MikroTik WireGuard VPN – Connect From Your Phone & Laptop (Full Setup)
Connect to your home or office network from your phone or laptop with WireGuard on MikroTik
(RouterOS v7) — full step-by-step road-warrior setup, exact commands below.
In this lab I set up WireGuard remote access on a MikroTik from scratch: the interface + tunnel
subnet, the client config on laptop and phone (QR code), the firewall, then reach a server on the
home LAN from outside — fully encrypted. Works on real hardware and on CHR.
⏱️ Chapters
00:00 Connect from anywhere — the result
00:25 The plan & addressing
00:58 Router – create the WireGuard interface (+ tunnel IP)
01:32 Create the client tunnel (laptop) + get its key
01:50 Add your device as a peer
02:10 Open the firewall
02:38 Finish the client + connect
03:02 Verify – reach your server (off → on)
03:32 Create the client tunnel (phone)
04:20 Add your phone (QR code)
🛠️ All commands
1) Router – WireGuard interface + tunnel IP
/interface/wireguard add listen-port=13231 name=wg1
/ip/address add address=172.16.10.1/24 interface=wg1
/interface/wireguard print # copy the router's PUBLIC key
2) Add the laptop as a peer (paste the laptop's public key)
/interface/wireguard/peers add interface=wg1 public-key="LAPTOP_PUBLIC_KEY" allowed-address=172.16.10.2/32
3) Firewall – open the port + allow VPN → LAN
/ip/firewall/filter add chain=input action=accept protocol=udp dst-port=13231 comment="Allow WireGuard" place-before=0
/ip/firewall/filter add chain=forward action=accept src-address=172.16.10.0/24 dst-address=192.168.10.0/24
4) Laptop client config (WireGuard app)
[Interface]
PrivateKey = (auto-generated by the app)
Address = 172.16.10.2/32
DNS = 192.168.10.1
[Peer]
PublicKey = ROUTER_PUBLIC_KEY
Endpoint = YOUR_PUBLIC_IP:13231
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
5) Verify (from the laptop)
ping -t 192.168.10.100
6) Phone via QR — WebFig or WinBox 4 (router generates the keys)
WireGuard → Peers → + → Private Key: "+" → auto → Apply
Allowed Address = 172.16.10.3/32
Client Address = 172.16.10.3/32
Client Endpoint = YOUR_PUBLIC_IP:13231
Client DNS = 192.168.10.1
Client Keepalive = 25
→ click "QR Code" and scan it with the WireGuard mobile app
📋 Addressing used
Home LAN .... 192.168.10.0/24 (router .1, server .100)
VPN tunnel .. 172.16.10.0/24 (router .1, laptop .2, phone .3)
Endpoint .... YOUR_PUBLIC_IP:13231
#mikrotik #wireguard #vpn #routeros #networking