WireGuard Client-to-Site Technical Details

🔧 WireGuard Client-to-Site Technical Details #

The Client-to-Site WireGuard VPN feature allows remote users to securely connect to corporate resources through the MikroTik SD-WAN Hub. All VPN clients are centrally managed, automatically provisioned, and individually authenticated using unique WireGuard cryptographic keys.

🌐 Supported Topology #

• Hub-and-Spoke architecture.
• Remote users connect directly to the VPN Hub.
• Multiple simultaneous VPN clients are supported.
• Designed for enterprise and MSP deployments.

🔐 Authentication #

• Unique Private/Public Key pair per client.
• Unique Preshared Key (PSK) for every VPN user.
• Independent peer configuration.
• No shared credentials between users.

📦 Automatic Provisioning #

• Private Key generation.
• Public Key generation.
• Preshared Key generation.
• Automatic VPN IP assignment.
• Automatic AllowedIPs configuration.
• Persistent Keepalive configuration.
• Complete WireGuard configuration file generation.
• QR Code generation for mobile devices.

📡 Routing Modes #

The platform supports two routing models:

• Split Tunnel
  Only traffic destined for corporate networks is sent through the VPN tunnel. Internet access continues to use the user’s local ISP.


• Full Tunnel (Redirect All Traffic)
  When Redirect All Traffic is enabled, all Internet traffic is routed through the corporate Hub, allowing centralized Internet breakout, firewall inspection and security policy enforcement.

⚙️ Automatically Generated Parameters #

• VPN Client Address
• DNS Server
• WireGuard Endpoint
• UDP Port
• Allowed IPs
• Persistent Keepalive
• Peer Public Key
• Preshared Key

🖥 Supported Clients #

• Windows
• Linux
• macOS
• Android
• iPhone & iPad (iOS)
• ChromeOS

📲 Deployment Options #

• QR Code provisioning.
• Download WireGuard configuration (.conf).
• Copy raw WireGuard configuration.
• Email configuration directly to the user.

🛡 Security Features #

• Modern WireGuard cryptography.
• Encrypted communication end-to-end.
• Unique credentials per VPN client.
• Centralized VPN lifecycle management.
• Instant enable/disable without deleting the user.
• Automatic revocation by disabling or removing the client.

📈 Scalability #

• Supports large numbers of concurrent remote users.
• Centralized management from a single dashboard.
• Ideal for enterprises and Managed Service Providers (MSPs).
• No manual RouterOS configuration required after deployment.

📌 Best Practices #

• Use unique names for every remote VPN user.
• Use trusted public DNS servers or internal DNS.
• Enable Full Tunnel only when corporate Internet breakout is required.
• Disable inactive VPN users instead of deleting them whenever possible.
• Protect downloaded configuration files as they contain private credentials.
• Keep RouterOS updated to the latest stable release.