(It actually does this even if you specify an endpoint IP, the endpoint IP is just what it will try in the first instance)Ĭode: Select all # jun/19/2021 23:09:37 by RouterOS 7.1beta6 The remote peer will either need your networks you want to be reachable behind your routerOS device it's allowedIP's or you'll need a NAT rule in the firewall on the router to make any traffic appear to have come from the router itself.Īlso if you are planning to route 0.0.0.0/0 down wireguard you also need either a static route for the IP of the wireguard server or to use a different routing table for the tunneled traffic as you need to route the traffic for wireguard itself outside of the tunnel.īy the way you don't need to specify the IP/Port for the client side in the server side if you don't want to (Handy for Dynamic IP's), if Wireguard receives a packet with the correct encryption it will just respond to whichever IP:Port the packet came from.

However wireguard on routerOS doesn't automatically add routes so you will need to add any routes for remote networks you want to reach via wireguard. You add the remote wireguard peer in exactly the same way you would if it was a client connecting into the router.

Wireguard routeros