⚙️
← All setup guides

MikroTik RouterOS 7 WireGuard Setup Guide

Managed gateway ProxyLink can configure this platform for you and keep it in step as you add VLANs.

MikroTik is the platform ProxyLink supports most fully, and you have three ways to set one up. Easiest: let ProxyLink configure the router for you over SSH. Next: download a ready-made RouterOS script and paste it in. Or follow the manual steps below if you would rather see every command. One MikroTik tunnel covers your main LAN and every VLAN.

1

Quickest: let ProxyLink configure it over SSH

Go to Devices → + Add → MikroTik (auto-configure) and give ProxyLink the router's address and admin credentials. It connects over SSH and sets up the WireGuard interface, peer, routes, firewall and mangle rules for you, then verifies the tunnel came up.

This is the recommended path. The rest of this guide is for doing it by hand.

2

Or: download the RouterOS script

Create the gateway with Devices → + Add → Router / LAN site, select Router / Gateway and enter your LAN subnet. On the gateway page, leave the download picker on ⚙️ MikroTik and click ↓ Activate & Download RouterOS .rsc.

That file is a complete RouterOS script, address translation rules included. Upload it to Files on the router and run /import file-name=<name>.rsc. Skip to the verification step afterwards.

3

Manual: get your values from ProxyLink

Doing it by hand instead? On the gateway page, switch the download picker to 🌐 Router (MikroTik / pfSense / OpenWRT) to get a plain .conf, and note the VPN IP, server public key, and endpoint from it.

4

Create the WireGuard interface

In Winbox: Interfaces → WireGuard → Add (+)

  • Name: proxylink
  • Listen Port: any unused port (e.g. 51821)
  • Private Key: paste from your config

Or via CLI:

/interface wireguard add name=proxylink listen-port=51821 private-key="YOUR_PRIVATE_KEY"
5

Assign an IP address

/ip address add address=YOUR_VPN_IP/32 interface=proxylink

Use /32 — this is a point-to-point tunnel. Routing is handled by the peer's allowed-address and the static route below.

6

Add the ProxyLink server as a peer

/interface wireguard peers add \
  interface=proxylink \
  public-key="SERVER_PUBLIC_KEY" \
  endpoint-address=46.225.153.241 \
  endpoint-port=51820 \
  allowed-address=10.100.0.0/16 \
  persistent-keepalive=25s
7

Add return route for ProxyLink server

RouterOS does not automatically add an OS-level route from a peer's allowed-address for forwarded traffic. Without this, LAN device replies to the ProxyLink server (10.100.0.x) are sent out WAN and dropped:

/ip route add dst-address=10.100.0.0/16 gateway=proxylink comment="ProxyLink server return path"
8

Allow forwarding between interfaces

Add forward rules to allow traffic between the ProxyLink tunnel and your LAN bridge:

/ip firewall filter add \
  chain=forward \
  in-interface=proxylink \
  out-interface=bridge \
  action=accept \
  place-before=0

/ip firewall filter add \
  chain=forward \
  connection-state=established,related \
  in-interface=bridge \
  out-interface=proxylink \
  action=accept \
  place-before=1
9

Add mangle rules (required if you have multiple WAN links)

If you use load-balancing or policy routing across multiple WAN links, add these mangle rules before your load-balancing marks. This ensures ProxyLink traffic always takes the correct return path:

/ip firewall mangle add \
  chain=prerouting \
  src-address=10.100.0.0/16 \
  dst-address=192.168.1.0/24 \
  action=accept \
  comment="ProxyLink return path"

/ip firewall mangle add \
  chain=prerouting \
  src-address=192.168.1.0/24 \
  dst-address=10.100.0.0/16 \
  action=accept \
  comment="ProxyLink return path"

Repeat for each VLAN subnet you add to the tunnel.

Good to know

RouterOS 7 is required. WireGuard is not available in RouterOS 6.x.
RouterOS cannot import a standard .conf file, which is why ProxyLink generates a RouterOS .rsc script for MikroTik instead. Use the auto-configure option or that script unless you specifically want to type the commands yourself.
The LAN bridge in RouterOS is typically named "bridge". Check Interface → Bridge to confirm yours.
Do NOT add srcnat masquerade for ProxyLink traffic. RouterOS processes mangle before NAT de-masquerade, which breaks the return routing path and causes connections to time out. The forward accept rules above are all that is needed.
VLAN access: after this tunnel is working, go to the ProxyLink tunnel page → VLAN Subnets and add any extra subnets (e.g. 192.168.200.0/24 for a camera VLAN). ProxyLink updates WireGuard AllowedIPs and routes automatically. On the MikroTik, add the same forward+mangle rules for each extra VLAN interface.

Reaching more than one VLAN

One LAN needs nothing beyond this guide. If the site has several VLANs (a camera VLAN, a PBX VLAN, a guest network), there is one more thing to know.

ProxyLink gives every gateway its own private address range and translates between that range and your real LAN addresses. That is what lets two different clients both use 192.168.1.0/24 without colliding. The translation rules live in the PostUp and PostDown lines of the config we generate.

On MikroTik RouterOS 7 this is handled for you. Add the VLAN under your gateway → VLAN subnets and ProxyLink pushes the matching rules to the device itself, so each VLAN gets its own isolated range with nothing to type on the router.

What you get once the tunnel is up

Ready to connect?

Create a free account and set up your first tunnel in minutes. Free during early access — no card required.

Start free → Other platforms

Setup guides for other platforms

🐧Linux Server 🪟Windows 🍎macOS 🤖Android 📱iPhone / iPad 🔧OpenWrt 🌐GL.iNet 🗄️Synology NAS 📡Asus Merlin 📶TP-Link 🛡️OPNsense 🔒pfSense 🔵Ubiquiti UniFi Gateway 🔷Ubiquiti EdgeRouter 📻Netgear 🔌Zyxel