Does MikroTik support WireGuard?

Yes. MikroTik includes a native WireGuard interface in RouterOS 7. It can act as a remote-access server, a site-to-site peer, or a client of a compatible VPN provider.

Which RouterOS version do I need for WireGuard?

Use RouterOS 7. Upgrade to a current stable release supported by your exact router, and export a backup before changing firewall or routing rules.

Can a MikroTik WireGuard server work behind CGNAT?

Not as a normal inbound server because the public UDP packet cannot reach your router through the ISP's shared NAT. Ask for a public IP, use an outbound relay or mesh path, or make the MikroTik the client of a reachable server.

Why does WireGuard show a handshake but no traffic?

The encrypted peer session is working, but routing or filtering is not. Check RX and TX counters, Allowed Address on both peers, the destination route, forward-chain rules, NAT only where required, and the destination network's return route.

What should Allowed Address contain on MikroTik?

Use the exact tunnel address and remote prefixes reachable through that peer. Do not add the same Allowed Address to two peers on one interface, and use 0.0.0.0/0 only when that peer should receive all IPv4 traffic.

Can MikroTik connect as a WireGuard client?

Yes. Add the provider or remote server as a peer with its endpoint, public key, and allowed prefixes, then create explicit routing and DNS behavior. Client mode creates an outbound path; it does not automatically provide inbound remote access.

How do I prevent DNS leaks through MikroTik WireGuard?

Send DNS to a resolver reachable through the tunnel, stop WAN DHCP from replacing it when appropriate, and block or redirect client DNS that should never leave through the normal WAN. Test both IPv4 and IPv6 after connecting.

How can I improve WireGuard speed on MikroTik?

Test with one peer and no queues first, watch router CPU, compare nearby endpoints, and only lower MTU after confirming fragmentation symptoms. FastTrack, policy routing, queues, and connection tracking can change which path traffic takes.

Why does a MikroTik WireGuard QR code fail to import?

A client profile must contain the client's private key, its tunnel address, the MikroTik public key and endpoint, and valid AllowedIPs. A QR code made from an incomplete export or the wrong peer-side key will not create a usable profile.

How do I connect a Linux client to MikroTik WireGuard?

Create a peer for the Linux public key, assign a unique tunnel address, and import the matching client configuration into NetworkManager or wg-quick. Then verify a recent handshake, routes, DNS, and access to only the intended LAN prefixes.

Guide

16 min readJul 30, 2026

WireGuard MikroTik Setup: Build a VPN That Actually Passes Traffic

Configure WireGuard on MikroTik RouterOS 7 for remote access, site-to-site links, or a privacy VPN—and fix the tunnel when it handshakes but passes no traffic.

Quick answer

Use RouterOS 7, choose one job for the tunnel, and verify the path in this order: UDP reachability, latest handshake, RX/TX counters, Allowed Address, routes, then firewall. For a simple outbound privacy tunnel—not inbound home access—Proton VPN publishes a MikroTik WireGuard profile and setup path.

Get Proton VPN Choose my setup Fix my symptom

Interface

Create the WireGuard interface and protect its private key.

Address

Assign a dedicated, non-overlapping tunnel subnet.

Peer

Add the other public key and exact allowed prefixes.

Firewall

Allow UDP input and only the forwarding you intend.

Interactive setup chooser

Choose the job before you configure the tunnel

“WireGuard MikroTik setup” covers three different network jobs. Pick one so the generated keys, Allowed Address values, firewall chain, and routes all point in the same direction.

Best for

Phone or laptop access to home, office, NAS, or admin tools

Hard requirement

A reachable public UDP path, or an alternative relay when the WAN is behind CGNAT

Your next action

Create one peer address per device, allow the UDP listen port in input, then allow only the required LAN destinations in forward.

RouterOS terminal

/interface/wireguard
add name=wg-remote listen-port=13231

/ip/address
add address=10.66.66.1/24 interface=wg-remote

/interface/wireguard/peers
add interface=wg-remote public-key="<CLIENT_PUBLIC_KEY>" \
    allowed-address=10.66.66.2/32

Replace every angle-bracket placeholder. Review existing firewall order and routes before pasting commands; RouterOS appends new rules, so an allow rule below a broad drop rule cannot match.

Traffic-first troubleshooting

A handshake is not the finish line

A recent handshake proves key exchange and UDP reachability. It does not prove that RouterOS selected the right route, allowed forwarding, received a reply, or kept DNS inside the tunnel.

Most likely layer

Handshake, no traffic

Do not regenerate keys. Authentication works; Allowed Address, routes, forward rules, or the return path is wrong.

1Watch peer RX and TX counters while generating traffic.
2Match the client AllowedIPs to the prefixes you actually want to reach.
3Confirm RouterOS has a route to the destination and the destination has a return path.
4Check forward-chain counters before adding masquerade; LAN access usually needs routing, not NAT.

MikroTik WireGuard routes and Allowed Address

Allowed Address does two jobs: it identifies which source addresses a peer may send, and it identifies which destinations belong to that peer. Keep peer tunnel addresses unique, avoid overlapping prefixes on one interface, and create an explicit return path for every remote LAN.

Decision	Remote access	Site-to-site	VPN provider
Primary goal	Reach one private network	Join two private networks	Change the internet exit
Inbound public IP	Usually required	Required on at least one side	Not required
Main routing object	Client tunnel /32 + LAN prefix	Remote LAN prefix	Default or policy route
NAT	Only for internet exit	Usually no	Usually provider-path masquerade
Common failure	CGNAT or input rule order	Missing return route	Endpoint routed into its own tunnel

CGNAT changes the topology, not the keys

If the MikroTik WAN address is private or inside 100.64.0.0/10 while a public-IP lookup shows something else, unsolicited UDP cannot normally reach it. Do not keep changing WireGuard settings: request a public IP, use an outbound relay or mesh path, or make the router connect outward.

Run the CGNAT check

Fastest privacy path

Need an outbound privacy tunnel, not remote access?

Proton VPN publishes a current MikroTik RouterOS 7 WireGuard workflow. Generate a fresh profile, preserve a direct route to the VPN endpoint, and test DNS before moving all devices. A provider tunnel changes the internet exit; it does not make a CGNAT home network reachable from outside.

Get Proton VPN for MikroTik

Five checks before you call the tunnel done

Peer state

A recent last-handshake and RX/TX counters that move in both directions.

Routes

The destination prefix resolves through the intended WireGuard interface or policy table.

Firewall

Input allows only the UDP listener; forward allows only intended tunnel traffic.

Return path

The destination LAN knows how to send replies back to the tunnel subnet.

Leaks

DNS and IPv6 follow the intended path, including after reconnect and reboot.

Continue with the matching network guide

Router VPN guideCompare a router VPN client with a VPN server and passthrough.Check for CGNATConfirm whether inbound UDP can reach your MikroTik WAN.Closed-port diagnosisTrace inbound reachability, firewall, double NAT, and ISP blocks.VPN for LinuxChoose a GUI, CLI, or manual WireGuard client for your desktop.

WireGuard MikroTik FAQ

Official references

Configuration facts were checked against current primary documentation on July 30, 2026.

MikroTik RouterOS WireGuard manual WireGuard quick start Proton VPN MikroTik guide

Share this article