VPN on MikroTik: WireGuard in RouterOS 7, and what about AmneziaWG

A VPN on MikroTik installs with no third-party software: RouterOS 7 understands plain WireGuard "out of the box", and the file from your NvoVPN account imports with a single button. After importing, you will need to add three things by hand — DNS, a route and NAT; the whole thing takes 15–20 minutes. An honest caveat: RouterOS has no AmneziaWG (WireGuard with traffic obfuscation). Where VPNs are not throttled, you do not need it anyway. If you are in Russia, read the "Are you in Russia?" block below: plain WireGuard is blocked there, and the route is different.

1. 1

   Download the WireGuard variant of the file

   In your account → "Connection" → "Manual", choose a server, the device "Router", and click "Create". Next to the AmneziaWG file is a plain WireGuard variant — that is the one MikroTik needs. Download it and note two lines: Address (the router's address in the tunnel) and DNS.

2. 2

   Upload the file to the router and import it

   You need RouterOS 7.12 or later — file import (wg-import) arrived in that version. In WinBox or WebFig, open "Files" → "Upload" → choose the .conf file. Then "WireGuard" → "WG Import" → point it to the uploaded file. If your version does not have that button, type /interface/wireguard/wg-import file=filename.conf in "New Terminal". The import creates a WireGuard interface with your key, and a peer (a record for our server) with its key, Endpoint and AllowedIPs.

3. 3

   Add by hand what the import does not do

   "IP" → "Addresses": the address from the Address line needs to sit on the WireGuard interface — add it if it is not there. "IP" → "DNS" → the "Servers" field: enter the address from the DNS line, since the import does not read it. "IP" → "Firewall" → the "NAT" tab → "+": Chain srcnat, Out. Interface — your WireGuard interface, Action masquerade.

   Routing all home traffic into the tunnel: "Routing" → "Tables" → a new table (call it WG, tick "FIB"); "Routing" → "Rules" → a rule: Src. Address — your home network (for example 192.168.88.0/24), Action "lookup only in table", Table WG; "IP" → "Routes" → "+": Dst. Address 0.0.0.0/0, Gateway — the WireGuard interface, Routing Table WG. Do not touch the interface's MTU: 1420 is the default.

4. 4

   Check the IP from a device behind the router

   On a laptop or phone connected to the MikroTik, open the "What is my IP" page. It should show the NvoVPN server's address, not your provider's. Seeing your provider's address? See the "If it will not connect" section below.

If the WireGuard client on MikroTik will not connect

• "Could not parse" during import. The file starts with a comment line beginning with # — delete lines like that in a text editor and try again. RouterOS below 7.12 has no wg-import command — update the system.
• The tunnel is up, sites will not open. That is DNS: the DNS line from the file is not imported. Enter the address in "IP" → "DNS" → "Servers", and hand it to your devices in "IP" → "DHCP Server" → "Networks" too.
• The internet bypasses the tunnel. Check three places: the WG table was created with "FIB" ticked, the rule in "Routing" → "Rules" names your network and "lookup only in table" WG, and the 0.0.0.0/0 route sits specifically in the WG table. So devices at home can see each other, add one more rule above this one: Src. Address and Dst. Address — your network, Action "lookup", Table main.
• No masquerade rule. Without it, the server drops packets carrying home addresses — the tunnel is "connected", but there is no data.
• Heavy pages hang, small ones open. Check the WireGuard interface's MTU: it needs to be 1420.
• One file, one device. You cannot use the router's configuration on a phone at the same time: the connection will drop on both. A subscription covers up to five configurations.
• Kill switch. RouterOS has no built-in "block internet if the tunnel drops" tickbox.
• Your AmneziaWG router connects, but no traffic gets through. Message support — we will prepare a configuration with a route for Russia.

MikroTik models and RouterOS versions

Per the manufacturer's data as of September 2026. WireGuard exists on any model with RouterOS 7 (RouterOS 6 does not have it); file import (wg-import) arrived with 7.12, text import (config-string) with 7.19. The containers AmneziaWG needs are only available on the ARM, ARM64 and x86 architectures; MIPSBE, MMIPS, SMIPS, TILE and PPC do not have them — MikroTik's architecture support table. Your model's architecture is listed on its page at mikrotik.com.

The interface and peer parameters are described in MikroTik's official WireGuard documentation.

FAQ

Can I upload the AmneziaWG file from my account to MikroTik? No. RouterOS only understands plain WireGuard — take the WireGuard variant of the file. It will not connect in Russia: you need a container or a second router from the "Are you in Russia?" block.

How do I route only the TV through the VPN? In the "Routing" → "Rules" rule, put one device's address in Src. Address instead of the whole network. The rest will go to the internet directly.

I have RouterOS 6 — what do I do? WireGuard only exists in RouterOS 7. Update the system: "System" → "Packages".

How many devices behind the MikroTik does the subscription count? One: to NvoVPN, the router is one configuration, no matter how many devices sit behind it.

Will a VPN slow the router down? WireGuard encryption is light, but a weak CPU becomes the bottleneck. A reference point: the hAP ac²'s CPU gives about 136 Mbps in WireGuard, per measurements from the OpenWrt community. That is enough for a TV and everyday use.

Related guides: VPN on a router: an overview by firmware · VPN on Keenetic · AmneziaWG vs WireGuard: what is the difference · VPN on TP-Link