WireGuard

ToolsCopy Anchor Link

• Create WireGuard Interface
• List WireGuard Interfaces
• Get WireGuard Interface Details
• Get WireGuard Status (Interfaces + Peers)
• Update WireGuard Interface
• Remove WireGuard Interface
• Enable WireGuard Interface
• Disable WireGuard Interface
• Add WireGuard Peer
• List WireGuard Peers
• Get WireGuard Peer Details
• Update WireGuard Peer
• Remove WireGuard Peer
• Enable WireGuard Peer
• Disable WireGuard Peer
• Generate WireGuard Client Config File

create_wireguard_interfaceCopy Anchor Link

Create WireGuard Interface · Risk: write

Creates a WireGuard tunnel interface (/interface wireguard) — the local VPN endpoint with a UDP listen port and private key. Use this to establish the server-side or site-to-site WireGuard interface before adding remote peers with add_wireguard_peer. For IPsec tunnels use create_ipsec_peer; for L2TP use create_l2tp_client; for OpenVPN use create_ovpn_client. Returns the created interface's detail including its name and RouterOS-generated public key.

list_wireguard_interfacesCopy Anchor Link

List WireGuard Interfaces · Risk: read

list_wireguard_interfaces — READ / list / show / inspect all WireGuard tunnel interfaces (/interface wireguard print). The go-to tool to read the current WireGuard state on a device. Returns each interface's name, listen-port, public-key, MTU, and running/disabled status. Filter by name substring (name_filter), disabled-only, or running-only. For one interface's full detail use get_wireguard_interface; for the peer table use list_wireguard_peers; for interfaces AND peers in one call use get_wireguard_status.

get_wireguard_interfaceCopy Anchor Link

Get WireGuard Interface Details · Risk: read

get_wireguard_interface — READ / get / show the full detail of ONE WireGuard tunnel interface (/interface wireguard print detail) looked up by name. Returns listen-port, private-key, public-key, MTU, running state, and comment. To list all interfaces use list_wireguard_interfaces; for that interface's peers use list_wireguard_peers; for interfaces AND peers in one call use get_wireguard_status.

get_wireguard_statusCopy Anchor Link

Get WireGuard Status (Interfaces + Peers) · Risk: read

get_wireguard_status — READ the current WireGuard state on a device in ONE call: ALL tunnel interfaces AND ALL peers together. Use this FIRST to inspect / show / check WireGuard before changing anything (e.g. to read public keys, see which side initiates, or confirm the tunnel is up). Interfaces report name, listen-port, public-key, MTU and running state; peers report .id, interface, public-key, allowed-address, endpoint/current-endpoint, last-handshake time and rx/tx bytes. Combines list_wireguard_interfaces + list_wireguard_peers; optionally filter both to one interface with interface_filter.

update_wireguard_interfaceCopy Anchor Link

Update WireGuard Interface · Risk: write-idempotent

Modifies settings on an existing WireGuard tunnel interface (/interface wireguard set [find name=]) — rename (new_name), change listen-port, rotate private-key, adjust MTU, or toggle disabled state. Only supplied fields are changed; omitted fields are left as-is. For updating remote peers use update_wireguard_peer. Returns the updated interface's detail.

remove_wireguard_interfaceCopy Anchor Link

Remove WireGuard Interface · Risk: destructive

Permanently deletes a WireGuard tunnel interface (/interface wireguard remove) by name, together with every peer bound to it. Verifies existence first with count-only. For removing only a specific peer without touching the interface use remove_wireguard_peer. Reports how many peers were removed alongside the interface.

enable_wireguard_interfaceCopy Anchor Link

Enable WireGuard Interface · Risk: write-idempotent

Enables a disabled WireGuard tunnel interface (/interface wireguard enable) by name, allowing it to accept and establish tunnel connections. For enabling a specific peer without affecting the interface use enable_wireguard_peer. To undo, use disable_wireguard_interface.

disable_wireguard_interfaceCopy Anchor Link

Disable WireGuard Interface · Risk: write-idempotent

Disables a WireGuard tunnel interface (/interface wireguard disable) by name, stopping all tunnel traffic through it without removing the interface or its peers. For disabling only a specific peer use disable_wireguard_peer. To re-enable use enable_wireguard_interface.

add_wireguard_peerCopy Anchor Link

Add WireGuard Peer · Risk: write

Adds a remote peer entry (/interface wireguard peers add) to an existing WireGuard interface — associates a public key with allowed source/destination CIDRs and an optional remote endpoint. Use this for each client or remote site connecting to a WireGuard interface created with create_wireguard_interface. For IPsec peers use create_ipsec_peer. Returns the created peer's detail including its .id.

Notes: allowed_address: CIDR, comma-separated for multiple e.g. "10.0.0.2/32" or "10.0.0.0/24,192.168.0.0/24" endpoint_address: remote host IP or hostname e.g. "203.0.113.1" (omit for road-warrior clients that dial in) persistent_keepalive: seconds as string e.g. "25"

list_wireguard_peersCopy Anchor Link

List WireGuard Peers · Risk: read

list_wireguard_peers — READ / list / show / inspect all WireGuard peers (/interface wireguard peers print). Use this to read which peers are configured and whether the tunnel is up (handshake). Returns each peer's .id, interface, public-key, allowed-address, endpoint/current-endpoint, last-handshake time, and rx/tx byte counters. Filter by interface name (interface_filter) or disabled-only. For the interface table use list_wireguard_interfaces; for one peer's full detail use get_wireguard_peer; for interfaces AND peers in one call use get_wireguard_status. Use the .id from this output with update_wireguard_peer, remove_wireguard_peer, enable_wireguard_peer, or disable_wireguard_peer.

get_wireguard_peerCopy Anchor Link

Get WireGuard Peer Details · Risk: read

get_wireguard_peer — READ / get / show the full detail of ONE WireGuard peer (/interface wireguard peers print detail) by its .id. Returns public-key, allowed-address, endpoint/current-endpoint, preshared-key presence, last-handshake time, and rx/tx bytes. To list all peers use list_wireguard_peers; for interfaces AND peers in one call use get_wireguard_status.

Notes: peer_id: the .id from list_wireguard_peers, format "*N" or "N" e.g. "*2"

update_wireguard_peerCopy Anchor Link

Update WireGuard Peer · Risk: write-idempotent

Modifies an existing WireGuard peer (/interface wireguard peers set) by its .id — change allowed addresses, endpoint address/port, preshared key, keepalive interval, or disabled state. Only supplied fields are changed; omitted fields are left as-is. For updating the parent interface use update_wireguard_interface. Returns the updated peer's detail.

Notes: peer_id: the .id from list_wireguard_peers, format "*N" or "N" e.g. "*2" allowed_address: CIDR, comma-separated e.g. "10.0.0.2/32" or "10.0.0.0/24,192.168.0.0/24" persistent_keepalive: seconds as string e.g. "25" Pass "" for endpoint_address or preshared_key to clear them.

remove_wireguard_peerCopy Anchor Link

Remove WireGuard Peer · Risk: destructive

Permanently removes a single WireGuard peer entry (/interface wireguard peers remove) by its .id. Verifies existence first with count-only. Leaves the parent WireGuard interface untouched. To remove the entire interface and all its peers use remove_wireguard_interface.

Notes: peer_id: the .id from list_wireguard_peers, format "*N" or "N" e.g. "*2"

enable_wireguard_peerCopy Anchor Link

Enable WireGuard Peer · Risk: write-idempotent

Enables a disabled WireGuard peer (/interface wireguard peers enable) by its .id, allowing traffic through that peer's tunnel without affecting the parent interface. For enabling the parent interface use enable_wireguard_interface. To undo, use disable_wireguard_peer.

Notes: peer_id: the .id from list_wireguard_peers, format "*N" or "N" e.g. "*2"

disable_wireguard_peerCopy Anchor Link

Disable WireGuard Peer · Risk: write-idempotent

Disables a WireGuard peer (/interface wireguard peers disable) by its .id, blocking tunnel traffic for that peer without removing it or affecting the parent interface. For disabling the parent interface use disable_wireguard_interface. To re-enable use enable_wireguard_peer.

Notes: peer_id: the .id from list_wireguard_peers, format "*N" or "N" e.g. "*2"

generate_wireguard_client_configCopy Anchor Link

Generate WireGuard Client Config File · Risk: read

Generates a standard wg0.conf client configuration file ([Interface] + [Peer] sections) entirely from the provided keys and server endpoint — runs locally, never contacts the router. Use this after registering a client's public key with add_wireguard_peer to produce the config text to distribute to that client. Returns the config text ready to save as /etc/wireguard/wg0.conf (Linux) or import into the WireGuard app, with instructions for generating client keys and bringing the tunnel up.

Notes: allowed_ips: CIDRs routed through the tunnel by the client, default "0.0.0.0/0" (all IPv4 traffic; add ::/0 to also route IPv6) persistent_keepalive: seconds integer, default 25