WireGuard

WireGuard is the simplest way to reach your own network over an encrypted link: one interface, a key pair per side, and a list of peers that are allowed in. It works for a phone or laptop on the road as well as for a permanent link between two routers.

Where it sits

In the wizard, the VPN gateway role has a VPN step of its own with the public address, WireGuard, IKEv2 and L2TP. If you picked another role, you can add VPN in the Combine step. In advanced everything is under VPN, with WireGuard as the first group. A tunnel between two routers can also be drawn on the network board, which fills in both ends at once.

Public address or hostname

At the top of the VPN part is the public address or hostname of this router. The field changes nothing on the router itself; it is used in the client configurations you get. Leave it empty and those configurations contain a placeholder, which the checks tell you about.

If you have no fixed IP address, switch on IP Cloud DDNS under Management access and use the sn.mynetname.net name the router gets from it.

The interface

You can create up to four WireGuard interfaces. Per interface you fill in:

Name — wg-rw, for example. That name comes back in the firewall, the routes and the checks.
UDP port — 13231 by default. The port is opened in the firewall for you, that one port and UDP only.
Router address in the tunnel — 10.10.10.1/24, for example. This is a small network for the tunnel itself, not your LAN. Pick something you use nowhere else, including the places you connect from.
Tunnel counts as LAN — puts the interface in the LAN interface list, so management and the router's DNS are reachable over the tunnel. Switch it off and tunnel traffic arrives as traffic from outside, which means writing your own rules.

Keys

Next to every key field is a button that creates a key pair. That happens in your browser and stays there; nothing is sent to a server. The router's private key ends up in the script, its public key in the client configuration.

If you generate no key pair, RouterOS makes one itself while the script runs. The router works, but the client configurations then lack the public key, and the checks warn about it. Treat the script as a password from then on: there is a private key in it.

Peers

Below the interface is the list of peers. Every peer is one phone, one laptop or one other router, and you pick the kind per peer:

Road-warrior client — the tool also generates the client's key pair and hands you a complete configuration for that device.
Site-to-site — you paste in the other router's public key, plus its endpoint and the networks behind it if you have them.

The peer tunnel address is the address that peer gets inside the tunnel, as a /32: 10.10.10.2/32, 10.10.10.3/32 and so on. Each address may appear only once, because it is what the router uses to decide which traffic belongs to which peer.

Leave the endpoint empty when the peer dials in, such as a phone or a router on a changing address. Fill it in as host:port and this router tries to set up the connection. Between two routers it is enough that one side knows the other's endpoint.

Networks behind the peer is the list of subnets on the far side, separated by commas. They are added to the allowed addresses, and the tool writes routes for them, in the shape /ip route add dst-address=192.168.2.0/24 gateway=wg1.

Keepalive, 25 seconds by default, sends an empty packet now and then so the hole in the provider's NAT table stays open. A side behind NAT needs it; a side with a fixed address can do without.

Full tunnel or only your own network

A client peer has all traffic through the VPN. On means AllowedIPs = 0.0.0.0/0, ::/0 in the client configuration: that device's ordinary internet traffic goes out through your router as well. Useful on Wi-Fi you do not trust, but you are then limited by the upload speed of the line at home. Off means the tunnel network and your LAN only; the rest goes directly.

What the script contains

/interface wireguard add name=wg-rw listen-port=13231 private-key=...
/ip address add address=10.10.10.1/24 interface=wg-rw
a line per peer under /interface wireguard peers with the public key, the allowed addresses and the keepalive
routes to the networks behind a site peer
a rule in the firewall input chain for your UDP port, and the interface in the LAN list if you left that on

The client configuration

Below the script there is a block per client peer, with a copy button and a download button for a .conf file. It holds the client's private key, its address in the tunnel, the DNS server (the router's tunnel address, so names from home resolve), the router's public key, the allowed addresses, the endpoint with its port, and the keepalive.

Every device gets its own configuration. Giving two phones the same one does not work: they would share one address and one key.

MTU

The configurator sets no MTU on the WireGuard interface, so RouterOS uses 1420. That fits on an ordinary connection. If your internet runs over PPPoE and peers connect over IPv6 it does not quite fit, and the checks say so: set mtu=1412 on the interface and MTU = 1412 in the client configuration. Those two changes are manual, the tool does not make them for you.

What goes wrong

No handshake. On the router, check with /interface wireguard peers print whether there ever was one. If it stays empty the traffic is not arriving: wrong hostname, wrong port, or a router in front that does not forward the UDP.
A handshake, but nothing reachable. Then the addresses do not line up. The client's address has to be on that peer on the router side, and your LAN has to be in the allowed addresses on the client side.
Do not test from your own network. Connecting from the inside to your own public address usually fails. Turn off the Wi-Fi on your phone and try it over mobile data.
Clashing addresses. The tunnel network and your LAN must not overlap with the network you are sitting on at the time. A hotel on 192.168.88.0/24 is not unusual.
The MikroTik is behind another router. Forward the UDP port there to the MikroTik. See Port forwarding.