⚙️
← All setup guides

MikroTik RouterOS 7 WireGuard Setup Guide

MikroTik RouterOS 7 has native WireGuard built-in. Configuration is done via Winbox, WebFig, or the CLI. RouterOS does not use wg-quick — NAT is configured through the RouterOS firewall engine. One MikroTik tunnel can cover your main LAN and all VLANs — add extra subnets from the ProxyLink tunnel page after setup.

1

Create a tunnel in ProxyLink

Go to Devices → + Add → Router / LAN site, select Home / LAN Router, enter your LAN subnet, and note the VPN IP, server public key, and endpoint from the downloaded config.

2

Create the WireGuard interface

In Winbox: Interfaces → WireGuard → Add (+)

  • Name: proxylink
  • Listen Port: any unused port (e.g. 51821)
  • Private Key: paste from your config

Or via CLI:

/interface wireguard add name=proxylink listen-port=51821 private-key="YOUR_PRIVATE_KEY"
3

Assign an IP address

/ip address add address=YOUR_VPN_IP/32 interface=proxylink

Use /32 — this is a point-to-point tunnel. Routing is handled by the peer's allowed-address and the static route below.

4

Add the ProxyLink server as a peer

/interface wireguard peers add \
  interface=proxylink \
  public-key="SERVER_PUBLIC_KEY" \
  endpoint-address=46.225.153.241 \
  endpoint-port=51820 \
  allowed-address=10.100.0.0/16 \
  persistent-keepalive=25s
5

Add return route for ProxyLink server

RouterOS does not automatically add an OS-level route from a peer's allowed-address for forwarded traffic. Without this, LAN device replies to the ProxyLink server (10.100.0.x) are sent out WAN and dropped:

/ip route add dst-address=10.100.0.0/16 gateway=proxylink comment="ProxyLink server return path"
6

Allow forwarding between interfaces

Add forward rules to allow traffic between the ProxyLink tunnel and your LAN bridge:

/ip firewall filter add \
  chain=forward \
  in-interface=proxylink \
  out-interface=bridge \
  action=accept \
  place-before=0

/ip firewall filter add \
  chain=forward \
  connection-state=established,related \
  in-interface=bridge \
  out-interface=proxylink \
  action=accept \
  place-before=1
7

Add mangle rules (required if you have multiple WAN links)

If you use load-balancing or policy routing across multiple WAN links, add these mangle rules before your load-balancing marks. This ensures ProxyLink traffic always takes the correct return path:

/ip firewall mangle add \
  chain=prerouting \
  src-address=10.100.0.0/16 \
  dst-address=192.168.1.0/24 \
  action=accept \
  comment="ProxyLink return path"

/ip firewall mangle add \
  chain=prerouting \
  src-address=192.168.1.0/24 \
  dst-address=10.100.0.0/16 \
  action=accept \
  comment="ProxyLink return path"

Repeat for each VLAN subnet you add to the tunnel.

Good to know

RouterOS 7 is required. WireGuard is not available in RouterOS 6.x.
Standard .conf files cannot be imported into RouterOS — you must configure everything manually via CLI or Winbox.
The LAN bridge in RouterOS is typically named "bridge". Check Interface → Bridge to confirm yours.
Do NOT add srcnat masquerade for ProxyLink traffic. RouterOS processes mangle before NAT de-masquerade, which breaks the return routing path and causes connections to time out. The forward accept rules above are all that is needed.
VLAN access: after this tunnel is working, go to the ProxyLink tunnel page → VLAN Subnets and add any extra subnets (e.g. 192.168.200.0/24 for a camera VLAN). ProxyLink updates WireGuard AllowedIPs and routes automatically. On the MikroTik, add the same forward+mangle rules for each extra VLAN interface.

What you get once the tunnel is up

Ready to connect?

Create a free account and set up your first tunnel in minutes. Free during early access — no card required.

Start free → Other platforms

Setup guides for other platforms

🐧Linux Server 🪟Windows 🍎macOS 🤖Android 📱iPhone / iPad 🔧OpenWrt 🌐GL.iNet 🗄️Synology NAS 📡Asus Merlin 📶TP-Link 🛡️OPNsense 🔒pfSense 🔵Ubiquiti UniFi Gateway 🔷Ubiquiti EdgeRouter 📻Netgear 🔌Zyxel