Another newbie having problems with Surfshark and Wireguard on Mikrotik

RouterOS Beginner Basics
1

I am newbie to Mikrotik, not completely newbie to routers and routing as such.

Tried to configure Wireguard on Mikrotik in a way that all devices that connects on LAN part of the RB951-2n running 7.19.3 will be routed trough Wireguard interface, unless they want to "talk" to each other or the Mikrotik itself (192.168.88.1, 192.168.88.0/24).

Mikrotik is configured in so called CPE mode, which means that built-in WiFi acts as WAN interface (and connects to home WiFi Access point).

Got the conf file from Surfshark, and with the same file able to connect to them via Windows Wireguard client (I am familiar with concept of private/public key system, and all was configured, up and running in matter of 5 minutes).

Same conf file was used for "WG Import" in Mikrotik Wireguard settings, and during that process some settings were imported automatically, some were not, but were copy/pasted from that file to the Mikrotik Wireguard settings. I see Wireguard "tunnel" between Mikrotik and Surfshark server as running.

As Surfshark does not have step by step instructions for Wireguard on Mikrotik, I've searched for similar setup and came across to this three:

Mikrotik WireGuard Setup Guide

How to setup Proton VPN on MikroTik routers using WireGuard | Proton VPN

and of course:

Surfshark VPN does not work with WG on MT - RouterOS / Beginner Basics - MikroTik community forum

on this forum.

Issue, I guess newbie type of issue, is that I am having some problems to copy/paste those commands into terminal window either on Webfig, Winbox or even PuTTY (Telnet) when commands are long. I always receive some error that error is in line 1, column xx, "expected..." one thing and got something else... I am ashamed to ask such question, but how to copy paste such long commands?

Here are parameters received from Surfshark:

Use this configuration with WireGuard client

[Interface]
Address = 10.14.0.2/16
PrivateKey =
DNS = 162.252.172.57, 149.154.159.92
[Peer]
PublicKey = dPZe8Jq3Hu0k07MDk+Y4+AS2XHSLYalyg91TSFXRYEA=
AllowedIPs = 0.0.0.0/0
Endpoint = at-vie.prod.surfshark.com:51820

and here is my router config without sensitive data:

2025-07-10 20:22:26 by RouterOS 7.19.3

software id = V2V5-9QGT

model = RB951-2n

serial number = 4778027DD9F1

/interface bridge
add admin-mac=D4:CA:6D:EE:60:71 auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX
disabled=no distance=indoors frequency=auto ssid=Kohiba
wireless-protocol=802.11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk group-ciphers=
tkip,aes-ccm mode=dynamic-keys supplicant-identity=MikroTik
unicast-ciphers=tkip,aes-ccm
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf disabled=yes interface=wlan1
add bridge=bridge interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=wlan1 list=WAN
/ip address
add address=192.168.88.1/24 interface=bridge network=192.168.88.0
/ip dhcp-client
add interface=wlan1
/ip dhcp-server network
add address=0.0.0.0/24 dns-server=0.0.0.0 gateway=0.0.0.0 netmask=24
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=
192.168.88.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN"
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade"
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat out-interface-list=WAN
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute"
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=input comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6"
connection-state=established,related
add action=accept chain=forward comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1"
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=forward comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
/system clock
set time-zone-name=Europe/Berlin
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

2

Hi!

It seems, from the config you have shared, that you don’t have WireGuard interface configured yet.

You can create/import it by using the command below (don’t forget to add PrivateKey).

/interface wireguard/wg-import config-string="
[Interface]
Address = 10.14.0.2/16
PrivateKey =
DNS = 162.252.172.57, 149.154.159.92
[Peer]
PublicKey = dPZe8Jq3Hu0k07MDk+Y4+AS2XHSLYalyg91TSFXRYEA=
AllowedIPs = 0.0.0.0/0
Endpoint = http://at-vie.prod.surfshark.com:51820"

Also, here is official WireGuard documentation for the Mikrotik - WireGuard - RouterOS - MikroTik Documentation

Regarding copy-pasting, I would advise you to use up arrow key to bring out the command you have just entered (it should have coloring if everything is entered correctly), after that you can check what segments are incorrect as they will have incorrect coloring scheme.
Also, while copy-pasting you need to ensure that the input is limited to one row.
For example terminal will struggle to process the command below as it is two rows:
/ip/address
print

instead, it should be entered like that:
/ip/address print

3

There is no issue with members in the same subnet reaching each other due to wireguard, but yes reaching the interface address could be but that is covered in the below.

  1. You have duplicate entries for /ip pool. Remove the one you added as the rest of the config uses the the default entry.

  2. You are missing adding a wireguard interface.
    lets call it WG-Surf port can be anything

  3. You are missing adding a wireguard address
    /ip address
    add address= 10.14.0.2/24 interface=WG-Surf network=10.14.0.0

  4. You are missing wireguard peer entry
    /ip peer
    add allowed-address=0.0.0.0/0 interface=WG-Surf endpoint-address=at-vie.prod.surfshark.com endpoint-port=51820 persistent-keep alive=35s

  5. THIS IS WRONG…
    /ip dhcp-server network
    add address=0.0.0.0/24 dns-server=0.0.0.0 gateway=0.0.0.0 netmask=24
    add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=
    192.168.88.1 netmask=24

MODIFY TO:
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=162.252.172.57,149.154.159.92 gateway=192.168.88.1

  1. This is wrong
    /ip dns
    set allow-remote-requests=yes
    /ip dns static
    add address=192.168.88.1 comment=defconf name=router.lan type=A

MODIFY TO:
/ip dns
set-server=1.1.1.1,9.9.9.9

  1. MODIFY forward chain firewall rules to:
    (input chain)
    ++++++++++++++++++++++++++++
    add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
    connection-state=established,related hw-offload=yes
    add action=accept chain=forward comment=
    “defconf: accept established,related, untracked” connection-state=
    established,related,untracked
    add action=drop chain=forward comment=“defconf: drop invalid”
    connection-state=invalid
    add action=accept chain=forward comment=“users to wireguard” in-interface=bridge out-interface=WG-Surf
    add action=drop chain=forward comment=“drop all else”

  2. Source nat rules have duplication and are incomplete.
    MODIFY TO:
    /ip firewall nat
    add action=masquerade chain=srcnat out-interface-list=WAN
    add action=masquerade chain=srncat out-interface=WG-Surf

This is significant as Surfshark will disregard any source IPs ( like .88.x ) as its only expecting one, 10.14.0.2

  1. Remove IPV6 firewall rules and any firewall address lists if not using IPV6.

  2. Since the DNS addresses provided by surfshark do NOT fall within the ip range of your given ip address one needs extra routes to point the router in the right direction.

/ip route
add address=162.252.172.57 gateway=WG-Surf routing-table=main
add address=149.154.159.92 gateway=WG-Surf routing-table=main

  1. To force users out the WG tunnel we need a TABLE, and a ROUTING RULE…
    /routing table
    add fib name=useWG
    /routing rule
    add dst-address=192.168.88.0/24 action=lookup-only-in-table table=MAIN
    add src-address=192.168.88.0/24 action=lookup-only-in-table table=useWG

  2. Finally it may be worthwhile to add an MTU helper mangle config line,may not help but does not hurt.. Will have to find that…
    /ip firewall mangle
    add action=change-mss chain=forward new-mss=1380 out-interface=WG-Surf protocol=tcp tcp-flags=syn tcp-mss=1381-65535 passthrough=yes

4

Many thanks for taking time and giving me more than detailed guideline(s) where I should look to make this work! I will make those suggested changes, one by one, and see when it will start to operate as desired.
Again, many thanks!
Will let you know of the outcome!

5

It works now! :slight_smile:

Thank you all for your help!

6

Awesome.

7

Thank you @anav. Was having similar and 12 did it for me.