# WireGuard Config Generator

> One page from jmrp.io, published as markdown. Index: https://jmrp.io/llms.txt

Canonical: https://jmrp.io/tools/wireguard-config-generator/
Language: en
Alternate: https://jmrp.io/es/tools/wireguard-config-generator/index.md
Updated: 2026-09-03
License: https://jmrp.io/license/
Category: mikrotik
Tags: wireguard, vpn, mikrotik, routeros, ipv6, firewall

Generate MikroTik RouterOS WireGuard VPN configs with dual-stack IPv4/IPv6, firewall rules, NAT, peers, and client files. Runs client-side.
Build-Date: 2026-09-06

Features:
- MikroTik RouterOS WireGuard script output
- Dual-stack IPv4/IPv6 with NAT and firewall
- Unlimited peers with client .conf files
- Full or split tunnel and QR support
- Runs locally in your browser

Questions answered:

**Are my WireGuard keys safe with this generator?**

Yes. The tool runs entirely in your browser and sends no data to any server. By default it lets RouterOS auto-generate the keys on the device, so private keys never need to be entered into the tool at all.

**What is the difference between full tunnel and split tunnel?**

Full tunnel routes all client traffic through the VPN (AllowedIPs = 0.0.0.0/0 and ::/0), while split tunnel only routes the specific subnets you list. Use split tunnel when clients should reach your LAN without sending their general internet traffic over the VPN.

**What should I put in AllowedIPs for a peer?**

On the client config, AllowedIPs defines which destinations are sent through the tunnel: use 0.0.0.0/0, ::/0 for a full tunnel or just your VPN and LAN subnets for split tunnel. On the router side, each peer's allowed address is its assigned VPN IP, which the generator fills in automatically.

**How many peers can I add?**

You can add unlimited peers. Each client device gets a unique auto-assigned IP address and its own .conf file, with optional per-peer customization.

**Why does the config include MSS clamping and a dual-stack IPv6 setup?**

MSS clamping prevents fragmentation problems over the tunnel by auto-calculating the right MSS value. Dual-stack adds IPv4 plus IPv6 ULA addressing with NAT66 so clients work on IPv6-capable networks; you can pick the IPv4-only preset if you don't need IPv6.


---

**Interactive tool** — this page hosts the working application itself, not a description of one.

## About This Tool

Generate complete MikroTik RouterOS WireGuard VPN configurations with an interactive builder. Configure your VPN parameters, add peers, and get a ready-to-paste RouterOS script plus client `.conf` files.

### Features

- **3 presets** — IPv4 Only, Dual-Stack (recommended), Site-to-Site
- **Dual-stack support** — Full IPv4 + IPv6 ULA configuration with NAT66
- **Complete firewall rules** — Input, forward, NAT/masquerade, MSS clamping, RAW flood protection, FastTrack
- **Multiple peers** — Add unlimited clients with auto-assigned IP addresses and per-peer customization
- **Key generation options** — RouterOS auto-generated keys (recommended) or manual public key entry
- **Client config files** — Complete WireGuard `.conf` files for each peer with full or split tunnel support
- **Client properties** — Auto-generates `client-*` properties for QR code support in WinBox/WebFig
- **Interface list management** — Configurable WAN, VPN, and LAN list membership
- **Extra LAN subnets** — Allow VPN access to additional networks (IoT, guest, etc.)

### How do I use it?

1. Select a **preset** to start with a common configuration, or customize from scratch
2. Configure the **WireGuard interface** settings (name, port, MTU)
3. Set your **network parameters** (VPN subnet, LAN subnet, IPv6 prefix)
4. Enter your **public endpoint** (domain name or DDNS hostname)
5. Add **peers** for each client device with unique IP addresses
6. Choose between **full tunnel** (all traffic via VPN) or **split tunnel** (only specified subnets)
7. **Copy** the generated RouterOS configuration and paste it into your router's terminal
8. Use the **client configuration** files to set up each device, or scan the QR code from WinBox/WebFig

### Configuration Sections Generated

- **Interface creation** — WireGuard interface with MTU and listen port
- **IP addressing** — IPv4 and IPv6 (ULA) addresses on the interface
- **IPv6 pool** — Address pool for IPv6 prefix delegation
- **Interface lists** — VPN and LAN list membership for firewall rule matching
- **Address lists** — Firewall address list for FastTrack and rule matching
- **Firewall input** — Accept WireGuard UDP port on IPv4 and IPv6
- **Firewall forward** — VPN to Internet, VPN to LAN, and reply rules
- **NAT/masquerade** — IPv4 masquerade and NAT66 for IPv6
- **MSS clamping** — Prevents fragmentation issues with auto-calculated MSS value
- **RAW rules** — Skip flood protection for WireGuard port
- **Peer definitions** — All peers with client properties for QR code generation

## Privacy

This tool runs **entirely in your browser**. No data is sent to any server — all configuration is generated locally using JavaScript. Your network settings, IP addresses, and any keys you enter never leave your device.

## Learn More

- [MikroTik WireGuard Dual-Stack VPN — Step-by-step guide](https://jmrp.io/blog/007-mikrotik-wireguard-dual-stack-vpn/)
- [MikroTik WireGuard Documentation](https://help.mikrotik.com/docs/spaces/ROS/pages/69664792/WireGuard)
- [WireGuard Official Site](https://www.wireguard.com/)