Connecting remote sites through WireGuard

Prerequisites and authority

Network/RouterOS authority, known topology and a recovery management path are required. Preserve existing router configuration before managed changes.

Connect a remote router over WireGuard

This is a routed management example, not a whole-network default-route recipe. Use a firmware with supported WireGuard functionality and a tested server setup. Keep private keys on their own devices and exchange public keys only.

For a direct peer, the server needs a peer entry for the router public key and its VPN /32. The router needs the server public key, stable endpoint and UDP port. A peer behind NAT may use persistent keepalive to maintain the mapping. Allowed-address configuration and IP routes must agree; a handshake alone does not establish routes.

A conceptual Linux peer configuration for the direct-router example is:

[Interface]
Address = 10.200.0.1/24
PrivateKey = <SERVER_PRIVATE_KEY>
ListenPort = 51820

[Peer]
PublicKey = <ROUTER_PUBLIC_KEY>
AllowedIPs = 10.200.0.11/32

Protect the real configuration file. On MikroTik create the WireGuard interface, assign 10.200.0.11/24, and add the server peer with management-source allowed address, endpoint and chosen port. Do not use 0.0.0.0/0 merely to make a management tunnel work.

Allow the tunnel's UDP transport at the endpoint and permit the required inner management traffic. API traffic to the gateway itself uses its input policy; forwarding to downstream routers additionally needs forwarding rules, IP forwarding at transit nodes and return routes.

For a site gateway, the server peer also covers that site's distinct management subnet. Downstream routers need a return route to the BryanNet management source through the gateway. Prefer routing; source NAT can hide identities and complicate restrictions.

Acceptance

Verify a recent handshake, the correct server route, TCP connection to the API and authenticated BryanNet access. Repeat from the API container's network context. Test router event return traffic and recovery after NAT/upstream interruption.

Consult the MikroTik WireGuard reference for firmware-specific syntax. Adapt the example to your addresses and routing policy, and test forward and return connectivity before applying it to a production site.

Related guides

Related guides: RouterOS API access, account policy and firewall hardening, Validate hotspot login, provisioning and router health, Shipped Desired State presets and safe customization, Internet sources and multi-site network topology, Router connection fails or API authentication is rejected.