MTWireguard is an open-source, powerful and secure web-based tool to manage Wireguard on Mikrotik devices.
You can manage Wireguard interface and peers on Mikrotik system (Physical Router or CHR VM).
It also contains some useful options to make your work easy.

What's This

MTWireGuard is not a VPN. It's a web interface built to make using Wireguard on Mikrotik easier.
It is based on docker containers which makes it possible to run on Mikrotik RouterOS (see requirements).
It's based on lightweigth Ubuntu-Chiseled images.

Platforms used

• Docker: container
• Ubuntu-Chiseled: os
• ASP.net Core: back-end
• Bootstrap: front-end

Privacy

Sensitive data privacy clarity

No information will sent to other servers. All your data is stored in your device. Wireguard peer's private-key will be held in a local database placed in the project directory. That's explained in FAQs section. Error logging only sends information about errors in application codes to help us improve the project and fix problems. This feature can be disabled from settings page.

Requirements

There are some basic hardware/software requirements to run this project

• RouterBoard or machine running RouterOS v7.9+ with root access Recommended 7.12+
• At least 1GB of RAM Recommended 2/4GB
• At least 512MB of HDD Recommended 5/10GB

Enable Container

At first, you need to enable container in device-mode on RouterOS to use docker images.
Enable container using this code:

After enabling container, it's required to reboot device with hardware button or if it's virtual machine, turn off and turn on machine from the host. Set registry-url (to download containers from Docker registry) and set extract directory (tmpdir) to a storage (recommended USB device or second HDD).

Enable REST-API

Rest-API must be enabled to allow communication between RouterOS and MTWireguard service. To start using REST-API, the www-ssl or www (starting with RouterOS v7.9) service must be configured and running.
It's recommended using www-ssl service with and a valid SSL certificate. RouterOS has built-in option to create valid SSL certificates.
RouterOS v7 has Let's Encrypt (letsencrypt) certificate support for the www-ssl service. To enable the Let's Encrypt certificate service with automatic certificate renewal, use the enable-ssl-certificate command:

Enable www-ssl service

Containers Bridge

When the Mikrotik is ready, it's time to configure virtual network for containers and install MTWireguard docker image.

Create a VETH

Create a bridge for containers and add VETH(s) to it:

Set IP address on bridge for containers gateway:

Firewall Rules

After configuring network parameters, it's required to add some firewall rules.

Setup src-nat for outgoing traffic of dockers

Setup dst-nat to access MTWireguard panel over internet
Replace <Public-IP> with your Public IP address and <Public-Port> with the port number you want use to access MTWireguard.

Now your virtual network is ready for docker containers. Let's setup container...

Environment Variables

Configure Mikrotik connections settings in container environments to allow container modify RouterOS

Replace your Mikrotik username, password and public IP address in required fields.

Install MTWireguard image from configured registry
Replace "techgarageir" with "techgarage-ir" if using GitHub registry.