MikroTik WireGuard Site-to-Site VPN – Full Setup (Step by Step)
Build a site-to-site VPN between two MikroTik routers with WireGuard (RouterOS v7) and let two whole networks talk securely — full step-by-step config, exact commands below.
I set up WireGuard on both MikroTiks from scratch: the interfaces, the peers, the route to the remote LAN, and the firewall — then ping from a PC on one site to a PC on the other, across the encrypted tunnel. Realistic setup: only ONE router needs a public IP; the other just reaches out to it (behind NAT or a dynamic IP is fine). No extra tunnel subnet. Works on physical MikroTik hardware and on CHR.
⏱️ Chapters
00:00 Two networks that can't talk — and the fix
00:47 The plan & addressing
01:28 Router 1 – create the WireGuard interface
01:46 Router 2 – create the WireGuard interface
02:00 Add the peers
03:00 Route to the remote LAN
03:39 Open the firewall
04:04 Verify the handshake
04:17 The real test: PC1 → PC2
🛠️ All commands
Customize for your network: Router 1's public IP or DDNS hostname, your own LAN subnets, the
WireGuard port (13231 here — any port works as long as both sides match), and swap in each router's real public key from "wireguard print".
Base addressing + default route
/ip/address add address=192.168.10.1/24 interface=ether1 ;# Router 1 LAN
/ip/address add address=200.9.9.2/24 interface=ether3 ;# Router 1 WAN (public)
/ip/route add dst-address=0.0.0.0/0 gateway=200.9.9.1
/ip/address add address=192.168.20.1/24 interface=ether1 ;# Router 2 LAN
/ip/address add address=100.1.1.2/24 interface=ether3 ;# Router 2 WAN
/ip/route add dst-address=0.0.0.0/0 gateway=100.1.1.1
Router 1 — the WireGuard interface (public side, listens)
/interface/wireguard add listen-port=13231 name=wg-s2s
/interface/wireguard print
Router 2 — the WireGuard interface (reaches out)
/interface/wireguard add name=wg-s2s
/interface/wireguard print
Router 1 — add Router 2 as a peer (no endpoint — Router 1 just listens)
/interface/wireguard/peers add interface=wg-s2s public-key="R2_PUBLIC_KEY" \
allowed-address=192.168.20.0/24
/ip/route add dst-address=192.168.20.0/24 gateway=wg-s2s
Router 2 — add Router 1 as a peer (needs the endpoint + keepalive)
/interface/wireguard/peers add interface=wg-s2s public-key="R1_PUBLIC_KEY" \
endpoint-address=200.9.9.2 endpoint-port=13231 \
allowed-address=192.168.10.0/24 persistent-keepalive=25s
/ip/route add dst-address=192.168.10.0/24 gateway=wg-s2s
Firewall — the WireGuard port only needs opening on Router 1 (Router 2's replies come back as established)
/ip/firewall/filter add chain=input action=accept protocol=udp dst-port=13231 \
comment="Allow WireGuard" place-before=0
Firewall — on BOTH routers, let the two LANs talk through the tunnel
/ip/firewall/filter add chain=forward action=accept src-address=192.168.10.0/24 dst-address=192.168.20.0/24
/ip/firewall/filter add chain=forward action=accept src-address=192.168.20.0/24 dst-address=192.168.10.0/24
Verify
/interface/wireguard/peers print # look for a recent last-handshake + rx/tx climbing
ping 192.168.20.100 # from PC1 to PC2, across the tunnel
#mikrotik #wireguard #vpn #routeros #networkingopportunity