WireGuard on MikroTik RouterOS 7: VPS client setup with full and selective tunneling, plus AmneziaWG

This guide shows how to set up WireGuard on MikroTik RouterOS 7 as a VPN client: the router connects to your VPS and sends either all LAN traffic or only selected sites through the tunnel. We cover plain WireGuard, built into RouterOS 7, and AmneziaWG — a flavor of WireGuard with traffic obfuscation for networks that filter VPN protocols, such as some corporate and guest Wi-Fi networks.

Screenshots were taken in WinBox on RouterOS 7.5, but the menus in current 7.x releases (7.24 at the time of this update) are almost unchanged. Every step also has a terminal command you can copy. Tested with a DWG server; any WireGuard or AmneziaWG server works, for example AmneziaVPN on your own VPS.

WireGuard or AmneziaWG: which one to choose

Plain WireGuard is easy to fingerprint by its handshake packets. Some networks filter it — corporate firewalls, hotel and guest Wi-Fi, mobile carriers with strict UDP policies: the handshake never completes or the connection drops after a few minutes.

• WireGuard — built into RouterOS 7, nothing to install, maximum speed. Use it if the handshake with your server works.
• AmneziaWG — the same WireGuard with modified headers, random padding and junk packets. On MikroTik it runs through the lightweight awg-proxy container: encryption is still done by the router’s built-in WireGuard, the container only rewrites the packet format. Requires the container package and an ARM, ARM64 or x86 router.

Start with plain WireGuard. If no handshake appears (see “Troubleshooting”), switch to the AmneziaWG section. All routing from this guide stays the same, only the interface name changes.

Upgrading RouterOS 6 to RouterOS 7

WireGuard is only available in RouterOS 7. If you already run v7, skip this section. Before upgrading, make sure your device can handle v7: models with 16 MB flash and old CPUs (e.g. hAP lite) struggle with it. AmneziaWG needs an ARM, ARM64 or x86 router — check your model’s architecture in the MikroTik documentation.

Download WinBox from the MikroTik downloads page (the new WinBox 4 is there too) and log in to the router. The default IP is 192.168.88.1. Connecting by MAC address is safer: you will not lose access if you make a mistake in the IP settings.

Open System → Packages.

Click Check For Updates.

Select Channel: stable (for v6 this is the latest 6.49.x) and click Download&Install.

After the reboot the upgrade channel becomes available. Select it and click Download&Install again.

Wait for the installation and reboot.

Upgrade the bootloader: System → RouterBOARD → Upgrade, then reboot the router.

The router now runs RouterOS 7. Keep it on the stable channel and update regularly: new releases fix WireGuard and container bugs.

What you need from the server

Take the client config issued by your server (DWG, wg-easy, AmneziaVPN, etc.). It has two sections — here is where each value goes on MikroTik:

• [Interface] PrivateKey — the client private key → Private Key of the WireGuard interface;
• [Interface] Address — client IP inside the tunnel, e.g. 10.8.0.2/24 → IP → Addresses;
• [Interface] MTU (if present) → MTU of the interface;
• [Peer] PublicKey — the server public key → Public Key of the peer;
• [Peer] PresharedKey (if present) → Preshared Key of the peer;
• [Peer] Endpoint — server IP and port → Endpoint and Endpoint Port of the peer.

A common mistake is putting the client public key into the peer. The peer always holds the key of the side you connect to, i.e. the server. With the wrong key the handshake will never complete.

Quick setup from the terminal

The commands below mirror the step-by-step WinBox setup from the next section. Open New Terminal, replace the values in angle brackets and run the blocks one by one. The common part first:

# 1. WireGuard interface and peer
/interface wireguard add name=wireguard1 mtu=1420 private-key="<client PrivateKey>"
/interface wireguard peers add interface=wireguard1 public-key="<server PublicKey>" \
    preshared-key="<PresharedKey>" endpoint-address=<server IP> endpoint-port=<port> \
    allowed-address=0.0.0.0/0 persistent-keepalive=25s
/ip address add address=<client Address, e.g. 10.8.0.2/24> interface=wireguard1

# 2. Separate routing table and a route through the tunnel
/routing table add name=wg_mark fib
/ip route add dst-address=0.0.0.0/0 gateway=wireguard1 routing-table=wg_mark

# 3. Private networks that must stay out of the tunnel
/ip firewall address-list
add list=local address=10.0.0.0/8
add list=local address=172.16.0.0/12
add list=local address=192.168.0.0/16

# 4. Keep Fasttrack away from VPN-marked connections
/ip firewall filter set [find where action=fasttrack-connection] connection-mark=no-mark

# 5. NAT and MSS clamping for the tunnel
/ip firewall nat add chain=srcnat out-interface=wireguard1 action=masquerade
/ip firewall mangle add chain=forward out-interface=wireguard1 protocol=tcp \
    tcp-flags=syn action=change-mss new-mss=clamp-to-pmtu passthrough=yes

Then one of the tunneling options. All traffic through the VPN:

# Option A: all LAN traffic through the VPN
/ip firewall mangle
add chain=prerouting in-interface-list=LAN dst-address-list=!local \
    connection-mark=no-mark action=mark-connection new-connection-mark=wg_conn passthrough=yes
add chain=prerouting in-interface-list=LAN connection-mark=wg_conn \
    action=mark-routing new-routing-mark=wg_mark passthrough=no

Or only selected sites (details in the Option B section):

# Option B: only selected sites through the VPN
# DNS queries for these domains go to 1.1.1.1 through the tunnel
/ip route add dst-address=1.1.1.1/32 gateway=wireguard1

# The router puts IPs of matched domains into the vpn_sites list
/ip dns static
add type=FWD name=ifconfig.me match-subdomain=yes forward-to=1.1.1.1 address-list=vpn_sites
add type=FWD name=example.com match-subdomain=yes forward-to=1.1.1.1 address-list=vpn_sites

# Keep CDN addresses in the list longer than their TTL
/ip dns set address-list-extra-time=30m

# Mark connections to addresses from the list
/ip firewall mangle
add chain=prerouting in-interface-list=LAN dst-address-list=vpn_sites \
    connection-mark=no-mark action=mark-connection new-connection-mark=wg_conn passthrough=yes
add chain=prerouting in-interface-list=LAN connection-mark=wg_conn \
    action=mark-routing new-routing-mark=wg_mark passthrough=no

If your configuration has no LAN interface list, replace in-interface-list=LAN with in-interface=bridge or src-address=192.168.88.0/24.

Setting up WireGuard on MikroTik in WinBox

Fasttrack: exclude VPN traffic

The Fasttrack rule speeds the router up: packets of established connections bypass Mangle. An earlier version of this guide suggested disabling it entirely, but that noticeably slows down all internet traffic, especially on low-end models. The right way is to keep Fasttrack for regular traffic and exclude only VPN-marked connections.

Open IP → Firewall → Filter Rules, double-click the defconf: fast-track rule (action fasttrack connection) and on the Advanced tab set Connection Mark to no-mark.

/ip firewall filter set [find where action=fasttrack-connection] connection-mark=no-mark

WireGuard interface

Open WireGuard in the left menu and click +.

Fill in Name (wireguard1), MTU (1420 by default; if the server config specifies an MTU, use it) and Private Key — the client private key from the [Interface] section. Listen Port can stay as suggested: the client initiates the connection, so the server port does not go here.

Peer — connection to the server

Go to the Peers tab and click +.

• Interface — wireguard1;
• Public Key — the server public key ([Peer] PublicKey);
• Endpoint and Endpoint Port — server IP and port from the Endpoint line;
• Preshared Key — if present in the config;
• Allowed Address — 0.0.0.0/0. These are the addresses allowed to be sent into and received from the tunnel. The field does not create routes — the routing table and Mangle below control the traffic;
• Persistent Keepalive — 25s. Without it the tunnel behind the ISP NAT goes idle and stops receiving packets.

On the screenshot Persistent Keepalive is still empty — make sure to set it to 25s. The ::/0 entry in Allowed Address is only needed if the server assigns IPv6 to clients; 0.0.0.0/0 is enough.

Client IP address inside the tunnel

Open IP → Addresses, click + and enter the Address from the [Interface] section with its mask (e.g. 10.8.0.2/24), Interface — wireguard1. RouterOS fills in Network automatically.

Routing table and route through the tunnel

By default all routes live in the main table. For the VPN we create a separate table with a default route through the tunnel — your regular ISP route stays untouched. That is why changing the Distance of the ISP DHCP client, as the old version of this guide suggested, is not needed.

Open Routing → Tables, click +, set Name = wg_mark and tick FIB.

Then IP → Routes → +: Dst. Address = 0.0.0.0/0, Gateway = wireguard1, Routing Table = wg_mark.

Private networks list

To keep traffic to LAN devices and to the router itself out of the tunnel, create a list of private subnets. IP → Firewall → Address Lists → +, Name = local, and add 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 one by one.

Option A: all traffic through the VPN

In IP → Firewall → Mangle add two rules. The first marks new connections from the LAN, the second sends packets of marked connections to the wg_mark table.

• Rule 1: Chain = prerouting, In. Interface List = LAN, Dst. Address List = !local (the “!” checkbox means “not”), Connection Mark = no-mark; Action = mark connection, New Connection Mark = wg_conn, Passthrough on.
• Rule 2: Chain = prerouting, In. Interface List = LAN, Connection Mark = wg_conn; Action = mark routing, New Routing Mark = wg_mark, Passthrough off.

The screenshots show Rule 2: Chain = prerouting on the General tab and Action = mark routing with Passthrough off on the Action tab. We mark connections rather than individual packets: this way Fasttrack does not grab VPN traffic and replies from the tunnel get back to your devices correctly.

Option B: only selected sites

The easiest way is to let the router DNS do the work. When a LAN device resolves a domain from the list, RouterOS forwards the query to the specified DNS server and puts the resolved IPs into an address list itself. This works with CDN-hosted sites whose addresses keep changing and covers subdomains automatically. These options exist in current RouterOS 7 releases; if a command is not found, update the router.

# Option B: only selected sites through the VPN
# DNS queries for these domains go to 1.1.1.1 through the tunnel
/ip route add dst-address=1.1.1.1/32 gateway=wireguard1

# The router puts IPs of matched domains into the vpn_sites list
/ip dns static
add type=FWD name=ifconfig.me match-subdomain=yes forward-to=1.1.1.1 address-list=vpn_sites
add type=FWD name=example.com match-subdomain=yes forward-to=1.1.1.1 address-list=vpn_sites

# Keep CDN addresses in the list longer than their TTL
/ip dns set address-list-extra-time=30m

# Mark connections to addresses from the list
/ip firewall mangle
add chain=prerouting in-interface-list=LAN dst-address-list=vpn_sites \
    connection-mark=no-mark action=mark-connection new-connection-mark=wg_conn passthrough=yes
add chain=prerouting in-interface-list=LAN connection-mark=wg_conn \
    action=mark-routing new-routing-mark=wg_mark passthrough=no

• match-subdomain=yes — the entry also matches subdomains (www.example.com, api.example.com);
• the route to 1.1.1.1 through the tunnel sends DNS queries for these domains through the tunnel as well, so they stay private;
• address-list-extra-time keeps addresses in the list longer than their TTL: sites behind Cloudflare can have a TTL of a few seconds.

This only works if devices use the router as their DNS. If the browser has “secure DNS” (DoH) enabled or Android uses “Private DNS”, queries bypass the router and the site opens directly. To check, open the site and look at IP → Firewall → Address Lists — addresses should appear in the vpn_sites list.

Apps that connect by IP without DNS (some messengers, VoIP and game clients) need to be added to the list manually as addresses or subnets. As in the first version of this guide, you can also enter a site name in the Address field: RouterOS resolves it and keeps the IP updated, but only for the A record of that exact domain, without subdomains. Any list name works as long as it is the same in the list and in the Mangle rule.

The Mangle rules are the same as in Option A, but in the first one use Dst. Address List = vpn_sites instead of Dst. Address List = !local.

The list already contains ifconfig.me for testing: it will show your server IP, while ipinfo.io, which is not in the list, will show the IP of your regular connection.

NAT for the tunnel

IP → Firewall → NAT → +: Chain = srcnat, Out. Interface = wireguard1, Action = masquerade. Without this rule the server cannot return replies to your LAN devices.

DNS

Keep the router as DNS for your devices: in IP → DHCP Server → Networks the DNS Servers field should contain the router address (192.168.88.1) or be empty — then the router hands out itself. Do not put 8.8.8.8 there: queries will go directly, bypassing the tunnel, and domain-based routing from Option B will stop working.

The DNS used by the router itself is set in IP → DNS → Servers. For a full tunnel, use your VPN server DNS — usually its tunnel address, e.g. 10.8.0.1 (10.2.0.100 for WireHole). You can also use a public DNS and add a route to it through wireguard1, as in Option B.

MTU and MSS

If sites load slowly or some do not open at all, packets most likely do not fit into the tunnel. Check the MTU first: 1420 fits a regular connection, 1412 or less for PPPoE. Then add a rule that adjusts TCP segment size to the tunnel. Open New Terminal:

/ip firewall mangle add chain=forward out-interface=wireguard1 protocol=tcp \
    tcp-flags=syn action=change-mss new-mss=clamp-to-pmtu passthrough=yes

No reboot is needed — the rule works immediately. It will appear in IP → Firewall → Mangle:

AmneziaWG on MikroTik with awg-proxy

If plain WireGuard does not get through the network you are on, connect to an AmneziaWG server instead. RouterOS has no AmneziaWG support, but there is the open-source amneziawg-mikrotik-c project (MIT license) — a tiny awg-proxy container. The scheme looks like this:

MikroTik WireGuard ──UDP──> awg-proxy container ──AmneziaWG──> server

Encryption is still done by the router’s built-in WireGuard, so the speed barely drops. The container rewrites packet headers and adds padding and junk packets the way an AmneziaWG server expects. Protocol versions AWG 1.0, 1.5, 2.0 and 3.0 are supported.

Requirements

• an AmneziaWG server — for example, installed with the AmneziaVPN app on your VPS;
• RouterOS 7.4 or newer and the container package — it is in the Extra packages archive on the downloads page for your architecture;
• an ARM64, ARM or x86 router. MIPS models (hAP lite, hAP ac lite, the old hEX RB750Gr3) do not support containers;
• at least 16 MB of free RAM; on models with 16 MB flash it is better to attach a USB drive and store the container there.

Preparing the router

Install the container package: drop the .npk file into Files and reboot. Then allow containers in device-mode:

/system/device-mode/update container=yes fetch=yes scheduler=yes

The router asks for confirmation: within a few minutes press the Reset or Mode button on the case (depends on the model) or wait for the reboot.

Parameters from the server

In the AmneziaVPN app select the connection → Share → protocol AmneziaWG, format AmneziaWG Format, and save the .conf file. Besides the usual keys it contains the obfuscation parameters Jc, Jmin, Jmax, S1, S2, H1–H4, plus extra ones in newer protocol versions.

Quick install with the configurator

The easiest way is the project author’s web configurator. Paste the .conf contents, choose the storage for the container, set the link MTU to 1492 for PPPoE, copy the generated commands and run them in the MikroTik terminal. The configurator runs entirely in the browser and does not send your config anywhere. If the router cannot download the image from GitHub, enable offline mode — the script will tell you which files to upload manually.

Manual install

The same steps by hand, following the project README. Network for the container and the WireGuard interface:

# Network for the container
/interface/veth/add name=veth-awg-proxy address=172.18.0.2/30 gateway=172.18.0.1
/ip/address/add address=172.18.0.1/30 interface=veth-awg-proxy
/ip/firewall/nat/add chain=srcnat action=masquerade src-address=172.18.0.0/30

# WireGuard connects to the container, not directly to the server
/interface/wireguard/add name=wg-awg-proxy private-key="<client PrivateKey>" listen-port=12429
/interface/wireguard/peers/add interface=wg-awg-proxy public-key="<server PublicKey>" \
    preshared-key="<PresharedKey>" endpoint-address=172.18.0.2 endpoint-port=51820 \
    allowed-address=0.0.0.0/0 persistent-keepalive=25
/ip/address/add address=<client Address> interface=wg-awg-proxy
/ip/firewall/nat/add chain=srcnat action=masquerade out-interface=wg-awg-proxy

Container parameters — take the values from your .conf:

# Server address and obfuscation parameters from .conf
/container/envs/add list=awg-proxy-env key=AWG_LISTEN value=":51820"
/container/envs/add list=awg-proxy-env key=AWG_REMOTE value="<server IP>:<port>"
/container/envs/add list=awg-proxy-env key=AWG_JC value="<Jc>"
/container/envs/add list=awg-proxy-env key=AWG_JMIN value="<Jmin>"
/container/envs/add list=awg-proxy-env key=AWG_JMAX value="<Jmax>"
/container/envs/add list=awg-proxy-env key=AWG_S1 value="<S1>"
/container/envs/add list=awg-proxy-env key=AWG_S2 value="<S2>"
/container/envs/add list=awg-proxy-env key=AWG_H1 value="<H1>"
/container/envs/add list=awg-proxy-env key=AWG_H2 value="<H2>"
/container/envs/add list=awg-proxy-env key=AWG_H3 value="<H3>"
/container/envs/add list=awg-proxy-env key=AWG_H4 value="<H4>"
/container/envs/add list=awg-proxy-env key=AWG_SERVER_PUB value="<server PublicKey>"
/container/envs/add list=awg-proxy-env key=AWG_CLIENT_PUB value=[/interface/wireguard/get [find name=wg-awg-proxy] public-key]

Create and start the container. Replace disk1 with your storage (see System → Disks):

# RouterOS 7.22+: image from the GHCR registry, architecture is detected automatically
/container/add remote-image=ghcr.io/timbrs/awg-proxy:latest interface=veth-awg-proxy \
    envlist=awg-proxy-env hostname=awg-proxy root-dir=disk1/awg-proxy \
    logging=yes shm-size=4M start-on-boot=yes
/container/start [find where tag~"awg-proxy"]

On RouterOS older than 7.22, download the archive for your architecture from the Releases page and use file=awg-proxy-arm64.tar.gz instead of remote-image=…; RouterOS 7.20 and older need the builds with the -7.20-Docker suffix. For hEX refresh and hEX S 2025 use the ghcr.io/timbrs/awg-proxy:latest-armv5 image. Parameters of newer protocol versions (AWG 2.0 and 3.0) are easier to transfer with the configurator.

Check: /container/print shows the container as running, and /interface/wireguard/peers/print shows a last-handshake value for the peer.

Routing through AmneziaWG

Everything else is the same as for plain WireGuard: the wg_mark table, the local list, Mangle rules, Fasttrack, NAT and MSS from the sections above — just use wg-awg-proxy instead of wireguard1 everywhere. For example:

/ip route add dst-address=0.0.0.0/0 gateway=wg-awg-proxy routing-table=wg_mark

The configurator can also create routing rules itself. Do not use both setups at once: pick either the rules from this guide or the ones from the configurator.

Accessing the MikroTik LAN through the tunnel

Now the reverse direction: devices connected to your VPN server (a phone or laptop away from home) get access to devices in the MikroTik LAN. Tested together with the settings above and with WireHole.

Server with plain WireGuard

For the server and its clients to see the router LAN, edit wg0.conf on the VPS. Find the PostUp and PostDown rules and remove the server’s external interface from them (-o eth0 in my case) so masquerade applies to all interfaces.

Before:

After:

In the [Peer] section of your MikroTik add the router LAN subnet to AllowedIPs (192.168.88.0/24 in my case).

Save wg0.conf and restart WireGuard on the server.

Server with WireHole

In WireHole editing wg0.conf is pointless — the container overwrites it on start. Edit the server.conf template in wirehole/wireguard/templates instead: only there can you define a static Peer that differs from the other clients (you must not add the LAN subnet to AllowedIPs of every peer).

Change PostUp and PostDown as for plain WireGuard. Append your router’s Peer section to the end of server.conf — you can copy it from the generated file in wirehole/wireguard/peer_mikrotik. Then remove the mikrotik name from the PEERS variable in docker-compose.yml so the router config is not duplicated, and delete the peer_mikrotik folder.

Restart the containers: cd wirehole && docker compose up -d. Configs are regenerated from docker-compose.yml and the server.conf and peer.conf templates on every change. It is handier to define peers by name rather than by count: PEERS=laptop,phone,tablet.

MikroTik settings

An earlier version of this guide suggested adding wireguard1 to the LAN interface list. Do not do that: the VPN server and all its clients would get access to router management (WinBox, SSH, web UI), and Mangle rules with In. Interface List = LAN would start marking tunnel traffic.

In the default configuration, access from the tunnel to LAN devices is already allowed: forward chain rules only block inbound traffic from WAN. If you need access to the router itself, allow it narrowly — only for your device’s tunnel address:

/ip firewall filter add chain=input in-interface=wireguard1 src-address=10.8.0.3 \
    action=accept place-before=0 comment="WG: admin access"

Troubleshooting

• No handshake. In /interface wireguard peers print detail the last-handshake field is empty or older than 2–3 minutes. Make sure the peer has the server public key, the Endpoint and port are correct and the UDP port is open on the server. If everything is correct and there is still no handshake, UDP or WireGuard traffic is probably filtered somewhere on the path — try another port or switch to AmneziaWG.
• Handshake is there, but no internet through the tunnel. Check the masquerade rule on the tunnel interface, the route in the table (/ip route print where routing-table=wg_mark) and whether the Mangle rule counters in IP → Firewall → Mangle are growing. Pinging the server tunnel address (e.g. /ping 10.8.0.1) shows whether traffic passes.
• Sites from Option B open directly. Check whether addresses appear in the vpn_sites list. An empty list means devices do not use the router DNS: DoH in the browser, Android Private DNS or a manually set DNS.
• The tunnel drops after a few idle minutes — Persistent Keepalive is not set.
• Sites load slowly or partially — an MTU issue, see “MTU and MSS”.
• AmneziaWG: the container does not start. Check the log in System → Logging and the troubleshooting section of the project README: it covers device-mode errors, lack of space and unsupported architectures.

FAQ