This guide builds a permanent encrypted WireGuard tunnel between a home router and a cottage router so both LANs can reach each other transparently. WireGuard is the recommended choice for MikroTik-to-MikroTik site-to-site VPNs on RouterOS 7.x — it requires fewer configuration objects than IPsec, has lower overhead, and handles dynamic IPs and NAT cleanly.
What you get after setup:
Devices at the cottage can reach home file servers, NAS, and printers by IP
Devices at home can reach cottage cameras, smart home gear, and remote desktops
All traffic between sites is encrypted with WireGuard’s ChaCha20-Poly1305 cipher
RouterOS 7.x on both routers (WireGuard was added in RouterOS 7.0)
At least one site with a public, reachable WAN IP (or port-forwarded UDP port)
DDNS hostname recommended for the reachable site if the WAN IP is dynamic
UDP port 13231 (or your chosen port) open inbound on the reachable site’s WAN
Carrier-grade NAT (CGNAT): If your ISP assigns a private WAN address (100.64.x.x or 10.x.x.x range), that site cannot receive inbound connections. One public-reachable site is enough — the CGNAT-side router initiates the tunnel and sends keepalives. If both sites are behind CGNAT, you need a VPS relay with a public IP.
The home router does not set endpoint-address here — it accepts connections from any source matching the public key.
Cottage router (initiates toward home):
/interface/wireguard/peers
addinterface=wg-home \
public-key="<HOME_PUBLIC_KEY>" \
endpoint-address=home.example.dyndns.org \
endpoint-port=13231 \
allowed-address=10.10.10.1/32,192.168.1.0/24 \
persistent-keepalive=25s \
comment="Home router"
persistent-keepalive=25s keeps the NAT mapping alive on the cottage side’s upstream router and ensures the home router always knows the cottage’s current endpoint.
Home router — allow inbound WireGuard and forward traffic between LANs:
Prerequisite — WAN interface list: The firewall rule below uses in-interface-list=WAN. This list exists on routers running the default factory configuration, but not on routers reset with no-defaults=yes or fresh CHR instances. If the list is missing, create it first and add your WAN interface (typically ether1):
No NAT bypass needed: Unlike IPsec, WireGuard uses a real interface (wg-cottage/wg-home). Masquerade rules that match out-interface-list=WAN do not apply to WireGuard tunnel traffic, so no extra NAT bypass rule is required.
The cottage router sets endpoint-address to the home router’s DDNS hostname. RouterOS resolves the hostname when re-establishing the peer connection.
The home router accepts connections from any IP matching the cottage’s public key and updates its view of the cottage endpoint automatically when it receives a valid packet.
persistent-keepalive=25s on the cottage peer ensures the connection stays alive and the home router tracks the current cottage WAN address.
Enable MikroTik Cloud DDNS on the home router:
/ip/cloud
setddns-enabled=yes
# Then use the assigned hostname in the cottage peer endpoint-address:
A healthy peer shows a recent last-handshake timestamp and non-zero rx and tx byte counters. If last-handshake is blank or very old, the tunnel is not established.
Verify the public key on each peer — a single wrong character prevents the handshake. Re-print keys with /interface/wireguard print on both routers and compare.
Check the home router firewall input chain:
/ip/firewall/filter/print
Ensure the UDP 13231 accept rule exists and appears before any drop or reject rule that would match inbound WAN traffic.
Confirm the DDNS hostname resolves to the home router’s WAN IP:
WireGuard sends no traffic when the tunnel is idle, so NAT mappings on ISP routers (especially CGNAT) expire — typically after 30–60 seconds. When the mapping is gone, inbound packets from the other side are dropped silently. persistent-keepalive prevents this by sending a small handshake packet before the mapping can expire.
Ensure persistent-keepalive is set on the initiating side (cottage — the side behind NAT or CGNAT):
/interface/wireguard/peers/printdetail
If persistent-keepalive is 0s or absent, add it:
/interface/wireguard/peers
set [findcomment="Home router"] persistent-keepalive=25s
25s is the standard value — short enough to beat most ISP NAT timeouts (typically 30–60 s).
One side is behind CGNAT (no public IP on either site)
