Configure WireGuard on MikroTik

Simple cofiguration for a WireGuard VPN interface on a MikroTik router

Published on updated on

This is a peer-to-site-like WireGuard tunnel configuration where the router is the gateway for the site.

You can use this kind of configuration to access your internal devices, like a NVR or NAS, through your own VPN tunnel, from outside your network / home.

Values used, these can be customized as you want:

  • wgc is the router’s interface WireGuard name
  • 51820 is the standard UDP port used by WireGuard. You can use any UDP port over 1024
  • 10.10.23.0 / 24 is the network allocated for this interface
  • 10.10.23.1 is the IP address of router’s WireGuard interface
  • 10.10.23.2 is the IP address of one peer

The interface

Create a WireGuard interface named wgc, assign it an IP address and a port:

/interface/wireguard/add listen-port=51820 name=wgc
/ip/address/add address=10.10.23.1/24 interface=wgc

The private and public keys will be generated automatically. To configure the peers we need the public key generated for this interface. Execute:

/interface wireguard print

and copy the public key. This is the router's public key.

Peers

To add a peer you need it’s public key. To generate the public and private keys read on the next paragraphs.

A peer is defined by a public key and an IP address. Select and IP address then add the peer like this:

/interface wireguard peers
add allowed-address=10.10.23.2/32 interface=wgc public-key="BdukRu8f+Uu3gIUhmGK3ojjxb9zjDib8rj1+YUvFHAA="

Android peer

Install the WireGuard Android app

Click the + button, select Create from scratch then:

  • give a name to this interface
  • Private key: press the refresh button and a new set of keys key will be generated
  • Public key: you need this key to add the peer on the router
  • Addresses: add the IP address that you allocated to this client. Example: 10.10.23.2/24

Click Add peer then:

  • Public key: here you should enter the router's public key
  • Endpoint: your_router’s_external_IP_address_or_DNS_name:51820
  • Allowed IPs: 0.0.0.0/0

Linux peer

For details check the WireGuard web page.

#!/bin/bash

WGINTF='wg0'
WGADDR='10.10.23.2'
WGENDP='external_IP_address_or_DNS_name_for_router:51820'
WGPUBK='public_key_of_the_router'

if ! command -v wg >/dev/null 2>&1; then
  printf 'wireguard tools are not installed !\n'
  sudo apt install && \
    sudo apt -y install wireguard
fi

if [ -f "/etc/wireguard/${WGINTF}.key" ]; then
    printf 'The key file %s already exists!\n' "/etc/wireguard/${WGINTF}.key"
    exit 1
fi
if [ -f "/etc/wireguard/${WGINTF}.conf" ]; then
    printf 'The configuration file %s already exists!\n' "/etc/wireguard/${WGINTF}.conf"
    exit 1
fi

wg genkey \
    | sudo tee "/etc/wireguard/${WGINTF}.key" \
    | wg pubkey \
    | sudo tee "/etc/wireguard/${WGINTF}.pub" >/dev/null

sudo chmod 0600 "/etc/wireguard/${WGINTF}.key"
sudo chown root: "/etc/wireguard/${WGINTF}.key"

sudo tee "/etc/wireguard/${WGINTF}.conf" >/dev/null <<EOF
[Interface]
Address = ${WGADDR}/24
ListenPort = 51820
PostUp = wg set %i private-key /etc/wireguard/%i.key

[Peer]
PublicKey = ${WGPUBK}
Endpoint = ${WGENDP}
AllowedIPs = 0.0.0.0/0
EOF

printf 'Test with:\nsudo wg-quick up %s\n' "${WGINTF}"

Related commands:

  • ip link set up dev wg0
  • wg show and wg showconf

The firewall

/ip firewall filter
add action=accept chain=input comment="WireGuard" dst-port=51820 protocol=udp

Customize the firewall rules for your peers and the network allocated to them.

Here are a few examples:

# to allow the peer `10.10.23.2` unrestricted access this router:
add action=accept chain=input comment="WireGuard peer to router" src-address=10.10.23.2

# to allow all the net `10.10.23.0/24` unrestricted access to another interface:
add action=accept chain=forward comment="WireGuard peers to Video interface" src-address=10.10.23.0/24 out-interface=Video