Does MikroTik support WireGuard?

Yes. MikroTik includes a native WireGuard interface in RouterOS 7. It can act as a remote-access server, a site-to-site peer, or a client of a compatible VPN provider.

Which RouterOS version do I need for WireGuard?

Use RouterOS 7. Upgrade to a current stable release supported by your exact router, and export a backup before changing firewall or routing rules.

Can a MikroTik WireGuard server work behind CGNAT?

Not as a normal inbound server because the public UDP packet cannot reach your router through the ISP's shared NAT. Ask for a public IP, use an outbound relay or mesh path, or make the MikroTik the client of a reachable server.

Why does WireGuard show a handshake but no traffic?

The encrypted peer session is working, but routing or filtering is not. Check RX and TX counters, Allowed Address on both peers, the destination route, forward-chain rules, NAT only where required, and the destination network's return route.

What should Allowed Address contain on MikroTik?

Use the exact tunnel address and remote prefixes reachable through that peer. Do not add the same Allowed Address to two peers on one interface, and use 0.0.0.0/0 only when that peer should receive all IPv4 traffic.

Can MikroTik connect as a WireGuard client?

Yes. Add the provider or remote server as a peer with its endpoint, public key, and allowed prefixes, then create explicit routing and DNS behavior. Client mode creates an outbound path; it does not automatically provide inbound remote access.

How do I prevent DNS leaks through MikroTik WireGuard?

Send DNS to a resolver reachable through the tunnel, stop WAN DHCP from replacing it when appropriate, and block or redirect client DNS that should never leave through the normal WAN. Test both IPv4 and IPv6 after connecting.

How can I improve WireGuard speed on MikroTik?

Test with one peer and no queues first, watch router CPU, compare nearby endpoints, and only lower MTU after confirming fragmentation symptoms. FastTrack, policy routing, queues, and connection tracking can change which path traffic takes.

Why does a MikroTik WireGuard QR code fail to import?

A client profile must contain the client's private key, its tunnel address, the MikroTik public key and endpoint, and valid AllowedIPs. A QR code made from an incomplete export or the wrong peer-side key will not create a usable profile.

How do I connect a Linux client to MikroTik WireGuard?

Create a peer for the Linux public key, assign a unique tunnel address, and import the matching client configuration into NetworkManager or wg-quick. Then verify a recent handshake, routes, DNS, and access to only the intended LAN prefixes.

Guide

16 min readJul 30, 2026

WireGuard MikroTik Setup: Build a VPN That Actually Passes Traffic

Configure WireGuard on MikroTik RouterOS 7 for remote access, site-to-site links, or a privacy VPN—and fix the tunnel when it handshakes but passes no traffic.

Quick answer

Use RouterOS 7, choose one job for the tunnel, and verify the path in this order: UDP reachability, latest handshake, RX/TX counters, Allowed Address, routes, then firewall. A handshake with no traffic is usually a route, Allowed Address, firewall, or return-path problem. Choose a managed VPN only when you want outbound privacy; it does not replace an inbound server setup.

Compare compatible VPN setups Choose my setup Fix my symptom

Interface

Create the WireGuard interface and protect its private key.

Address

Assign a dedicated, non-overlapping tunnel subnet.

Peer

Add the other public key and exact allowed prefixes.

Firewall

Allow UDP input and only the forwarding you intend.

Interactive setup chooser

Choose the job before you configure the tunnel

“WireGuard MikroTik setup” covers three different network jobs. Pick one so the generated keys, Allowed Address values, firewall chain, and routes all point in the same direction.

Best for

Phone or laptop access to home, office, NAS, or admin tools

Hard requirement

A reachable public UDP path, or an alternative relay when the WAN is behind CGNAT

Your next action

Create one peer address per device, allow the UDP listen port in input, then allow only the required LAN destinations in forward.

RouterOS terminal

/interface/wireguard
add name=wg-remote listen-port=13231

/ip/address
add address=10.66.66.1/24 interface=wg-remote

/interface/wireguard/peers
add interface=wg-remote public-key="<CLIENT_PUBLIC_KEY>" \
    allowed-address=10.66.66.2/32

Replace every angle-bracket placeholder. Review existing firewall order and routes before pasting commands; RouterOS appends new rules, so an allow rule below a broad drop rule cannot match.

Traffic-first troubleshooting

A handshake is not the finish line

A recent handshake proves key exchange and UDP reachability. It does not prove that RouterOS selected the right route, allowed forwarding, received a reply, or kept DNS inside the tunnel.

Most likely layer

Handshake, no traffic

Do not regenerate keys. Authentication works; Allowed Address, routes, forward rules, or the return path is wrong.

1Watch peer RX and TX counters while generating traffic.
2Match the client AllowedIPs to the prefixes you actually want to reach.
3Confirm RouterOS has a route to the destination and the destination has a return path.
4Check forward-chain counters before adding masquerade; LAN access usually needs routing, not NAT.

MikroTik WireGuard routes and Allowed Address

Allowed Address does two jobs: it identifies which source addresses a peer may send, and it identifies which destinations belong to that peer. Keep peer tunnel addresses unique, avoid overlapping prefixes on one interface, and create an explicit return path for every remote LAN.

Decision	Remote access	Site-to-site	VPN provider
Primary goal	Reach one private network	Join two private networks	Change the internet exit
Inbound public IP	Usually required	Required on at least one side	Not required
Main routing object	Client tunnel /32 + LAN prefix	Remote LAN prefix	Default or policy route
NAT	Only for internet exit	Usually no	Usually provider-path masquerade
Common failure	CGNAT or input rule order	Missing return route	Endpoint routed into its own tunnel

CGNAT changes the topology, not the keys

If the MikroTik WAN address is private or inside 100.64.0.0/10 while a public-IP lookup shows something else, unsolicited UDP cannot normally reach it. Do not keep changing WireGuard settings: request a public IP, use an outbound relay or mesh path, or make the router connect outward.

Run the CGNAT check

Paid VPNs that fit a MikroTik WireGuard client

These are for outbound privacy routing, not for publishing a MikroTik behind CGNAT. Proton VPN is first because it has a current RouterOS 7 WireGuard guide. PureVPN provides manual WireGuard profiles and lists MikroTik among supported routers, but its dedicated MikroTik walkthrough currently uses IKEv2, so translating the profile into RouterOS is the more technical option. NordVPN is excluded because its official MikroTik path uses IKEv2 rather than an exportable WireGuard profile.

Generate a fresh profile, preserve a direct WAN route to its endpoint, and verify the provider's current RouterOS compatibility before paying; platforms and generated-profile behavior can change.

Official MikroTik guide

Proton VPN

100M+ Proton accounts across its privacy ecosystem
Five consecutive annual independent no-logs audits
Open-source VPN apps with public code
30-day refund window for eligible paid-plan purchases

Manual configuration

PureVPN

3M+ users and 17 years in cybersecurity
Fourth consecutive independent no-log assessment
ISO 27001-certified information security program
31-day refund window for eligible initial purchases

Some links on this page are affiliate links, meaning we may earn a commission at no extra cost to you. This helps keep NAT Checker free, but it doesn't affect what we recommend.

Lower-cost public UDP relay for advanced administrators

FRP fits this guide only when the goal is inbound WireGuard remote access through CGNAT: a small public server can expose the chosen UDP listen port and relay it through frps/frpc to an always-on Linux host on the MikroTik LAN. It can cost less over time than a complete VPN subscription, but MikroTik does not run frpc natively; you must configure Linux, the VPS and LAN firewalls, UDP forwarding to the router, frps, frpc, access protection, monitoring, and security updates. This is not a beginner setup.

Vultr

New users get $300