interface (mandatory) | iface_enum | Name of the WireGuard interface the peer belongs to. |
name | string | Adds a name to a peer, used as a reference in WireGuard logs. Available from RouterOS version 7.15. |
public-key | string | A base64 public key calculated from the private key. Public keys are used by peers to authenticate each other. |
private-key | | A base64 private key. auto generates the key automatically, none disables it. |
endpoint-address | address (flags=46D) | The IP address or hostname used by WireGuard to establish a secure connection between two peers. |
endpoint-port | num | The UDP port on which a WireGuard peer listens for incoming traffic. |
allowed-address (mandatory) | | List of IP (v4 or v6) addresses with CIDR masks from which incoming traffic for this peer is allowed and to which outgoing traffic for this peer is directed. Allowed-address ranges cannot overlap on one interface. |
preshared-key | | A base64 preshared key. Adds an additional layer of symmetric-key cryptography for post-quantum resistance. auto generates the key automatically. |
persistent-keepalive | time | Interval in seconds of how often to send an authenticated empty packet to the peer to keep a stateful firewall or NAT mapping valid. A value of 0 disables the keepalive. |
client-address | | When imported with a QR code by a client, this address for the WireGuard interface is set on that device. |
client-dns | | DNS servers used when the WireGuard server acts as a VPN gateway for peer traffic. |
client-endpoint | address (flags=46D) | The IP address and port number of the WireGuard server. |
client-keepalive | time | Same as persistent-keepalive but from the peer side. |
client-listen-port | num | The local port on which the WireGuard tunnel listens for incoming traffic from peers and from which it sources outgoing packets. |
client-allowed-address | | Allowed IPs configured for the client. Available from RouterOS version 7.21. |
client-mtu | num | MTU value set on the client when importing configuration. |
responder | bool | Specifies if the peer is a connection initiator or only a responder. Use on WireGuard devices that act as servers for client devices. Otherwise the router repeatedly tries to connect to endpoint-address or current-endpoint-address. |