MikroTik CHR WireGuard VPN

2026-09-04T00:00:00+00:00
MikroTik CHR WireGuard VPN</h1>
Securely connect a Debian 13 client to a MikroTik CHR router using WireGuard.</p>
The VPN allows the Debian client to:</p>
Use the VPN network
10.10.10.0/24</code></li>
</ul>
Table of Contents</h2>

Prerequisites</a></li>
Network Topology</a></li>
Configuration Summary</a></li>
1. Install WireGuard on Debian</a></li>
2. Generate Debian WireGuard Keys</a></li>
3. Create the WireGuard Interface on MikroTik</a></li>
4. Add the Debian Client to MikroTik</a></li>
5. Configure the MikroTik Firewall</a></li>
6. Configure Debian WireGuard</a></li>
7. Start the WireGuard Tunnel</a></li>
8. Test the VPN Connection</a></li>
9. Enable WireGuard at Boot</a></li>
10. Verify the MikroTik Handshake</a></li>
Adding a Second Client</a></li>
Troubleshooting</a></li>
Useful Commands</a></li>
</ul>

Prerequisites</h2>


RouterOS 7.x or later</strong> — WireGuard support requires RouterOS v7. MikroTik CHR images v6 do not include WireGuard.</p>
</li>

Debian 13</strong> with sudo</code> access and a working internet connection.</p>
</li>

IP forwarding</strong> on the Debian client (if routing traffic through the VPN):</p>
sudo</span> sysctl -w net.ipv4.ip_forward=</span>1</span></span></code></pre>
To persist across reboots, add to /etc/sysctl.d/99-wireguard.conf</code>:</p>
echo</span> "net.ipv4.ip_forward = 1"</span> |</span> sudo</span> tee /etc/sysctl.d/99-wireguard.conf</span></span>
sudo</span> sysctl --system</span></span></code></pre></li>
</ul>

Note:</strong> If you only want to access LAN devices from Debian (not route all Debian traffic through the VPN), IP forwarding on Debian is not required.</p>
</blockquote>

Network Topology</h2>
                             Internet</span></span>
                                 |</span></span>
                                 |</span></span>
                         1.2.3.45</span></span>
                         MikroTik CHR</span></span>
                                 |</span></span>
                    +------------+------------+</span></span>
                    |                         |</span></span>
                 ether1                      ether2</span></span>
            1.2.3.45              192.168.50.10</span></span>
                                              |</span></span>
                                      LAN: 192.168.50.0/24</span></span>
</span>
</span>
                         WireGuard VPN</span></span>
                         UDP port 51820</span></span>
                                 |</span></span>
                                 |</span></span>
                 10.10.10.1      |      10.10.10.2</span></span>
              MikroTik CHR  <----+---->  Debian 13</span></span>
               wireguard1               wg0</span></span></code></pre>

Configuration Summary</h2>
Component</th> Value</th></tr></thead>

MikroTik WAN address</td> 1.2.3.45/24</code></td></tr>
MikroTik WAN interface</td> ether1</code></td></tr>
WAN gateway</td> 1.2.3.1</code></td></tr>
MikroTik LAN address</td> 192.168.50.10/24</code></td></tr>
MikroTik LAN interface</td> ether2</code></td></tr>
LAN network</td> 192.168.50.0/24</code></td></tr>
WireGuard network</td> 10.10.10.0/24</code></td></tr>
MikroTik WireGuard address</td> 10.10.10.1/24</code></td></tr>
Debian WireGuard address</td> 10.10.10.2/24</code></td></tr>
MikroTik WireGuard interface</td> wireguard1</code></td></tr>
Debian WireGuard interface</td> wg0</code></td></tr>
WireGuard UDP port</td> 51820</code></td></tr>
</tbody></table>

Replace all placeholder values such as DEBIAN_PRIVATE_KEY</code> and MIKROTIK_PUBLIC_KEY</code> with the real values from your devices.</p>
</blockquote>

Dynamic WAN IP:</strong> If the MikroTik WAN address is not static, replace the Endpoint = 1.2.3.45:51820</code> address with a DDNS hostname (e.g., vpn.example.com:51820</code>). Configure a DDNS client on the MikroTik using /ip cloud set update-time=yes</code> or a third-party service. The hostname must resolve to the MikroTik's current public IP.</p>
</blockquote>

1. Install WireGuard on Debian</h2>
Update the package list and install WireGuard:</p>
sudo</span> apt update</span></span>
sudo</span> apt install wireguard</span></span></code></pre>
Verify the installation:</p>
wg</span> --version</span></span></code></pre>
Create the WireGuard directory:</p>
sudo</span> install -d -m</span> 700</span> /etc/wireguard</span></span></code></pre>

2. Generate Debian WireGuard Keys</h2>
Generate the Debian private key:</p>
sudo</span> sh -c 'umask 077; wg genkey > /etc/wireguard/client_private.key'</span></span></code></pre>
Generate the corresponding public key:</p>
sudo</span> wg pubkey</span> \</span></span>
    <</span> /etc/wireguard/client_private.key</span> \</span></span>
    |</span> sudo</span> tee /etc/wireguard/client_public.key</span></span></code></pre>
Display the Debian public key:</p>
sudo</span> cat /etc/wireguard/client_public.key</span></span></code></pre>
Save this value. It will be added to the MikroTik peer configuration.</p>
Key security</h3>
The private key must remain secret:</p>
sudo</span> cat /etc/wireguard/client_private.key</span></span></code></pre>
Never share or publish the private key.</p>
A valid WireGuard public key normally looks similar to:</p>
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=</span></span></code></pre>
A short value such as fgareqrq</code> is not a complete WireGuard public key.</p>

3. Create the WireGuard Interface on MikroTik</h2>
Open the MikroTik terminal and create the WireGuard interface:</p>
/interface/wireguard/add \</span></span>
    name=wireguard1 \</span></span>
    listen-port=51820</span></span></code></pre>
Display the interface details:</p>
/interface/wireguard/print detail</span></span></code></pre>
Copy the MikroTik WireGuard public key. It will be used in the Debian configuration.</p>
Assign the WireGuard IP address:</p>
/ip/address/add \</span></span>
    address=10.10.10.1/24 \</span></span>
    interface=wireguard1</span></span></code></pre>
Verify the address:</p>
/ip/address/print</span></span></code></pre>
Expected result:</p>
10.10.10.1/24    wireguard1</span></span></code></pre>

Optional — MikroTik as DNS resolver:</strong> If you want VPN clients to resolve names via the MikroTik, enable the DNS service on the WireGuard IP. In the Debian config, set DNS = 10.10.10.1</code> instead of the WAN address. Make sure /ip dns set allow-remote-requests=yes</code> is configured on the MikroTik.</p>
</blockquote>

4. Add the Debian Client to MikroTik</h2>
Replace DEBIAN_PUBLIC_KEY</code> with the public key generated on Debian:</p>
/interface/wireguard/peers/add \</span></span>
    interface=wireguard1 \</span></span>
    public-key="DEBIAN_PUBLIC_KEY" \</span></span>
    allowed-address=10.10.10.2/32 \</span></span>
    comment="Debian WireGuard client"</span></span></code></pre>
Verify the peer:</p>
/interface/wireguard/peers/print detail</span></span></code></pre>
The peer should contain:</p>
interface=wireguard1</span></span>
allowed-address=10.10.10.2/32</span></span></code></pre>
The MikroTik peer does not need a manually configured endpoint. The endpoint is learned automatically when the Debian client connects.</p>
Optional: Add a preshared key</h3>
A preshared key adds a symmetric pre-shared secret on top of the asymmetric key exchange. It protects against potential future quantum-computer attacks on Curve25519.</p>
Generate the key on Debian:</p>
wg</span> genpsk</span> |</span> sudo</span> tee /etc/wireguard/preshared.key</span></span>
sudo</span> chmod</span> 600</span> /etc/wireguard/preshared.key</span></span></code></pre>
Display it:</p>
sudo</span> cat /etc/wireguard/preshared.key</span></span></code></pre>
Add it to the MikroTik peer:</p>
/interface/wireguard/peers/set [find comment="Debian WireGuard client"] \</span></span>
    preshared-key="PRESHARED_KEY"</span></span></code></pre>
Add it to the Debian [Peer]</code> section in wg0.conf</code>:</p>
[</span>Peer</span>]</span></span>
PublicKey</span> =</span> MIKROTIK_PUBLIC_KEY</span></span>
PresharedKey</span> =</span> PRESHARED_KEY</span></span>
Endpoint</span> =</span> 1.2.3.45:51820</span></span>
AllowedIPs</span> =</span> 10.10.10.0/24, 192.168.50.0/24</span></span>
PersistentKeepalive</span> =</span> 25</span></span></code></pre>
Each client must have its own unique preshared key.</p>

5. Configure the MikroTik Firewall</h2>
Allow WireGuard connections</h3>
Allow incoming UDP traffic on port 51820</code>:</p>
/ip/firewall/filter/add \</span></span>
    chain=input \</span></span>
    protocol=udp \</span></span>
    dst-port=51820 \</span></span>
    action=accept \</span></span>
    comment="Allow WireGuard"</span></span></code></pre>Allow VPN clients to access the router</h3>
/ip/firewall/filter/add \</span></span>
    chain=input \</span></span>
    src-address=10.10.10.0/24 \</span></span>
    action=accept \</span></span>
    comment="Allow WireGuard clients to router"</span></span></code></pre>Allow VPN clients to access the LAN</h3>
/ip/firewall/filter/add \</span></span>
    chain=forward \</span></span>
    src-address=10.10.10.0/24 \</span></span>
    dst-address=192.168.50.0/24 \</span></span>
    action=accept \</span></span>
    comment="WireGuard to LAN"</span></span></code></pre>
Check the firewall rules:</p>
/ip/firewall/filter/print</span></span></code></pre>
Make sure these rules appear above any general drop</code> rules.</p>
You can move them to the top with:</p>
/ip/firewall/filter/move [find comment="Allow WireGuard"] 0</span></span>
/ip/firewall/filter/move [find comment="Allow WireGuard clients to router"] 0</span></span>
/ip/firewall/filter/move [find comment="WireGuard to LAN"] 0</span></span></code></pre>Allow VPN clients to reach LAN devices via NAT</h3>
If the MikroTik is not the default gateway for LAN devices, add a source NAT rule so LAN devices can reply to WireGuard clients:</p>
/ip/firewall/nat/add \</span></span>
    chain=srcnat \</span></span>
    src-address=10.10.10.0/24 \</span></span>
    dst-address=192.168.50.0/24 \</span></span>
    action=masquerade \</span></span>
    comment="NAT WireGuard clients to LAN"</span></span></code></pre>

Note:</strong> Routing is preferred over NAT when possible because it preserves the original VPN client address. Add a static route 10.10.10.0/24 via 192.168.50.10</code> on the LAN gateway instead, if you control it.</p>
</blockquote>

6. Configure Debian WireGuard</h2>
Create the WireGuard configuration file:</p>
sudo</span> nano /etc/wireguard/wg0.conf</span></span></code></pre>
Add the following configuration:</p>
[</span>Interface</span>]</span></span>
PrivateKey</span> =</span> DEBIAN_PRIVATE_KEY</span></span>
Address</span> =</span> 10.10.10.2/24</span></span>
MTU</span> =</span> 1420</span></span>
DNS</span> =</span> 1.2.3.45</span></span>
</span>
[</span>Peer</span>]</span></span>
PublicKey</span> =</span> MIKROTIK_PUBLIC_KEY</span></span>
Endpoint</span> =</span> 1.2.3.45:51820</span></span>
AllowedIPs</span> =</span> 10.10.10.0/24, 192.168.50.0/24</span></span>
PersistentKeepalive</span> =</span> 25</span></span></code></pre>

Split tunnel vs full tunnel:</strong> The AllowedIPs</code> above routes only VPN and LAN traffic through the tunnel (split tunnel). To route all traffic through the VPN, use AllowedIPs = 0.0.0.0/0</code> instead. When using full tunnel, set DNS</code> to a working resolver (e.g., the MikroTik LAN address or a public DNS like 1.1.1.1</code>), or you will lose name resolution.</p>
</blockquote>
Replace:</p>


DEBIAN_PRIVATE_KEY</code> with the contents of:</p>
sudo</span> cat /etc/wireguard/client_private.key</span></span></code></pre></li>

MIKROTIK_PUBLIC_KEY</code> with the public key shown by:</p>
/interface/wireguard/print detail</span></span></code></pre></li>
</ul>
Secure the configuration file:</p>
sudo</span> chmod</span> 600</span> /etc/wireguard/wg0.conf</span></span></code></pre>
The final file should look similar to:</p>
[</span>Interface</span>]</span></span>
PrivateKey</span> =</span> <Debian-private-key></span></span>
Address</span> =</span> 10.10.10.2/24</span></span>
MTU</span> =</span> 1420</span></span>
DNS</span> =</span> 1.2.3.45</span></span>
</span>
[</span>Peer</span>]</span></span>
PublicKey</span> =</span> <MikroTik-public-key></span></span>
Endpoint</span> =</span> 1.2.3.45:51820</span></span>
AllowedIPs</span> =</span> 10.10.10.0/24, 192.168.50.0/24</span></span>
PersistentKeepalive</span> =</span> 25</span></span></code></pre>Optional: Kill switch</h3>
To block all internet traffic if the WireGuard tunnel drops, add iptables rules. This ensures no traffic leaks outside the tunnel:</p>
[</span>Interface</span>]</span></span>
PrivateKey</span> =</span> DEBIAN_PRIVATE_KEY</span></span>
Address</span> =</span> 10.10.10.2/24</span></span>
MTU</span> =</span> 1420</span></span>
DNS</span> =</span> 1.2.3.45</span></span>
PostUp</span> =</span> iptables -I OUTPUT ! -o wg0 -m addrtype ! --dst-type LOCAL -j REJECT</span></span>
PreDown</span> =</span> iptables -D OUTPUT ! -o wg0 -m addrtype ! --dst-type LOCAL -j REJECT</span></span></code></pre>

Warning:</strong> This blocks all non-VPN internet traffic, including SSH connections to the Debian machine. Only add the kill switch if you access the machine via the VPN or console.</p>
</blockquote>

7. Start the WireGuard Tunnel</h2>
Start the interface:</p>
sudo</span> wg-quick up wg0</span></span></code></pre>
Check the interface:</p>
ip</span> addr show wg0</span></span></code></pre>
Expected address:</p>
10.10.10.2/24</span></span></code></pre>
Check the routes:</p>
ip</span> route</span></span></code></pre>
You should see routes for:</p>
10.10.10.0/24</span></span>
192.168.50.0/24</span></span></code></pre>
Check the WireGuard status:</p>
sudo</span> wg show</span></span></code></pre>
A successful connection should show:</p>
latest handshake: ...</span></span>
transfer: ... received, ... sent</span></span></code></pre>

8. Test the VPN Connection</h2>
Test the MikroTik WireGuard address</h3>
ping</span> -c</span> 4 10.10.10.1</span></span></code></pre>Test the MikroTik LAN address</h3>
ping</span> -c</span> 4 192.168.50.10</span></span></code></pre>Test another LAN device</h3>
ping</span> -c</span> 4</span> 192.168.50.X</span></span></code></pre>
Replace 192.168.50.X</code> with the address of another device on the LAN.</p>

9. Enable WireGuard at Boot</h2>
Enable and start the WireGuard service:</p>
sudo</span> systemctl enable --now wg-quick@wg0</span></span></code></pre>
Check the service:</p>
systemctl</span> status wg-quick@wg0</span></span></code></pre>
View the logs:</p>
sudo</span> journalctl -u wg-quick@wg0</span></span></code></pre>

10. Verify the MikroTik Handshake</h2>
On the MikroTik, run:</p>
/interface/wireguard/peers/print detail</span></span></code></pre>
A working peer should display values similar to:</p>
current-endpoint-address=...</span></span>
current-endpoint-port=...</span></span>
last-handshake=...</span></span>
rx=...</span></span>
tx=...</span></span></code></pre>
The client IP address and source port may change over time. This is normal.</p>

Adding a Second Client</h2>
Each additional client needs its own key pair, unique WireGuard address, and peer entry. Use the same steps as above with these changes:</p>
Item</th> Client 1 (Debian)</th> Client 2 (example)</th></tr></thead>

WireGuard address</td> 10.10.10.2/24</code></td> 10.10.10.3/24</code></td></tr>
Interface</td> wg0</code></td> wg0</code></td></tr>
Private key</td> unique per device</td> unique per device</td></tr>
Preshared key</td> unique per peer</td> unique per peer</td></tr>
</tbody></table>
MikroTik peer for the second client</h3>
/interface/wireguard/peers/add \</span></span>
    interface=wireguard1 \</span></span>
    public-key="CLIENT2_PUBLIC_KEY" \</span></span>
    preshared-key="CLIENT2_PRESHARED_KEY" \</span></span>
    allowed-address=10.10.10.3/32 \</span></span>
    comment="Second WireGuard client"</span></span></code></pre>Second client WireGuard config</h3>
[</span>Interface</span>]</span></span>
PrivateKey</span> =</span> CLIENT2_PRIVATE_KEY</span></span>
Address</span> =</span> 10.10.10.3/24</span></span>
MTU</span> =</span> 1420</span></span>
DNS</span> =</span> 1.2.3.45</span></span>
</span>
[</span>Peer</span>]</span></span>
PublicKey</span> =</span> MIKROTIK_PUBLIC_KEY</span></span>
PresharedKey</span> =</span> CLIENT2_PRESHARED_KEY</span></span>
Endpoint</span> =</span> 1.2.3.45:51820</span></span>
AllowedIPs</span> =</span> 10.10.10.0/24, 192.168.50.0/24</span></span>
PersistentKeepalive</span> =</span> 25</span></span></code></pre>

Troubleshooting</h2>
No handshake or 0 B received</code></h3>
Check the following:</p>


The Debian endpoint is correct:</p>
1.2.3.45:51820</span></span></code></pre></li>

The MikroTik WireGuard interface uses UDP port 51820</code>.</p>
</li>

The Debian public key is configured on the MikroTik peer.</p>
</li>

The MikroTik public key is configured in the Debian [Peer]</code> section.</p>
</li>

UDP port 51820</code> is allowed through the MikroTik firewall.</p>
</li>

The WireGuard firewall rules are above any drop rules.</p>
</li>

The key values are complete and valid.</p>
</li>

The MikroTik has a public IP address or the WireGuard port is correctly forwarded.</p>
</li>
</ol>

Check for incoming WireGuard packets</h3>
On the MikroTik:</p>
/tool/sniffer/quick \</span></span>
    interface=ether1 \</span></span>
    ip-protocol=udp \</span></span>
    port=51820</span></span></code></pre>
If packets appear, the Debian client can reach the MikroTik.</p>
If no packets appear, verify:</p>

The Debian endpoint address</li>
The UDP port</li>
Upstream firewalls</li>
NAT or port forwarding</li>
The MikroTik WAN interface</li>
</ul>

LAN devices cannot reply</h3>
LAN devices need a route back to the WireGuard network. Add one of these on the LAN gateway:</p>
Option 1 — Static route (preferred):</strong></p>
10.10.10.0/24 via 192.168.50.10</span></span></code></pre>
Option 2 — NAT masquerade:</strong></p>
If you cannot modify the LAN gateway, use the NAT rule from step 5</a> (Allow VPN clients to reach LAN devices via NAT</code>).</p>
Routing is preferred because it preserves the original VPN client address.</p>

Useful Commands</h2>
Debian</h3>
Action</th> Command</th></tr></thead>

Show WireGuard status</td> sudo wg show</code></td></tr>
Show interface</td> ip addr show wg0</code></td></tr>
Show routes</td> ip route</code></td></tr>
Start the VPN</td> sudo wg-quick up wg0</code></td></tr>
Stop the VPN</td> sudo wg-quick down wg0</code></td></tr>
Restart the VPN</td> sudo wg-quick down wg0 && sudo wg-quick up wg0</code></td></tr>
Check the service</td> systemctl status wg-quick@wg0</code></td></tr>
View service logs</td> sudo journalctl -u wg-quick@wg0</code></td></tr>
</tbody></table>
MikroTik</h3>
Action</th> Command</th></tr></thead>

Show WireGuard interface</td> /interface/wireguard/print detail</code></td></tr>
Show WireGuard peers</td> /interface/wireguard/peers/print detail</code></td></tr>
Show IP addresses</td> /ip/address/print</code></td></tr>
Show routes</td> /ip/route/print</code></td></tr>
Show firewall rules</td> /ip/firewall/filter/print</code></td></tr>
Show NAT rules</td> /ip/firewall/nat/print</code></td></tr>
</tbody></table>

Key Relationships</h2>
Public keys are configured in the opposite</strong> device's peer config. Private keys never leave their device.</p>
Key</th> Goes to</th></tr></thead>

Debian public key</td> MikroTik peer public-key</code></td></tr>
MikroTik public key</td> Debian [Peer]</code> PublicKey</code></td></tr>
</tbody></table>
EsmaeelE - Free Software enthusiast - MikroTik

MikroTik CHR WireGuard VPN

5. Configure the MikroTik Firewall</h2>

8. Test the VPN Connection</h2>

Troubleshooting</h2>

Useful Commands</h2>
