MikroTik WireGuard Remote Access (RouterOS v7): Secure “Road Warrior” Setup

Last updated: 2026-01-02
This guide shows a clean, secure WireGuard “road warrior” setup on MikroTik RouterOS v7 with step-by-step commands, validation, and rollback.

Assumption: RouterOS v7+ is installed (WireGuard is RouterOS v7 feature). WireGuard configuration concepts and CLI paths follow official MikroTik docs. MikroTik Help

1) Plan & variables (edit these first)

Replace values in ALL CAPS:

WG_IF=wg-remote
WG_PORT=51820
WG_NET=10.66.66.0/24
Router WG IP: 10.66.66.1/24
Client WG IP: 10.66.66.2/32
LAN_NET=192.168.88.0/24 (your LAN)
WAN_IF=ether1 (your internet-facing interface)
CLIENT_PUBLIC_KEY="PASTE_CLIENT_PUBLIC_KEY_HERE"

2) Create WireGuard interface + IP address

3) Add the remote client peer (road warrior)

For road warrior clients, you typically don’t set endpoint-address (client IP changes). The peer is identified by public-key and constrained by allowed-address. MikroTik Help

4) Routing choice: Split tunnel vs Full tunnel

Option A — Split tunnel (recommended initially)

Client can access only your LAN (and any other internal subnets you add).
You mainly need firewall rules (below). Routing is already handled if your LAN is directly connected to MikroTik.

On the client config, set:

AllowedIPs = 10.66.66.0/24, 192.168.88.0/24

Option B — Full tunnel (send all client traffic through MikroTik)

You must NAT WireGuard traffic out to the internet.

5) Firewall rules (SAFE baseline)

5.1 Allow WireGuard UDP port to the router (input chain)

Put this rule above generic drops.

MikroTik firewall filtering concepts: allow/deny policies must be consistent and ordered. MikroTik Help

5.2 Allow WG client access to LAN (forward chain)

5.3 (Optional) Basic protection

If you already have established/related rules, keep them. If not, add:

6) Client configuration (WireGuard app)

Example (Windows/macOS/Linux WG):

Router public key can be read from the WG interface properties (WinBox/CLI).

7) Verification (must-do)

7.1 On MikroTik

Check peer handshake/time and traffic:

You want to see recent handshake after connecting. MikroTik Help

7.2 From the client

Ping router WG IP: ping 10.66.66.1
Ping a LAN host: ping 192.168.88.10
If full tunnel: check external IP changed (browser “what is my IP”)

WireGuard “Road Warrior” on MikroTik (RouterOS v7)