Hello everyone,
I’ve been following the discussions around TunGuard, particularly the conversations about kernel vs. userspace performance, RouterOS firewall rule ordering ("place-before=0"), and comparisons with larger overlay-network platforms such as Tailscale and ZeroTier.
A lot of the discussion has focused on TunGuard as a server-to-router transport layer. However, there is another use case that I think deserves more attention: using TunGuard as a remote management plane for MikroTik routers.
Once your laptop or phone is connected as a TunGuard/WireGuard peer, it can communicate directly with the private tunnel address of a remote MikroTik. That means you can use WinBox remotely even when the router is behind CGNAT, mobile broadband, or an ISP that does not provide a publicly reachable address.
Here is the workflow.
Step 1: Provision Your Management Device
1. Open your TunGuard Web Dashboard and go to Peers.
2. Generate a new peer configuration and name it something like "Admin-Laptop" or "Admin-Phone".
3. Desktop: Download the ".conf" file and import it into the official WireGuard client.
4. Mobile: Scan the generated QR code using the WireGuard mobile application.
5. Enable the WireGuard interface.
Your management device is now part of the same private WireGuard network as your remote MikroTik.
Step 2: Allow WinBox Through the RouterOS Firewall
If the MikroTik has a restrictive "input" firewall policy, allow WinBox from the TunGuard subnet.
For example:
/ip firewall filter
add chain=input action=accept protocol=tcp dst-port=8291 \
src-address=10.100.0.0/24 \\
comment="Allow WinBox via TunGuard VPN" \\
place-before=0
The subnet should, of course, match the actual address range used by your TunGuard deployment.
This does not expose WinBox to the public internet. The rule restricts access to traffic originating from the specified VPN subnet.
Step 3: Connect With WinBox
Open WinBox on your computer or mobile device.
Do not rely on the Neighbors tab. A routed WireGuard/TunGuard connection does not provide the Layer-2 broadcast discovery that WinBox uses for neighbor discovery.
Instead, connect directly to the router's TunGuard IP.
For example:
10.100.0.3
Enter your normal RouterOS credentials and connect.
You now have graphical WinBox access to the remote router without requiring a public IP on the router.
Why This Is Useful
CGNAT and Mobile Networks
This is particularly useful for routers deployed over 4G/5G connections.
The MikroTik establishes the outbound tunnel to the TunGuard server, so the management connection does not depend on the router being directly reachable from the internet.
The topology effectively becomes:
WinBox Laptop/Phone
|
| WireGuard
|
TunGuard Server
|
| WireGuard
|
Remote MikroTik
The router can therefore remain behind CGNAT while still being reachable through its private tunnel address.
Smaller Attack Surface
You don't need to expose TCP/8291 directly to the internet.
Instead, WinBox access can be restricted to the WireGuard/TunGuard management network. The router only accepts the management traffic after it has entered through the VPN path.
That gives you a much cleaner management architecture than forwarding WinBox through a public IP.
TCP SSH Fallback
There is also an interesting fallback when the management device is connected to a network that blocks the WireGuard UDP transport.
If TunGuard's SSH fallback is available and configured, you can establish a local TCP tunnel through the server:
ssh -L 8291:10.100.0.3:8291 tanguard@your-server-ip -p 2222
Then point WinBox at:
127.0.0.1:8291
The WinBox TCP connection is forwarded through the SSH session to the remote MikroTik.
This can be useful on restrictive networks where outbound UDP connectivity is unavailable.
The Bigger Picture
The interesting part isn't simply that TunGuard can connect a MikroTik to a server.
The more useful architecture is treating the TunGuard network as a private management plane.
Your field routers, administration laptops, phones, and other trusted management endpoints can all become authenticated peers. Once they're on the same routed overlay, services such as WinBox, SSH, HTTP/HTTPS management interfaces, and other internal services can be accessed through their private tunnel addresses.
For someone managing distributed MikroTik infrastructure on a limited budget, this is a surprisingly powerful capability.
The router doesn't need a public IP.
The administrator doesn't need to expose WinBox.
And the management device can connect from practically anywhere with internet access.