Hello everyone, I’ve been following the discussions around TunGuard, particularly the conversations about kernel vs. userspace performance, RouterOS firewall rule ordering ("place-before=0"), and comparisons with larger overlay-network platforms such as Tailscale and ZeroTier. A lot of the discuss…

I know the immediate response from the senior members will be: "We’ve done this for years using standard RoMON over a central SSTP/WireGuard tunnel, or via MikroTik's native Back-to-Home feature."Before you type that out, look at the actual operational friction comparison for a distributed team with…

I risk being branded as negative yet again, but how would that vary from having all routers connect via any VPN desired to a central server (with similar filters), and admins using a single VPN connection to that server, and simply allowing IP routing of the traffic to reach any desired router by IP…

Yes, the same architecture can absolutely be built manually with WireGuard and routing. The difference is the operational side. For example, once the TunGuard configuration is provisioned on 10 routers, each router has its own private tunnel IP. From then on, an administrator doesn't need to config…

For me, I use TunGuard and the router management is simply much easier. Once the routers are provisioned, I can connect to the network and access whichever MikroTik I need through its tunnel IP in WinBox. I was just sharing the workflow and why I find it useful; I'm not saying the underlying network…

Thanks. I was just trying to determine if it added any unique functionality, as opposed to being primarily focused on reducing workload and simplifying the process.

Exactly. That’s really the point TunGuard isn’t reinventing WireGuard or routing it’s simplifying the operational side. Once the routers are provisioned, you connect to the network and manage any router by its tunnel IP. No per-router VPN setup or exposed WinBox. For a distributed fleet, that simp…

Not to nitpick, but there IS a per router VPN . . . it's just to the server, not the end user in this type of architecture.

Fair point you're right. There is still a per-router VPN tunnel to the server. The difference is that the admin side doesn't need a separate VPN/routing setup for each router. That's the operational simplicity I was getting at.

And again, not to nitpick, and thats what a lot of us have without a 3rd party product. (You make it sound like you can only do that with your product), but again some workload involved. Also, I'm not clear (and too lazy to look) . . . the TunGuard server is user on-prem, or cloud, or ???

TunGuard runs like a WireGuard server, so it needs to run on a machine with a reachable public IP. That can be a cloud VPS or your own on-prem server with a public IP.

MikroTik community forum

The Missing Link: Remote Mobile/Desktop WinBox Access Over TunGuard in 30 Seconds

3rd party tools