CloudHosting runs MikroTik CHR virtual routers in our Riga data centre if you want to build this on a hosted router instead of on-site hardware.