You need to reach a MikroTik router — or the LAN behind it — from outside, without exposing WinBox or SSH directly to the internet. RouterOS 7 ships with WireGuard as a first-class interface type, and it's become the default choice over IPsec or OpenVPN for this: it's fast, the config is short, and there's very little to misconfigure compared to older VPN types.
Create the WireGuard interface
RouterOS generates the key pair automatically when you create the interface — you don't need to paste in a private key.
/interface wireguard add name=wireguard1 listen-port=13231Assign an address to the tunnel
Pick a small subnet that isn't used anywhere else on your network — this becomes the VPN's own address space.
/ip address add address=10.10.10.1/24 interface=wireguard1Allow WireGuard traffic through the firewall
WireGuard listens on a single UDP port. Add a rule near the top of the input chain so it isn't blocked by a later "drop everything else" rule.
/ip firewall filter add chain=input protocol=udp dst-port=13231 action=accept place-before=0Add a peer for the client
Generate a key pair on the client first (most WireGuard apps do this for you), then register its public key on the router with the address you want that client to use inside the tunnel:
/interface wireguard peers add interface=wireguard1 public-key="<client-public-key>" allowed-address=10.10.10.2/32Grab the router's own public key to give to the client with:
/interface wireguard printConfigure the client
In the WireGuard app on your laptop or phone, use a config like this, substituting your router's public IP and the keys from the previous steps:
[Interface]
PrivateKey = <client-private-key>
Address = 10.10.10.2/32
[Peer]
PublicKey = <router-public-key>
Endpoint = your-router-public-ip:13231
AllowedIPs = 10.10.10.0/24
PersistentKeepalive = 25Connect, then ping 10.10.10.1 from the client to confirm the tunnel is up.
Why do it this way
WireGuard authenticates with public-key cryptography instead of a shared password, so there's no credential to brute-force — the whole attack surface is a single UDP port that silently drops any packet that isn't signed by a registered peer. That's a meaningfully smaller and simpler surface than IPsec's negotiation phases or OpenVPN's certificate infrastructure, both of which have historically been where MikroTik VPN misconfigurations happen. For a road-warrior tunnel where you just need one admin to reach one router, WireGuard gets you there with five short commands instead of a page of IPsec proposals.
How MoniTik helps
This is close to the exact mechanism MoniTik itself relies on to reach routers that have no public IP at all: an outbound tunnel initiated by the router, not an inbound port you have to keep open and patched. If you're setting up WireGuard just to get occasional WinBox access to a handful of routers, MoniTik gives you that same remote access without managing keys, ports, or client configs per device — and it keeps working even if the router's WAN address changes.
Isabela writes about the everyday MikroTik tasks that never quite make it into the official docs.