How to set up Proton VPN WireGuard® on MikroTik routers

You can set up Proton VPN on your MikroTik router so that all devices that connect to the internet through it are protected by Proton VPN.

In this guide, we show you how to do this using the WireGuard VPN protocol on MikroTik routers running RouterOS 7.

1. Download a WireGuard configuration file and open it using any text editor.

Note that you can’t use a saved config file. Proton VPN never stores your private keys, so saved config files don’t have them. You must create and download a new config file. 

Learn how to download a WireGuard configuration file from Proton VPN. Open it using any text editor.

Note that you can’t use a saved config file. Proton VPN never stores your private keys, so saved config files don’t have them. You must create and download a new config file.

2. Open a command line (the Terminal app macO, PowerShell on Windows, or any terminal window on Linux) and run:

ssh admin@192.168.88.1

Replace admin with your router username if you changed it. Read more about using the command line with MikroTik(new window).

3. Create a new WireGuard interface.

To find your private key, look for the line starting PrivateKey = in the configuration file you downloaded in step 1. Keep the straight double quotes (") around the key. Run:

/interface wireguard add listen-port=13231 mtu=1420 name=wireguard-inet private-key="your private key"

4. Add an IP address to the interface you just created.

/ip address add address=10.2.0.2/30 interface=wireguard-inet network=10.2.0.0

5. Add a WireGuard server as a peer.

Add the endpoint address, endpoint port, and public key from the configuration file. Look for the lines starting PublicKey = and Endpoint =.

For example, if the file says Endpoint = 103.107.197.2:51820, enter endpoint-address=103.107.197.2 and endpoint-port=51820.

Run:

/interface wireguard peers add allowed-address=0.0.0.0/0 endpoint-address=x.x.x.x endpoint-port=xxxxx interface=wireguard-inet persistent-keepalive=25s public-key="your public key"

6. Enable masquerade for that interface.

This assumes you use MikroTik’s default local network, 192.168.88.0/24. If you’ve changed it, use your network for src-address= instead. Run:

/ip firewall nat add action=masquerade chain=srcnat out-interface=wireguard-inet src-address=192.168.88.0/24

7. Redirect all internet traffic through WireGuard. Run:

/ip route add disabled=no distance=1 dst-address=0.0.0.0/1 gateway=10.2.0.1 pref-src="" routing-table=main scope=30 target-scope=10
/ip route add disabled=no distance=1 dst-address=128.0.0.0/1 gateway=10.2.0.1 pref-src="" routing-table=main scope=30 target-scope=10

8. Configure DNS settings. Run:

/ip dns set servers=10.2.0.1
/ip dhcp-client set 0 use-peer-dns=no

9. Route the WireGuard server address through your internet provider’s gateway.

Replace x.x.x.x with the endpoint address from the configuration file (Endpoint =). Run:

/ip route
add disabled=no dst-address=x.x.x.x/32 gateway=[/ip dhcp-client get [find interface=ether1] gateway] routing-table=main

If this doesn’t work, replace gateway=[/ip dhcp-client get [find interface=ether1] gateway] with gateway=x.x.x.x, where x.x.x.x is your own internet gateway address. Your internet service provider (ISP) should be able to provide this address.

10. Restart your router. Run:

/system reboot

Enter y to confirm. When the router is back, it protects all internet connections it provides with Proton VPN.

Check your connection

• On the router: /interface wireguard peers print shows a recent last-handshake.
• Visit our free secure IP scanner to check that your IP address location matches your VPN server.

Disconnect and reconnect

• To disconnect: Run /interface wireguard disable wireguard-inet. Devices on your network then use your regular internet connection without VPN protection.
• To reconnect: Run /interface wireguard enable wireguard-inet.