How to Connect MikroTik to WireGuard VPN (Winbox & Terminal Guide)

WireGuard is a modern, high-performance VPN protocol known for its simplicity and security. With the release of MikroTik RouterOS version 7, WireGuard support has been integrated, allowing users to set up secure VPN tunnels with ease. This guide provides a comprehensive walkthrough on configuring MikroTik WireGuard VPN using both the graphical Winbox interface and the command-line Terminal.

---

Prerequisites

Before proceeding, ensure the following:

• Your MikroTik router is running RouterOS version 7.0 or higher.
• Access to Winbox or Terminal (SSH or serial console).
• Basic understanding of networking concepts.

---

Configuring WireGuard VPN Using Winbox

Step 1: Create WireGuard Interface

1. Open Winbox and connect to your MikroTik router.myconfigure.blogspot.com+2redshieldvpn.xyz+2help.rackzar.com+2
2. Navigate to Interfaces > WireGuard.Reddit+9MikroTik Forum+9MikroTik Forum+9
3. Click the “+” button to add a new WireGuard interface.help.rackzar.com
4. Set the following parameters:
   • Name: wireguard1
   • Listen Port: 51820 (default WireGuard port)
   • Private Key: Click “Generate” to create a new private key.
5. Click “OK” to save the interface.

Step 2: Assign IP Address to WireGuard Interface

1. Go to IP > Addresses.
2. Click the “+” button to add a new IP address.IVPN
3. Set the following parameters:
   • Address: 10.0.0.1/24
   • Interface: wireguard1
4. Click “OK” to apply the settings.

Step 3: Add WireGuard Peer

1. Navigate to Interfaces > WireGuard.
2. Select the wireguard1 interface and click on the “Peers” tab.
3. Click the “+” button to add a new peer.
4. Set the following parameters:
   • Public Key: Enter the public key of the remote peer.
   • Allowed Address: 10.0.0.2/32
   • Endpoint Address: Enter the public IP address of the remote peer.
   • Endpoint Port: 51820
   • Persistent Keepalive: 25
5. Click “OK” to save the peer configuration.

Step 4: Configure Firewall Rules

1. Navigate to IP > Firewall > Filter Rules.
2. Click the “+” button to add a new rule.
3. Set the following parameters:
   • Chain: input
   • Protocol: udp
   • Dst. Port: 51820
   • Action: accept
4. Click “OK” to apply the rule.

Step 5: Configure NAT (Masquerade)

1. Navigate to IP > Firewall > NAT.
2. Click the “+” button to add a new rule.
3. Set the following parameters:
   • Chain: srcnat
   • Out. Interface: wireguard1
   • Action: masquerade
4. Click “OK” to save the NAT rule.

---

Configuring WireGuard VPN Using Terminal

Step 1: Create WireGuard Interface

/interface wireguard add name=wireguard1 listen-port=51820 private-key="your_private_key"

Step 2: Assign IP Address to WireGuard Interface

/ip address add address=10.0.0.1/24 interface=wireguard1

Step 3: Add WireGuard Peer

/interface wireguard peers add interface=wireguard1 public-key="remote_public_key" endpoint-address=remote_ip endpoint-port=51820 allowed-address=10.0.0.2/32 persistent-keepalive=25

Step 4: Configure Firewall Rules

/ip firewall filter add chain=input action=accept protocol=udp dst-port=51820 comment="Allow WireGuard"
/ip firewall filter add chain=input action=accept src-address=10.0.0.0/24 comment="Allow WireGuard subnet"

Step 5: Configure NAT (Masquerade)

/ip firewall nat add chain=srcnat action=masquerade out-interface=wireguard1

---

Testing the MikroTik WireGuard VPN

• Ensure that the WireGuard interface is running:

/interface wireguard print

• Ping the remote peer to verify connectivity:

/ping 10.0.0.2

---

FAQ: MikroTik WireGuard VPN

What is the advantage of using WireGuard over other VPN protocols?

WireGuard offers a simpler codebase, faster speeds, and improved security compared to traditional VPN protocols like IPsec and OpenVPN.

Can I use multiple peers with WireGuard on MikroTik?

Yes, you can configure multiple peers on a single WireGuard interface, each with its own set of allowed IPs and endpoints.

How do I update the WireGuard keys?

Generate new key pairs and update the private key on your MikroTik interface and the corresponding public keys on the peers.

Is it possible to route only specific traffic through the WireGuard tunnel?

Yes, by configuring appropriate routing rules and firewall policies, you can route specific traffic through the VPN tunnel.

How can I monitor the status of the WireGuard connection?

Use the command /interface wireguard peers print to view the status, including the latest handshake and data transfer statistics.

---

Looking for a reliable VPN that supports open-source apps and anonymous crypto payments?

Vpnymous is a privacy-first VPN service that lets you browse freely with no logs, no tracking, and full transparency.

Explore Vpnymous VPN

Related Guides:

OpenWrt vs MikroTik RouterOS: The Ultimate 2025 Comparison

What VPN and Tunneling Protocols Does MikroTik Support?

How to Connect MikroTik to OpenVPN Server (Complete Guide: Winbox & CLI)

How to Connect MikroTik to an L2TP/IPSec VPN (Winbox & Terminal Guide)