[feature request] Make QRCODE for WireGuard Peer downloadable as PNG

QRCODE Mikrotik shows for peer configuration is ASCII gymnastics totally unusable outside of Mikrotik.

The only use of QR code is to send it to user to configure his Wireguard by scanning from the screen. Thus QR code should be bitmap, not ASCII.

Can you add option that we can simply download QR code as PNG file named by Peer name?

Or even better to support svg, so it is scalable.

What’s wrong with just taking a screenshot of the QR code?

Nothing, if you have to set just one or two VPN connections.

Why not use one of the many QR code generator utilities/libraries?

I always thought that the qr generation feature was basically targeted at home users, who scan it directly. It sounds like you have some deployment scenario going beyond this

Well that is exactly what I proposed. To have proper QR code generator within Mikrotik.

Having to use third party QR code generator is no better than having to make snapshots of QR code.

And snapshots are not easy to do in Winbox as it hides QR code on moment you move focus to other window. I have to open web GUI to be able to make snapshot (ridiculously, even in web GUI QR code is ASCII).

I think having them generated in a spreadsheet and having the $office_software create individual PDFs with relevant information, instructions and the QR code itself is a bit more convenient than either making screenshots or having a bunch of PNGs.

Anyway, I think this is a typical task for an external program. Maybe that external program can be WinBox :slight_smile:

Yes, I am even considering making application to do that, but I see it valuable to everyone managing WireGuard not just me.

Contrary to building everything from scratch, Winbox already has all it needs, it is just small step to at least allow downloading QR code as image. Even better if I could send configuration to end user directly to email from within WinBox.

I agree it would be nice to have it as an image. Not necessarily as part of RouterOS but WinBox could effectively take a screenshot automatically.

You do realize emailing a QR code is the same as emailing a password, do you? It was never meant to be used like this. The scenario MikroTik probably had in mind for this is sitting in front of your computer with WinBox opened and setting up a bunch of mobile devices by securely scanning QR code from the screen.

If you have a lot of clients, creating configuration in MikroTik is probably not the best approach to begin with. I wrote a PowerShell script that uses wg.exe to generate keys and qrencode.exe to turn text configuration file into a QR code (and then used USB flash drive to distribute on a very small scale).

If you want to keep everything on MikroTik router, you can export client configuration as text files and use a qrencode container to convert them into PNG. It can also be scripted there.

I was always curious about how people securely distribute WG keys en masse. Probably with some central management tool that has additional credentials to protect the keys (like Tailscale does). Since WireGuard is based on asymmetric cryptography, the secure way would be to exchange just the public keys and IP configuration via insecure channels like email. But it would require some technical work at both ends, usually not feasible with end users.

As I think about it more, I’m coming to a funny conclusion that printing QR codes on paper and mailing them out is actually more secure than emailing in many cases.

1 Like