How to configure MikroTik for a small business: a secure baseline step by step
Update RouterOS, replace the admin user, close management services, set up the firewall and a guest network — with ready-to-use commands.
Read articleWireGuard is a modern, fast VPN built into RouterOS v7. It is much simpler to configure than older VPN types and works well on laptops and phones. With it, employees reach office servers through an encrypted tunnel, and nothing except one UDP port is open to the internet.
Before you start: you need RouterOS v7, a public IP address (or a dynamic DNS name such as the one from
/ip cloud) and the free WireGuard app on each laptop or phone. The office network in the examples is 192.168.88.0/24, and the VPN network is 10.10.10.0/24.Step 1. Create the WireGuard interface on the router
Create the interface, give it an address in a separate VPN network and add it to the LAN list so VPN users are treated like office users. If you want to limit what VPN users can reach, use a separate list and firewall rules instead.
/interface wireguard add name=wg-office listen-port=13231
/ip address add address=10.10.10.1/24 interface=wg-office
/interface list member add interface=wg-office list=LANStep 2. Allow the WireGuard port in the firewall
The rule must be above the rule that drops everything not from LAN. Print the rules, find the number of that drop rule and use it in place-before (3 in a default configuration).
/ip firewall filter print
/ip firewall filter add chain=input protocol=udp dst-port=13231 action=accept comment="WireGuard" place-before=3Step 3. Add each employee as a peer
In the WireGuard app on the employee's device, create an empty tunnel — the app generates a key pair. Copy the device's public key into the router. The first command shows the router's public key, which you need for the next step. Give each device its own address.
/interface wireguard print
/interface wireguard peers add interface=wg-office public-key="CLIENT_PUBLIC_KEY" allowed-address=10.10.10.2/32 comment="Anna - laptop"Step 4. Configure the employee's device
Fill in the tunnel in the app like this. AllowedIPs sends only office traffic through the VPN; the rest of the internet goes directly.
[Interface]
PrivateKey = (created by the WireGuard app)
Address = 10.10.10.2/32
DNS = 192.168.88.1
[Peer]
PublicKey = ROUTER_PUBLIC_KEY
Endpoint = YOUR_PUBLIC_IP:13231
AllowedIPs = 192.168.88.0/24, 10.10.10.0/24
PersistentKeepalive = 25Step 5. Manage access
When a laptop is lost or an employee leaves, disable or remove their peer — access stops immediately. Review the list of peers regularly.
/interface wireguard peers print
/interface wireguard peers disable [find comment="Anna - laptop"]Good practice
- One peer per device, never shared keys.
- Never send private keys by email or messenger; the private key never leaves the device.
- Combine VPN with strong passwords and MFA on the systems behind it (1C, RDP, file shares).
A VPN is the door for your team. Give each person their own key and take it back when they leave.
Need help with this? Contact CySec for a free consultation.
Frequently asked questions
Is WireGuard secure enough for business use?
Yes. WireGuard uses modern cryptography and a small codebase that is easy to audit. Security depends mostly on key handling: one key per device and immediate removal when a device is lost.
WireGuard or IPsec/L2TP on MikroTik?
For remote employees, WireGuard is simpler to set up and usually faster. IPsec remains useful for connecting to other vendors' firewalls that do not support WireGuard.
Can employees use 1C and file shares through this VPN?
Yes. With AllowedIPs set to the office network, the laptop reaches 1C, file servers and printers as if it were in the office, while normal internet traffic goes directly.
What if the office has a dynamic public IP?
Use a DNS name that follows the IP, such as MikroTik's built-in /ip cloud name or your own dynamic DNS, as the endpoint in the client configuration.