Hi everyone,
I've been managing a growing number of WireGuard peers on a MikroTik CHR and got tired of jumping between terminal and Winbox for every add/edit/delete. So I built a lightweight web dashboard that handles the full peer lifecycle via the RouterOS REST API.
Features
Web Dashboard — List, create, edit, delete WireGuard peers via browser
Automatic IP Allocation — Scans subnet and assigns the next free IP
X25519 Key Generation — Uses libsodium for cryptographic key pairs
Key Regeneration — Rotate keys without deleting/recreating peers
Winbox DNAT Port — Calculate and display the DNAT port for Winbox access to client routers through the CHR (CHR_IP:DNAT_PORT). Formula: dnat_base + third_octet * dnat_multiplier + fourth_octet, configurable via config.php.
Internationalization — Italian and English UI, switchable via config.php
VPN IPs Export — Download all WireGuard peer IPs (and optionally SSTP secrets) as a text file via the dashboard
Live Status — Configurable auto-refresh (default 30s), real-time handshake/traffic monitoring
Config Validation — Startup validation with user-friendly error page for misconfiguration
Consistent Error Handling — All API layers throw exceptions with context
The project is mature enough for production use on trusted LANs. If you expose it externally, pair it with a reverse proxy and firewall rules.
I'd love feedback — especially on features you'd like to see (multi-interface, NAT rule automation, HA setups, etc.).
That sounds really nice.
You thought about running it in a docker or kubernetes env.? Which would make most sense, as you can strip down the entire image content to the bare minimum.
I have made a rapid prototype, but only tested it with docker compose so far (Note, I didn't have time to do it myself, chatgpt helped - but I asked it to be very precise and document everything).
I'll clean it up and send it under a new branch as soon as I find time,
advantage with Chatgpt is: You send him working while you do your real work
BTW - for translations, you should have a look at .po files.. It is easier to add other languages (dynamically translated by the php-engine and there are tools to do that).
Update: I've implemented the following security improvements across v1.5.0–v1.6.1:
1. Authentication (mandatory)
Added a PHP session-based login system — the dashboard now requires a password to access
On first visit, you're redirected to setup.php to set an admin password
The password hash is stored in .admin-hash (gitignored, one file only)
Session timeout after 30 minutes of inactivity
All write API calls return 401 Unauthorized without a valid session
2. CSRF protection
3. Security headers
4. Credential storage
Router credentials remain in config.php (gitignored) — this is a separate issue. For now, they stay out of version control and inaccessible from the web. A .env approach or Apache SetEnv could be explored in the future.
