WireGuard implementation in MikroTik RouterOS

Deploying WireGuard on MikroTik RouterOS via the command line interface (CLI) can be done by following these basic steps.

This example provides a simple configuration to establish a VPN tunnel between a WireGuard server on MikroTik and a remote client. Remember to adapt specific settings, such as IP addresses and keys, to your own environment.

1. RouterOS Update

Make sure your MikroTik device is updated and supports WireGuard. To do this, you can check and update your version of RouterOS from the “System” and “Packages” menu in WinBox or through the CLI with the command /system package update check-for-updates and then /system package update install.

2. Key Generation

Generates a key pair (public and private) for the server and client. On the MikroTik device (server), use the following command to generate the keys:

/tool ​​wireguard key generate

/tool ​​wireguard key print

3. WireGuard Interface Configuration

Configure the WireGuard interface on the MikroTik server with the generated private key and define a listening port. Replaces GENERATED-PRIVATE-KEY with your real private key.

/interface wireguard add name=wg0 listen-port=51820 private-key=GENERATED-PRIVATE-KEY

4. Peer Configuration

Adds the client device as a peer on the server, specifying the client's public key and the IP address to be assigned to the client within the VPN tunnel. Replaces CLIENT-PUBLIC-KEY with the client's real public key and CLIENT-IP with the desired IP address for the client within the VPN.

/interface wireguard peers add interface=wg0 public-key=CLIENT-PUBLIC-KEY allowed-address=CLIENT-IP/32

5. Assignment of IP Addresses and Routes

Assign an IP address to the WireGuard interface on the server and configure the necessary routes. For example, if you want the server to have the address 10.0.0.1 inside the VPN tunnel:

/ip address add address=10.0.0.1/24 interface=wg0

Configure routes if necessary, depending on your network and how you want traffic to flow through the VPN tunnel.

6. Firewall Configuration

Make sure to allow UDP traffic for the WireGuard port (default, 51820) on the MikroTik firewall:

/ip firewall filter add action=accept chain=input protocol=udp port=51820

7. Client Configuration

On the client device, you will need to perform a similar configuration, including creating a WireGuard interface, generating keys (if not already done), and configuring this interface with the client's private key and specifying the MikroTik server as your peer with the server's public key.

Remember that each environment is unique, and these steps may require adaptations. Additionally, it's always important to consider security and privacy when setting up VPNs, ensuring only authorized devices can connect.