WireGuard Site-to-Site VPN

Learn how to configure a fast and modern WireGuard site-to-site VPN on RouterOS 7.

WireGuard Site-to-Site VPN

Explain It Simply

WireGuard is a modern, incredibly fast, and stateless VPN protocol. Instead of complex state machines like older protocols, WireGuard operates entirely on the concept of “Cryptokey Routing.” This means it simply associates public keys with specific IP addresses (Allowed IPs). If a packet comes in signed by a known key and from an allowed IP, it gets routed. If not, it’s silently dropped.

RouterOS 7 Configuration

Here is the exact CLI required to bring up a WireGuard tunnel between two RouterOS devices.

1. Generate Keys and Create Interface

/interface wireguard
add listen-port=13231 name=wireguard1

(Note: RouterOS automatically generates the private and public keys when you create the interface. Use /interface wireguard print to view your Public Key so you can give it to the remote side.)

Go to WireGuard → WireGuard tab.
Click [+] to create a new interface. Name it wireguard1. Listen Port is 13231 by default.
Click Apply. WinBox will instantly generate a Private and Public Key.
Copy the Public Key to share with the remote peer. Click OK.

2. Add the Peer and Configure Endpoint

Next, add the remote peer’s public key, configure the endpoint address, and define the allowed-ips.

/interface wireguard peers
add allowed-address=10.0.0.0/24,192.168.50.0/24 \
    endpoint-address=203.0.113.5 endpoint-port=13231 \
    interface=wireguard1 \
    public-key="<REMOTE_PUBLIC_KEY>"

Go to WireGuard → Peers tab.
Click [+]. Select wireguard1 as the Interface.
Paste the remote router’s Public Key into the Public Key field.
Set Endpoint Address to 203.0.113.5 and Endpoint Port to 13231.
In Allowed Address, enter 10.0.0.0/24. Click the downward arrow next to the box to add a second subnet, and enter 192.168.50.0/24. Click OK.