Wireguard Setup and Confirmation

RouterOS General
1

Hi all! Apologies in advance, seems like lots of questions around Wireguard setup. I’ve watched some videos, and read other articles, but still missing something. I’m working to get iOS devices to use Wireguard.

If I follow correctly, it goes like this:

iOS Device → Wireguard →

  • Generate Public/Private Keys


  • Configure a static IP/mask for Address


  • Add peer info including Public Key (from Wireguard interface)


  • Endpoint is external IP and port


  • allowed IPs 0.0.0.0/0 for all traffic testing

Then in RouterOS I setup wireguard interface:

  • listen port is default 13231

This is where I get confused a little bit.

So when you configure a Peer, if you do it through the web interface, it asks for things like:

  • name


  • interface - my wireguard interface


  • Public Key - This seems to want to generate a key for the Peer


  • Private Key


  • Endpoint - is this the IP/domain of the wireguard service?


  • Port - Wireguard external configured port on service?


  • Allowed address - 0.0.0.0/0

Then down towards the bottom there is more “Client” configuration, with

  • Address - Local IP for VPN device


  • DNS


  • Client Endpoint - What is this compared to the Endpoint above?

I’ve been putting keys here and there trying to get the right combination, but my most recent efforts have stopped with client logs showing:
Tunnel status is now ‘connected’
‘Sending keep alive’

But pings back to the configured address on the Wireguard interface of 192.168.32.1 don’t show any hits.

A few other things, I did configure a firewall rule to allow the incoming port traffic (I think).

Hopefully I got rid of all the secret stuff here. This didn’t seem to export the peer info, not sure how to get that to export from the terminal, if its needed let me know.

# 2025-05-12 21:20:21 by RouterOS 7.18.2
# software id = BEVV-WS58
#
# model = E50UG
# serial number = XXX
/interface bridge
add admin-mac=F4:1E:57:71:B9:89 auto-mac=no comment=defconf name=bridge
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=wireguard1 list=LAN
/interface ovpn-server server
add mac-address=FE:07:57:F0:7D:95 name=ovpn-server1
/interface wireguard peers
add allowed-address=0.0.0.0/0 client-address=192.168.32.2/24 client-dns=\
    192.168.32.1 client-endpoint=“XXPUBLIC_IPXX interface=wireguard1 name=\
    iphone private-key=“XXPRIVATE1XX” \
    public-key=“XXPUBLIC1XX
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=192.168.32.1 interface=wireguard1 network=192.168.32.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=192.168.88.2 client-id=1:8:36:c9:80:d8:25 mac-address=\
    08:36:C9:80:D8:25 server=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment="allow WireGuard" dst-port=13231 \
    protocol=udp
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=America/New_York
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
2

A quick update, if it is helpful at all. When I connect from my phone, it does show a “last handshake” and some sort of data transfer.
Screenshot 2025-05-12 at 10.23.13 PM.png

3

I’m going to keep spamming my own post while I try and figure this out! :slight_smile:

So after some more work last night, it seems the Peers configured in Router OS don’t really matter? They seem to be redundant to the client iOS configuration. Do those actually have to match the Client, or “is” that the client config that is just centrally managed and then can be distributed to clients?

The connection seems to be happening based on the handshake confirmations on client and in RouterOS. I’m guessing there are some missing Routes or Firewall info that is blocking the traffic.

4

If you want to connect iOs (any) device as client to mikrotik which is a wireguard server, the easiest way, is to have arm mikrotik, enable ip-cloud-back to home.
Then you could either scan qr or import conf file (both qr+conf can be seen ip-cloud- bth vpn wireguard).
What architecture mikrotik device do you have?

5

First, no need to run around in circles.
Step1: Ensure you have a public IP from your ISP or perhaps an ISP provider router that gets a PUBLIC IP, and you can forward ports from the ISP router.
Step2: If the answer to 1 is YES, gold, if the answer is NO, then problems, and the question asked above becomes germane is the router an ARM cpu device??

So lets get that answered prior to advancing.
As for the the general wireguard setup on the router.
Yes, accept input chain rule for the dst-port
Yes, accept input chain rule for wireguard interface if you want to be able to configure the router securely from remote locations
Yes, accept forward chain rule for wireguard interface to LAN subnets as required.

As for wireguard peers the minimal format on the ROUTER ( allowed addresses identifies the remote user(s) at the remote peer either coming to the router or being visited by local users)
allowed-address=192.168.32.2/32 interface=wireguard1 public-key=(from remote peer) comment=“my laptop”

6

I believe this is all the config I have for working wireguard config which my iPhone connects to. This may be helpful to you:

/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/ip address
# this is a subnet for the VPN clients, it's different to the subnet of the ISP router
add address=10.99.99.1/24 interface=wireguard1 network=10.99.99.0


/interface wireguard peers
# IP addresses, one local IPv4 from the range (10.99.99.0/24) - use a different client address for each peer
add allowed-address=10.99.99.0/24  client-address=10.99.99.2/24 \
# DNS for the client this is the value my ISP router provides to other clients on the network
    client-dns=192.168.178.1 \
    # Add your public IP address and port, the one clients will connect to here:
    endpoint-address= endpoint-port= \
    interface=wireguard1 name=iphone \
    # these should have key values, set private key to auto when creating, and it will generate for you.
    private-key="" public-key=""

# not all firewall rules, only ones relevant to wireguard
/ip firewall filter
# accept incoming connections from to the wireguard server
add action=accept chain=input comment="wireguard incoming" connection-nat-state="" dst-port=13231 protocol=udp
# allow wireguard interface to forward packets
add action=accept chain=forward connection-nat-state=srcnat in-interface=wireguard1
/ip firewall nat
# NAT IPv4 packets using masquerade - bridge is my main interface
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface=bridge out-interface-list=WAN