Ultimate MikroTik Wireguard Site-to-Site Guide

Hey there, hope you are having a wonderful day/evening. Many people have reached out to me about Wireguard, asking me to make videos about X or Y scenarios. So I decided to merge all those questions into one singular video where we will be configuring Wireguard for Site-to-Site VPN use cases and how we can setup wireguard to route between sites. It is an amazing protocol and I highly suggest reading the white paper about it. More reference material in the pinned comment below.

❗Help the channel grow by subscribing if you aren't subscribed already! A like is also very appreciated and feel free to leave a comment about what you liked or disliked in the video and what else you would like to see from me :) 👊❗

Timestamps:
📕00:00 - Introduction
📕00:46 - Wireguard Overview
📕03:11 - Lab Overview
📕06:27 - Configure Server (Site A)
📕10:23 - Configure Remote Site (Site B)
📕13:18 - MikroTik WG Quirks
📕18:43 - Configuring Remote Site (Site C)
📕24:43 - Access between Remote Sites

Support the Channel:

Social Media:

MTCRE Playlist:

MTCNA Playlist:

Thanks again for watching

[TheNetworkBerg]

Hi Guys,

Just pinning this top comment with some relevant information like the setup or the whitepaper docs. Please use for reference.

Wireguard Whitepaper:

MikroTik Wireguard Material:

Topology Diagram:

Router Configurations:

[JustinShaedo]

Genuinely impressed with how clearly you explain things. Huge respect.

I'm learning WireGuard with PFSense, but this video is so good and easy to understand, I'm finding it invaluable. That's about as high a compliment as I can give. Thank you for making this video.

[sgenov]

Amazing step-by-step tutorial. I was running EoIP and desperately wanted to simplify things. Thank you!

[kirksteinklauber]

Loved the video!! And just addressed my use cases!! I tested the configuration myself and worked flawlessly!! Thanks so much 😎👍

[hansvanderlinden]

Thanks. I'm already running WG on MT and road warriors, but I'll keep this as a reference. It's clear and complete. Plus with document references as a bonus. Nice.

[jamesugbojoide]

VPN made easy! Great work with a detailed guide to the end goal.

[kennethbautista]

I made it through using AWS as public CHR and looks cool. Subscribed and thanks to you man. Very clear explanation. Will do the pihole as my next project and will watch your video on this. No skipping on your ads. More power to you!

[mrb]

Thanks. I was able to create multiple connections to a number of different offices with this. Excellent tutorial.

[srkl]

Thank's a lot for the really good one on teaching Wireguard on Mikrotik.

[Lehnargh]

I wasted hours of firewall config and didn't succeed in connecting a Windows client to the mikrotik router. I shall try it again with the ultimate tutorial. Thank you very much for your Videos

[fernandomelo]

Thank you so much to provide this content 👏

[PeterSzamosi]

I would love to see how you connect a mikrotik router to a Pritunl server :)

Great videos!

[whistler]

Great guide, easy and as always you give a good explanation on how and why one should do the following things, I just setup an similar setup using your guide, and i had problems with my road warrior routers, they would sometimes prefer to use their own internet connection instead of using "site A" internet connection, to fix this i added/changed the following to the config (corrected so it should match your guide):


/routing table add name=onlyWG fib

/ip route add dst-address=0.0.0.0/0 gwy=WG-MikroTik-C table=onlyWG
/routing rule add src-address=172.16.20.0/24 action=lookup table=onlyWG

if one should wish to only allow internet through the WG tunnel change the action to action=lookup-only-in-table

Note: my Mikrotik bokses are running standard firewall config and are doing NAT.
Note: RouterOS version is 7.14.1 (2024-MAr 08 14:50)

[christianseidel]

Thank you very much. Very good Turorial. Greetings from Germany.

[gylletrold]

Hello Johnny. Thank you for another excellent video.
Would you care to share a little about your "special startup scripts"?
The default firewall script works fairly well, but I'm just curious whether you come up with some "must have" addons?

[mikkio]

thank you i am successful . where i had challenge on your design were 'WG-INET1 and WG_INET2' but after reading comment here . you made me understand they are acting as isp . so i nated them . thanks .

[riccardomanfredi]

Finally somone who knows what is JOB!!!

[aledurov]

Thanks! works 100%!!!! Can I configure and run s2s and road warrior running at the same time? Should I add a new wireguard interface for road warrior? Thanks!!!

[bsem]

Thanks for this, I have been pfSense user for long time, but since merger with another company, the others here are Mikrotik fanboys. I am learning Mikrotik and taking this video as a basic, was able to make a WG S2S from an old RB3011 to my 5100 Netgate pfSense. Mikrotik is a little strange compare to pfSense (and everything else really) but I do notice that changes are near instantaneous eg. firewall rules etc. where pfSense has to wait for filters to reload. Having said that, we continue to use pfSense for most new things, just want to learn Mikrotik to support some existing clients.

[ocular]

Great video. Want to try out wireguard on my 3 site setup that currently is using ipsec tunnels in a triangular topology. All miktotiks have static public IPs and different subnets behind them. In my current ipsec setup if one host goes down the other 2 are still connected. I wish to modify your presented wireguard topology. Do I setup like you have presented with Site A as master and site B &C as clients and add the extra allowed IPs for the other client to the existing client wireguard peer as you have done or should I add an extra peer on each client for the other client (like on Site A) for each client. In your setup are Site B and C still connected if Site A goes down? Thanks