WireGuard Config Generator

Preset

WireGuard Interface

Interface Name

Listen Port

Comment

Network

VPN IPv4 Subnet Gateway will be .1

Home LAN Subnet

Enable IPv6 (Dual-Stack)

VPN IPv6 ULA Prefix Gateway will be ::1

Additional LAN Subnets

Endpoint & DNS

Public Endpoint Domain or DDNS hostname for client connections

DNS Server(s) Leave empty to use router gateway IP

Advanced Configuration

Peers / Clients

Peer 1

Name

Comment

IPv4 Address

IPv6 Address

Keepalive

Key Generation

Private Key

Public Key

Preshared Key (optional)

Client Configuration

Generate client .conf files

Tunnel Mode

RouterOS Configuration

Client Configuration Files

About This Tool

Generate complete MikroTik RouterOS WireGuard VPN configurations with an interactive builder. Configure your VPN parameters, add peers, and get a ready-to-paste RouterOS script plus client .conf files.

Features

3 presets — IPv4 Only, Dual-Stack (recommended), Site-to-Site
Dual-stack support — Full IPv4 + IPv6 ULA configuration with NAT66
Complete firewall rules — Input, forward, NAT/masquerade, MSS clamping, RAW flood protection, FastTrack
Multiple peers — Add unlimited clients with auto-assigned IP addresses and per-peer customization
Key generation options — RouterOS auto-generated keys (recommended) or manual public key entry
Client config files — Complete WireGuard .conf files for each peer with full or split tunnel support
Client properties — Auto-generates client-* properties for QR code support in WinBox/WebFig
Interface list management — Configurable WAN, VPN, and LAN list membership
Extra LAN subnets — Allow VPN access to additional networks (IoT, guest, etc.)

How do I use it?

Select a preset to start with a common configuration, or customize from scratch
Configure the WireGuard interface settings (name, port, MTU)
Set your network parameters (VPN subnet, LAN subnet, IPv6 prefix)
Enter your public endpoint (domain name or DDNS hostname)
Add peers for each client device with unique IP addresses
Choose between full tunnel (all traffic via VPN) or split tunnel (only specified subnets)
Copy the generated RouterOS configuration and paste it into your router’s terminal
Use the client configuration files to set up each device, or scan the QR code from WinBox/WebFig

Configuration Sections Generated

Interface creation — WireGuard interface with MTU and listen port
IP addressing — IPv4 and IPv6 (ULA) addresses on the interface
IPv6 pool — Address pool for IPv6 prefix delegation
Interface lists — VPN and LAN list membership for firewall rule matching
Address lists — Firewall address list for FastTrack and rule matching
Firewall input — Accept WireGuard UDP port on IPv4 and IPv6
Firewall forward — VPN to Internet, VPN to LAN, and reply rules
NAT/masquerade — IPv4 masquerade and NAT66 for IPv6
MSS clamping — Prevents fragmentation issues with auto-calculated MSS value
RAW rules — Skip flood protection for WireGuard port
Peer definitions — All peers with client properties for QR code generation

Privacy

This tool runs entirely in your browser. No data is sent to any server — all configuration is generated locally using JavaScript. Your network settings, IP addresses, and any keys you enter never leave your device.

Learn More

Frequently asked questions

Are my WireGuard keys safe with this generator?

Yes. The tool runs entirely in your browser and sends no data to any server. By default it lets RouterOS auto-generate the keys on the device, so private keys never need to be entered into the tool at all.

What is the difference between full tunnel and split tunnel?

Full tunnel routes all client traffic through the VPN (AllowedIPs = 0.0.0.0/0 and ::/0), while split tunnel only routes the specific subnets you list. Use split tunnel when clients should reach your LAN without sending their general internet traffic over the VPN.

What should I put in AllowedIPs for a peer?

On the client config, AllowedIPs defines which destinations are sent through the tunnel: use 0.0.0.0/0, ::/0 for a full tunnel or just your VPN and LAN subnets for split tunnel. On the router side, each peer's allowed address is its assigned VPN IP, which the generator fills in automatically.

How many peers can I add?

You can add unlimited peers. Each client device gets a unique auto-assigned IP address and its own .conf file, with optional per-peer customization.

Why does the config include MSS clamping and a dual-stack IPv6 setup?

MSS clamping prevents fragmentation problems over the tunnel by auto-calculating the right MSS value. Dual-stack adds IPv4 plus IPv6 ULA addressing with NAT66 so clients work on IPv6-capable networks; you can pick the IPv4-only preset if you don't need IPv6.