Create a WireGuard interface. RouterOS will automatically generate the public/private key pair:

/interface/wireguard/add name=wireguard1 listen-port=13231

Note down the public key — you’ll need it when configuring client devices:

/interface/wireguard/print

Give the WireGuard interface its own subnet. VPN clients will be assigned addresses from this range:

/ip/address/add address=10.0.0.1/24 interface=wireguard1

Create an IP pool so MTWireGuard can auto-assign addresses to new peers:

/ip/pool/add name=wireguard-pool ranges=10.0.0.2-10.0.0.254

Allow incoming WireGuard connections and let VPN clients reach your LAN:

# Allow WireGuard UDP traffic in
/ip/firewall/filter/add \
  chain=input \
  protocol=udp \
  dst-port=13231 \
  action=accept \
  comment="WireGuard VPN"

# Allow VPN clients to forward traffic to the LAN
/ip/firewall/filter/add \
  chain=forward \
  in-interface=wireguard1 \
  action=accept \
  comment="WireGuard to LAN"

# Masquerade VPN traffic so it appears to come from the router
/ip/firewall/nat/add \
  chain=srcnat \
  src-address=10.0.0.0/24 \
  action=masquerade

MTWireGuard uses the RouterOS REST API over HTTP — not the legacy API port. Enable the www service and create a dedicated user:

# Enable the www (HTTP REST API) service on port 80
/ip/service/enable www

# Create a dedicated user for MTWireGuard (don't reuse your admin account)
/user/add name=mtwireguard \
  password="your-strong-password" \
  group=full

/ip/service/set www address=192.168.88.50/32

Enable MikroTik’s built-in DDNS service so you always have a hostname pointing to your current public IP — this is what remote VPN clients will connect to:

/ip/cloud/set ddns-enabled=yes

# Check your assigned hostname
/ip/cloud/print

Your hostname will look like abc123.sn.mynetname.net — note it down for use in Step 7.

Run the official Docker install script — this works on both Raspberry Pi OS and Ubuntu:

# Download and run the official Docker install script
curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh

# Add your user to the docker group so you don't need sudo every time
sudo usermod -aG docker $USER

# Apply the group change without logging out
newgrp docker

# Verify Docker is working
docker --version

Run the following command. The values below are pulled from the settings panel near the top of this guide — fill those in first, then hit Copy.

sudo docker run -d \
  --name mtwireguard \
  --restart unless-stopped \
  -p 8080:8080 \
  -v ./mtwg-data:/app/storage \
  -e MT_IP="192.168.88.1" \
  -e MT_PORT="80" \
  -e MT_USER="mtwireguard" \
  -e MT_PASS="your-strong-password" \
  -e MT_PUBLIC_IP="your-public-ip-or-ddns" \
  techgarageir/mtwireguard:latest

Because WireGuard runs natively on RouterOS, the firewall rule from Step 3 already allows incoming traffic on port 13231. The only additional step needed is if you have a separate modem or upstream router between the MikroTik and the internet — in that case, also forward UDP 13231 on that device pointing to the MikroTik’s WAN IP.

In the MTWireGuard dashboard, click the + Add Peer button. Fill in the details:

• Name: something descriptive — e.g. Johns-iPhone or Work-Laptop
• Allowed IPs: leave as 0.0.0.0/0 to route all traffic through the VPN, or set to 192.168.x.x/24 (your home LAN subnet) if you only want LAN access
• DNS: optionally set to your router’s LAN IP (e.g. 10.2.0.125) or a public DNS like 1.1.1.1
• Expiry / Data limit: leave blank for permanent access, or set limits for guest access

Click Save. MTWireGuard will automatically generate a key pair and add the peer to RouterOS.

Install the WireGuard app on your phone (free on iOS App Store and Google Play). Then:

• In MTWireGuard, find your new peer in the list and click the QR code icon
• In the WireGuard app on your phone, tap the + button and choose Scan QR Code
• Point your camera at the QR code on screen — the tunnel config is imported automatically
• Give the tunnel a name and tap Add Tunnel
• Toggle the tunnel on — you should be connected

Install the WireGuard app on your computer from wireguard.com/install. Then:

• In MTWireGuard, find your peer and click the download config icon to save a .conf file
• Open the WireGuard app on your computer and click Import tunnel(s) from file
• Select the downloaded .conf file
• Click Activate to connect