How to Configure WireGuard VPN Server On Mikrotik | Remote VPN Access
Explore IT Issues: Solutions For All
Here’s a clear step‑by‑step guide to configuring a WireGuard VPN server on MikroTik RouterOS for remote access:
🔑 Prerequisites
MikroTik router running RouterOS v7+ (WireGuard is supported only from v7).
Basic networking knowledge (IP addressing, firewall rules).
At least one public IP or dynamic DNS for remote access.
WireGuard client installed on your remote device (Windows, macOS, Linux, iOS, Android).
⚙️ Step 1: Create WireGuard Interface
Log into your MikroTik via Winbox or CLI.
Add a new WireGuard interface:
/interface wireguard add name=wg0 listen-port=51820
listen-port can be any unused port (default: 51820).
Router will generate a public/private key pair automatically.
⚙️ Step 2: Assign IP Address
Assign an internal VPN subnet to the WireGuard interface:
/ip address add address=10.10.0.1/24 interface=wg0
This subnet will be used for VPN clients.
⚙️ Step 3: Configure Peer (Client)
Generate keys on the client (via WireGuard app or CLI).
Add the client as a peer on MikroTik:
/interface wireguard peers add interface=wg0 public-key="CLIENT_PUBLIC_KEY" allowed-address=10.10.0.2/32
Replace CLIENT_PUBLIC_KEY with the client’s key.
allowed-address is the client’s VPN IP.
⚙️ Step 4: Client Configuration
On the client device, configure:
[Interface]
PrivateKey = CLIENT_PRIVATE_KEY
Address = 10.10.0.2/32
DNS = 8.8.8.8
[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = YOUR_PUBLIC_IP:51820
AllowedIPs = 0.0.0.0/0
Replace SERVER_PUBLIC_KEY with MikroTik’s WireGuard public key.
Endpoint is your router’s public IP/DNS + port.
AllowedIPs = 0.0.0.0/0 routes all traffic via VPN (use 10.10.0.0/24 if you only want LAN access).
⚙️ Step 5: Firewall & NAT Rules
Allow WireGuard traffic:
/ip firewall filter add chain=input action=accept protocol=udp dst-port=51820
- If you want clients to access the internet via VPN, add NAT:
/ip firewall nat add chain=srcnat action=masquerade src-address=10.10.0.0/24
⚙️ Step 6: Test Connection
Activate the WireGuard interface on MikroTik.
Connect from the client.
Verify with:
/interface wireguard peers print
You should see handshake and data exchange.
🚨 Key Considerations- Security: Always use strong keys and restrict allowed-address to specific subnets.
Performance: WireGuard is lightweight and faster than IPsec/L2TP.
Remote Access: You can configure multiple peers for different users/devices.