WireGuard Config Generator

Build production-ready MikroTik WireGuard VPN configurations with a visual builder — dual-stack, firewall, NAT, and client configs included.

WireGuard Config Generator
Preset
WireGuard Interface
Network
Gateway will be .1
Gateway will be ::1
Endpoint & DNS
Domain or DDNS hostname for client connections
Leave empty to use router gateway IP
Peers / Clients
Peer 1
Client Configuration
RouterOS Configuration
Client Configuration Files
Full guide: MikroTik WireGuard Dual-Stack VPN

About This Tool

Generate complete MikroTik RouterOS WireGuard VPN configurations with an interactive builder. Configure your VPN parameters, add peers, and get a ready-to-paste RouterOS script plus client .conf files.

Features

  • 3 presets — IPv4 Only, Dual-Stack (recommended), Site-to-Site

  • Dual-stack support — Full IPv4 + IPv6 ULA configuration with NAT66

  • Complete firewall rules — Input, forward, NAT/masquerade, MSS clamping, RAW flood protection, FastTrack

  • Multiple peers — Add unlimited clients with auto-assigned IP addresses and per-peer customization

  • Key generation options — RouterOS auto-generated keys (recommended) or manual public key entry

  • Client config files — Complete WireGuard .conf files for each peer with full or split tunnel support

  • Client properties — Auto-generates client-* properties for QR code support in WinBox/WebFig

  • Interface list management — Configurable WAN, VPN, and LAN list membership

  • Extra LAN subnets — Allow VPN access to additional networks (IoT, guest, etc.)

How to Use

  1. Select a preset to start with a common configuration, or customize from scratch

  2. Configure the WireGuard interface settings (name, port, MTU)

  3. Set your network parameters (VPN subnet, LAN subnet, IPv6 prefix)

  4. Enter your public endpoint (domain name or DDNS hostname)

  5. Add peers for each client device with unique IP addresses

  6. Choose between full tunnel (all traffic via VPN) or split tunnel (only specified subnets)

  7. Copy the generated RouterOS configuration and paste it into your router’s terminal

  8. Use the client configuration files to set up each device, or scan the QR code from WinBox/WebFig

Configuration Sections Generated

  • Interface creation — WireGuard interface with MTU and listen port

  • IP addressing — IPv4 and IPv6 (ULA) addresses on the interface

  • IPv6 pool — Address pool for IPv6 prefix delegation

  • Interface lists — VPN and LAN list membership for firewall rule matching

  • Address lists — Firewall address list for FastTrack and rule matching

  • Firewall input — Accept WireGuard UDP port on IPv4 and IPv6

  • Firewall forward — VPN to Internet, VPN to LAN, and reply rules

  • NAT/masquerade — IPv4 masquerade and NAT66 for IPv6

  • MSS clamping — Prevents fragmentation issues with auto-calculated MSS value

  • RAW rules — Skip flood protection for WireGuard port

  • Peer definitions — All peers with client properties for QR code generation

Privacy

This tool runs entirely in your browser. No data is sent to any server — all configuration is generated locally using JavaScript. Your network settings, IP addresses, and any keys you enter never leave your device.

Learn More