Put a MikroTik on a public IPv6
RouterOS has WireGuard built in, so a MikroTik needs no agent. You add it as a device, download a config file once, and import it. Ten minutes, most of which is waiting for the file to upload.
- RouterOS 7. WireGuard does not exist in RouterOS 6. Check with
/system/resource/print; if it says 6.x, upgrade first. - The router can reach the internet outbound. Any ISP, behind NAT or CGNAT is fine. Nothing needs forwarding to it.
- A wayangi account with a paid device, or a free-tier slot if you only want the private mesh.
The four steps
-
Add the device
On your dashboard, open Add a device, give it a name, and under What is this device? pick A MikroTik router.
You will be offered an optional RouterBoard serial. If you fill it in, the config file refuses to import on any other unit — useful when a technician is carrying several routers. Read it off the sticker or with:
/system routerboard printRunning CHR or RouterOS on x86? Those have no RouterBoard and the command above returns nothing. Leave the field empty; the device binds on its WireGuard key instead, exactly like our agent devices do.
-
Download the config, once
Open the device page. The MikroTik RouterOS config card has a download button.
You get this file onceIt contains the device's WireGuard private key. We hand it over and delete our copy in the same breath, so there is no second download. If you lose it, rotate the token on the device page: that issues a new key and a new file, and retires the old one.
-
Upload and import
In WinBox, open Files and drag the
.rscinto the list. Then open New Terminal and run the import, using the exact file name shown on the device page:/import wayangi-<nama-device>.rscOver SSH instead of WinBox:
scp wayangi-nas.rsc [email protected]:/ ssh [email protected] "/import wayangi-nas.rsc"The file configures the WireGuard interface, your addresses, the routes and the inbound firewall rule, then deletes itself from the router. That last step matters: until it runs, your private key is sitting in the router's file list.
-
Check that it came up
A handshake should land within about 30 seconds:
/interface/wireguard/peers printLook for a recent
last-handshake. Then confirm the address is on the interface:/ipv6/address print where interface=wayangiFinally, prove it from outside your own network. Our probe connects from the hub, so it tests the real inbound path rather than your LAN:
curl -s "https://wayangi.dalang.io/check?target=[YOUR-IPv6-HERE]:80"Bind something to the address first, or there will be nothing to answer. See Test that your tunnel works.
What the config actually does
Nothing is hidden, so you can read the file before importing it. In order:
- Refuses to run if the serial does not match, when you supplied one.
- Creates a WireGuard interface named
wayangi, MTU 1420, with your private key. - Adds our hub as its only peer, with a 25-second keepalive so the tunnel survives CGNAT.
- Puts your tunnel addresses and your public IPv6 on that interface.
- Adds routes for the tunnel scopes only. There is deliberately no default route through the tunnel: wayangi carries inbound traffic, and your outbound stays on your own ISP.
- Adds two accept rules at the top of the IPv6 firewall so inbound traffic to your public address is not dropped by a default-drop chain.
- Removes itself from the router.
When it does not work
| What you see | What it means |
|---|---|
no such item on /interface/wireguard | RouterOS 6. WireGuard arrived in 7; upgrade the router. |
| Import stops on a serial error | The file is for a different unit. Check the serial on the device page, or create the device again without one. |
| No handshake after a few minutes | The router cannot reach the hub outbound on UDP. Some corporate and campus firewalls block it. Check with /tool/torch interface=wayangi, and tell us — we have a TCP fallback for exactly this. |
| Handshake is fine, nothing reaches the service | Something between the address and the service is dropping it. Check /ipv6/firewall/filter print for a drop rule above ours, and confirm the service is listening on the public address rather than only on localhost. |
| The file was never downloaded and the button is gone | Undownloaded keys are cleared after 24 hours. Rotate the token to issue a fresh one. |
One router, or the whole office?
This guide puts one MikroTik on a public IPv6, inbound only, and you run it yourself. If what you actually want is a dedicated public IPv4 and IPv6 for a whole site, with the router supplied and managed by us, ISP failover and 24/7 monitoring, that is a different product: see Managed Router with Dedicated IP.