MikroTik CHR WireGuard VPN

Securely connect a Debian 13 client to a MikroTik CHR router using WireGuard.

The VPN allows the Debian client to:

• Connect securely to the MikroTik router
• Reach the MikroTik WireGuard address
• Access devices on the MikroTik LAN
• Use the VPN network 10.10.10.0/24

Table of Contents

• Prerequisites
• Network Topology
• Configuration Summary
• 1. Install WireGuard on Debian
• 2. Generate Debian WireGuard Keys
• 3. Create the WireGuard Interface on MikroTik
• 4. Add the Debian Client to MikroTik
• 5. Configure the MikroTik Firewall
• 6. Configure Debian WireGuard
• 7. Start the WireGuard Tunnel
• 8. Test the VPN Connection
• 9. Enable WireGuard at Boot
• 10. Verify the MikroTik Handshake
• Adding a Second Client
• Troubleshooting
• Useful Commands

Prerequisites

• RouterOS 7.x or later — WireGuard support requires RouterOS v7. MikroTik CHR images v6 do not include WireGuard.

• Debian 13 with sudo access and a working internet connection.

• IP forwarding on the Debian client (if routing traffic through the VPN):

  sudo sysctl -w net.ipv4.ip_forward=1

  To persist across reboots, add to /etc/sysctl.d/99-wireguard.conf:

  echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/99-wireguard.conf
  sudo sysctl --system

Note: If you only want to access LAN devices from Debian (not route all Debian traffic through the VPN), IP forwarding on Debian is not required.

Network Topology

                             Internet
                                 |
                                 |
                         1.2.3.45
                         MikroTik CHR
                                 |
                    +------------+------------+
                    |                         |
                 ether1                      ether2
            1.2.3.45              192.168.50.10
                                              |
                                      LAN: 192.168.50.0/24


                         WireGuard VPN
                         UDP port 51820
                                 |
                                 |
                 10.10.10.1      |      10.10.10.2
              MikroTik CHR  <----+---->  Debian 13
               wireguard1               wg0

Configuration Summary

Replace all placeholder values such as DEBIAN_PRIVATE_KEY and MIKROTIK_PUBLIC_KEY with the real values from your devices.

Dynamic WAN IP: If the MikroTik WAN address is not static, replace the Endpoint = 1.2.3.45:51820 address with a DDNS hostname (e.g., vpn.example.com:51820). Configure a DDNS client on the MikroTik using /ip cloud set update-time=yes or a third-party service. The hostname must resolve to the MikroTik's current public IP.

1. Install WireGuard on Debian

Update the package list and install WireGuard:

sudo apt update
sudo apt install wireguard

Verify the installation:

wg --version

Create the WireGuard directory:

sudo install -d -m 700 /etc/wireguard

2. Generate Debian WireGuard Keys

Generate the Debian private key:

sudo sh -c 'umask 077; wg genkey > /etc/wireguard/client_private.key'

Generate the corresponding public key:

sudo wg pubkey \
    < /etc/wireguard/client_private.key \
    | sudo tee /etc/wireguard/client_public.key

Display the Debian public key:

sudo cat /etc/wireguard/client_public.key

Save this value. It will be added to the MikroTik peer configuration.

Key security

The private key must remain secret:

sudo cat /etc/wireguard/client_private.key

Never share or publish the private key.

A valid WireGuard public key normally looks similar to:

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=

A short value such as fgareqrq is not a complete WireGuard public key.

3. Create the WireGuard Interface on MikroTik

Open the MikroTik terminal and create the WireGuard interface:

/interface/wireguard/add \
    name=wireguard1 \
    listen-port=51820

Display the interface details:

/interface/wireguard/print detail

Copy the MikroTik WireGuard public key. It will be used in the Debian configuration.

Assign the WireGuard IP address:

/ip/address/add \
    address=10.10.10.1/24 \
    interface=wireguard1

Verify the address:

/ip/address/print

Expected result:

10.10.10.1/24    wireguard1

Optional — MikroTik as DNS resolver: If you want VPN clients to resolve names via the MikroTik, enable the DNS service on the WireGuard IP. In the Debian config, set DNS = 10.10.10.1 instead of the WAN address. Make sure /ip dns set allow-remote-requests=yes is configured on the MikroTik.

4. Add the Debian Client to MikroTik

Replace DEBIAN_PUBLIC_KEY with the public key generated on Debian:

/interface/wireguard/peers/add \
    interface=wireguard1 \
    public-key="DEBIAN_PUBLIC_KEY" \
    allowed-address=10.10.10.2/32 \
    comment="Debian WireGuard client"

Verify the peer:

/interface/wireguard/peers/print detail

The peer should contain:

interface=wireguard1
allowed-address=10.10.10.2/32

The MikroTik peer does not need a manually configured endpoint. The endpoint is learned automatically when the Debian client connects.

Optional: Add a preshared key

A preshared key adds a symmetric pre-shared secret on top of the asymmetric key exchange. It protects against potential future quantum-computer attacks on Curve25519.

Generate the key on Debian:

wg genpsk | sudo tee /etc/wireguard/preshared.key
sudo chmod 600 /etc/wireguard/preshared.key

Display it:

sudo cat /etc/wireguard/preshared.key

Add it to the MikroTik peer:

/interface/wireguard/peers/set [find comment="Debian WireGuard client"] \
    preshared-key="PRESHARED_KEY"

Add it to the Debian [Peer] section in wg0.conf:

[Peer]
PublicKey = MIKROTIK_PUBLIC_KEY
PresharedKey = PRESHARED_KEY
Endpoint = 1.2.3.45:51820
AllowedIPs = 10.10.10.0/24, 192.168.50.0/24
PersistentKeepalive = 25

Each client must have its own unique preshared key.

5. Configure the MikroTik Firewall

Allow WireGuard connections

Allow incoming UDP traffic on port 51820:

/ip/firewall/filter/add \
    chain=input \
    protocol=udp \
    dst-port=51820 \
    action=accept \
    comment="Allow WireGuard"

Allow VPN clients to access the router

/ip/firewall/filter/add \
    chain=input \
    src-address=10.10.10.0/24 \
    action=accept \
    comment="Allow WireGuard clients to router"

Allow VPN clients to access the LAN

/ip/firewall/filter/add \
    chain=forward \
    src-address=10.10.10.0/24 \
    dst-address=192.168.50.0/24 \
    action=accept \
    comment="WireGuard to LAN"

Check the firewall rules:

/ip/firewall/filter/print

Make sure these rules appear above any general drop rules.

You can move them to the top with:

/ip/firewall/filter/move [find comment="Allow WireGuard"] 0
/ip/firewall/filter/move [find comment="Allow WireGuard clients to router"] 0
/ip/firewall/filter/move [find comment="WireGuard to LAN"] 0

Allow VPN clients to reach LAN devices via NAT

If the MikroTik is not the default gateway for LAN devices, add a source NAT rule so LAN devices can reply to WireGuard clients:

/ip/firewall/nat/add \
    chain=srcnat \
    src-address=10.10.10.0/24 \
    dst-address=192.168.50.0/24 \
    action=masquerade \
    comment="NAT WireGuard clients to LAN"

Note: Routing is preferred over NAT when possible because it preserves the original VPN client address. Add a static route 10.10.10.0/24 via 192.168.50.10 on the LAN gateway instead, if you control it.

6. Configure Debian WireGuard

Create the WireGuard configuration file:

sudo nano /etc/wireguard/wg0.conf

Add the following configuration:

[Interface]
PrivateKey = DEBIAN_PRIVATE_KEY
Address = 10.10.10.2/24
MTU = 1420
DNS = 1.2.3.45

[Peer]
PublicKey = MIKROTIK_PUBLIC_KEY
Endpoint = 1.2.3.45:51820
AllowedIPs = 10.10.10.0/24, 192.168.50.0/24
PersistentKeepalive = 25

Split tunnel vs full tunnel: The AllowedIPs above routes only VPN and LAN traffic through the tunnel (split tunnel). To route all traffic through the VPN, use AllowedIPs = 0.0.0.0/0 instead. When using full tunnel, set DNS to a working resolver (e.g., the MikroTik LAN address or a public DNS like 1.1.1.1), or you will lose name resolution.

Replace:

• DEBIAN_PRIVATE_KEY with the contents of:

  sudo cat /etc/wireguard/client_private.key

• MIKROTIK_PUBLIC_KEY with the public key shown by:

  /interface/wireguard/print detail

Secure the configuration file:

sudo chmod 600 /etc/wireguard/wg0.conf

The final file should look similar to:

[Interface]
PrivateKey = <Debian-private-key>
Address = 10.10.10.2/24
MTU = 1420
DNS = 1.2.3.45

[Peer]
PublicKey = <MikroTik-public-key>
Endpoint = 1.2.3.45:51820
AllowedIPs = 10.10.10.0/24, 192.168.50.0/24
PersistentKeepalive = 25

Optional: Kill switch

To block all internet traffic if the WireGuard tunnel drops, add iptables rules. This ensures no traffic leaks outside the tunnel:

[Interface]
PrivateKey = DEBIAN_PRIVATE_KEY
Address = 10.10.10.2/24
MTU = 1420
DNS = 1.2.3.45
PostUp = iptables -I OUTPUT ! -o wg0 -m addrtype ! --dst-type LOCAL -j REJECT
PreDown = iptables -D OUTPUT ! -o wg0 -m addrtype ! --dst-type LOCAL -j REJECT

Warning: This blocks all non-VPN internet traffic, including SSH connections to the Debian machine. Only add the kill switch if you access the machine via the VPN or console.

7. Start the WireGuard Tunnel

Start the interface:

sudo wg-quick up wg0

Check the interface:

ip addr show wg0

Expected address:

10.10.10.2/24

Check the routes:

ip route

You should see routes for:

10.10.10.0/24
192.168.50.0/24

Check the WireGuard status:

sudo wg show

A successful connection should show:

latest handshake: ...
transfer: ... received, ... sent

8. Test the VPN Connection

Test the MikroTik WireGuard address

ping -c 4 10.10.10.1

Test the MikroTik LAN address

ping -c 4 192.168.50.10

Test another LAN device

ping -c 4 192.168.50.X

Replace 192.168.50.X with the address of another device on the LAN.

9. Enable WireGuard at Boot

Enable and start the WireGuard service:

sudo systemctl enable --now wg-quick@wg0

Check the service:

systemctl status wg-quick@wg0

View the logs:

sudo journalctl -u wg-quick@wg0

10. Verify the MikroTik Handshake

On the MikroTik, run:

/interface/wireguard/peers/print detail

A working peer should display values similar to:

current-endpoint-address=...
current-endpoint-port=...
last-handshake=...
rx=...
tx=...

The client IP address and source port may change over time. This is normal.

Adding a Second Client

Each additional client needs its own key pair, unique WireGuard address, and peer entry. Use the same steps as above with these changes:

MikroTik peer for the second client

/interface/wireguard/peers/add \
    interface=wireguard1 \
    public-key="CLIENT2_PUBLIC_KEY" \
    preshared-key="CLIENT2_PRESHARED_KEY" \
    allowed-address=10.10.10.3/32 \
    comment="Second WireGuard client"

Second client WireGuard config

[Interface]
PrivateKey = CLIENT2_PRIVATE_KEY
Address = 10.10.10.3/24
MTU = 1420
DNS = 1.2.3.45

[Peer]
PublicKey = MIKROTIK_PUBLIC_KEY
PresharedKey = CLIENT2_PRESHARED_KEY
Endpoint = 1.2.3.45:51820
AllowedIPs = 10.10.10.0/24, 192.168.50.0/24
PersistentKeepalive = 25

Troubleshooting

No handshake or 0 B received

Check the following:

1. The Debian endpoint is correct:

   1.2.3.45:51820

2. The MikroTik WireGuard interface uses UDP port 51820.

3. The Debian public key is configured on the MikroTik peer.

4. The MikroTik public key is configured in the Debian [Peer] section.

5. UDP port 51820 is allowed through the MikroTik firewall.

6. The WireGuard firewall rules are above any drop rules.

7. The key values are complete and valid.

8. The MikroTik has a public IP address or the WireGuard port is correctly forwarded.

Check for incoming WireGuard packets

On the MikroTik:

/tool/sniffer/quick \
    interface=ether1 \
    ip-protocol=udp \
    port=51820

If packets appear, the Debian client can reach the MikroTik.

If no packets appear, verify:

• The Debian endpoint address
• The UDP port
• Upstream firewalls
• NAT or port forwarding
• The MikroTik WAN interface

LAN devices cannot reply

LAN devices need a route back to the WireGuard network. Add one of these on the LAN gateway:

Option 1 — Static route (preferred):

10.10.10.0/24 via 192.168.50.10

Option 2 — NAT masquerade:

If you cannot modify the LAN gateway, use the NAT rule from step 5 (Allow VPN clients to reach LAN devices via NAT).

Routing is preferred because it preserves the original VPN client address.

Useful Commands

Debian

MikroTik

Key Relationships

Public keys are configured in the opposite device's peer config. Private keys never leave their device.