Setup Wireguard With Mikrotik and Fedora Linux

1. Ensure Mikrotik (Hex S in my case) is updated for Wireguard support
2. In Wireguard menu on Winbox (or web manager):
   • Add a new Wireguard instance
     • Name the interface
     • Change the port number
     • Click ‘+’ next to private key
3. Go to IP -> Addresses and add new address
   • Comment appropriately
   • Set address as something not commonly used. 192.168.100.1/24, perhaps
   • Set network address (192.168.100.0, for this case)
   • Set the interface as the Wireguard instance created above
4. Go to IP -> Firewall
   • In Filter Rules:
     • New rule.
       • Chain = input.
       • Protocol = 17(udp).
       • Dst. Port = {your chosen port}.
       • Action = accept.
       • Comment as “Accept WG input” or something.
     • New rule.
       • Chain = forward.
       • In Interface = {WG interface set up above}.
       • Action = accept.
       • Comment as “For WG access” or something.
   • In NAT:
     • New rule.
       • Chain = srcnat.
       • Src Address = {WG network address (192.168.100.0/24)}.
       • Out Interface = {Your WAN interface}.
       • Action = masquerade
       • Comment as “Masquerade WG” or something
5. On Fedora client (Should work similarly for any Linux distro, to be fair)
   • sudo dnf install wireguard-tools
   • wg genkey | tee privatekey | wg pubkey > publickey
   • sudo su. You will need to be root in terminal to access the WG folder
   • cd /etc/wireguard
   • nano wg0.conf (or name it whatever you want your connection named)
   • "[Interface]
PrivateKey = {paste private key}
ListenPort = {your chosen port}
Address = {IP within chosen network ie/ 192.168.100.2}

[Peer]
PublicKey = {paste from Winbox}
Endpoint = {Your public IP}:{your WG port}
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 20“
   • Ctrl + x then ‘y’ to save
   • nmcli con import type wireguard file /etc/wireguard/{your config file}
   • firewall-cmd –add-port={your WG port}/udp
6. Configure peer in Winbox
   • In Wireguard menu, select Peers tab and add new
   • Give it a name, and a comment if you like
   • Choose your WG interface
   • Copy/paste public key from Fedora
   • Allowed Address = {Fedora WG IP/32 (192.168.100.2/32)}
7. Try the connection!

Hopefully this is helpful if you stumble across it. I’m hoping to do more of these tutorials as I try to do more stuff myself and stumble across the internet for answers. Did this work for you? Let me know if anything doesn’t or if something confuses you above!