WireGuard VPN on MikroTik RouterOS 7

Introduction

WireGuard is a modern, high-performance VPN protocol that was added to MikroTik RouterOS 7.x natively. It's far simpler to configure than OpenVPN or IPSec, uses state-of-the-art cryptography, and delivers excellent throughput.

Prerequisites

MikroTik RouterOS 7.1 or later
Public IP on the MikroTik router (or port forwarding)
WireGuard client app on endpoints

Step 1: Enable WireGuard on RouterOS

BASH

# Add WireGuard interface
/interface wireguard
add name=wg0 listen-port=13231 mtu=1420

# View the auto-generated public key (share this with peers)
/interface wireguard print

Note the public-key value — you'll need to give this to each peer.

Step 2: Assign IP to the WireGuard Interface

BASH

/ip address add address=10.200.0.1/24 interface=wg0

Step 3: Generate Client Keys

On a Linux machine or WireGuard app:

BASH

wg genkey | tee client_private.key | wg pubkey > client_public.key
cat client_private.key  # keep this SECRET
cat client_public.key   # give this to RouterOS

Step 4: Add Peer on RouterOS

BASH

/interface wireguard peers
add interface=wg0   public-key="CLIENT_PUBLIC_KEY_HERE"   allowed-address=10.200.0.2/32   comment="Laptop-John"

Step 5: Configure Firewall

BASH

# Allow WireGuard UDP port
/ip firewall filter
add chain=input protocol=udp dst-port=13231 action=accept comment="WireGuard"

# Allow traffic from WireGuard subnet
add chain=input src-address=10.200.0.0/24 action=accept
add chain=forward src-address=10.200.0.0/24 action=accept
add chain=forward dst-address=10.200.0.0/24 action=accept

Step 6: Client Configuration File

Create a config file for the client:

INI

[Interface]
PrivateKey = CLIENT_PRIVATE_KEY_HERE
Address = 10.200.0.2/24
DNS = 8.8.8.8

[Peer]
PublicKey = MIKROTIK_PUBLIC_KEY_HERE
Endpoint = YOUR_PUBLIC_IP:13231
AllowedIPs = 192.168.1.0/24, 10.200.0.0/24
PersistentKeepalive = 25

Site-to-Site WireGuard

For connecting two MikroTik sites:

Site A (10.10.1.0/24):

BASH

/interface wireguard
add name=wg-site-b listen-port=13232 mtu=1420

/ip address add address=10.99.0.1/30 interface=wg-site-b

/interface wireguard peers
add interface=wg-site-b   public-key="SITE_B_PUBLIC_KEY"   endpoint-address=SITE_B_PUBLIC_IP   endpoint-port=13232   allowed-address=10.10.2.0/24,10.99.0.2/32   persistent-keepalive=25

Add static routes for the remote network:

BASH

/ip route add dst-address=10.10.2.0/24 gateway=wg-site-b

Monitoring WireGuard

BASH

# Check peer handshake status
/interface wireguard peers print
# "last-handshake" should be recent (within 3 minutes)

# Traffic counters
/interface wireguard peers print stats

Performance Tips

WireGuard uses ChaCha20-Poly1305 — extremely fast on ARM CPUs
Set MTU to 1420 to avoid fragmentation over most internet connections
PersistentKeepalive=25 keeps NAT mappings alive for mobile clients
WireGuard is connectionless — there's no "connect/disconnect" state; just check last-handshake
For road warriors, use AllowedIPs = 0.0.0.0/0 to route all traffic through the VPN