Does WireGuard on MikroTik work on RouterOS 6?

No. WireGuard is only available in RouterOS 7, so upgrade first (see "Upgrading RouterOS 6 to RouterOS 7"). Check that your model has enough flash and RAM for v7.

How do I check that the WireGuard tunnel on MikroTik is up?

Run /interface wireguard peers print detail: last-handshake should be under 2–3 minutes old and the rx/tx counters should grow. Then ping the server tunnel address, for example /ping 10.8.0.1.

Do I need to disable Fasttrack?

No. Set Connection Mark = no-mark in the Fasttrack rule: VPN-marked connections bypass Fasttrack while the rest of the traffic stays fast.

Can I send all traffic into the tunnel without Mangle?

Yes: add a route to the server IP via your ISP gateway (/ip route add dst-address=<server IP>/32 gateway=<ISP gateway>), increase the ISP route distance (/ip dhcp-client set [find] default-route-distance=2) and add /ip route add dst-address=0.0.0.0/0 gateway=wireguard1 distance=1. It is simpler, but the router's own traffic will also go through the tunnel and selective routing is not possible. If your ISP gateway changes, the route to the server has to be updated.

Which MikroTik do I need for AmneziaWG?

Any ARM, ARM64 or x86 model with RouterOS 7: e.g. hAP ax², hAP ax³, RB5009 or hEX refresh. MIPS models will not work.

Does AmneziaWG reduce speed?

Only slightly: the built-in WireGuard does the encryption, the container only rewrites the packet format.

Where do I get a server?

Any VPS works. AmneziaVPN installs a server on a VPS in a few clicks, and WireGuard can be deployed with DWG . Harden the server first — see the VPS security checklist for Ubuntu and Debian .

WireGuard on MikroTik RouterOS 7 + AmneziaWG

Skip to content

Search:

Cyber Fox

RU

Security
Services
Web apps
Apps & services
- Sync
- AI models
Smart home
Coding with kids
- Roblox Studio