kiler129 / mikrotik-auto-wireguard

MikroTik Auto WireGuard

TL;DR: this tool lets you autoconfigure WireGuard clients on a MikroTik RouterOS and generate configs for them without hand-assigning any parameters.

Why?

WireGuard is a static and simple by design. Thus, it does not offer any form of:

• automatic IP assignment
• route pushing
• config generation
• DHCP tunneling (or any non-IP traffic)

This is why normally to get a new node/person connection you have to:

• generate keys for the user (or ask the user for its public key)
• add new client
• find the next free IP & assign it statically a client
• create a config for the user
• make a note of which peer is which user

This tool does all that automatically for one or more users at once.

How to use it?

Docker

The simplest way is through Docker:

• Build image: docker build -t mt-wg-auto https://github.com/kiler129/mikrotik-auto-wireguard.git
• Run: docker run -it --rm mt-wg-auto generate --help

For more see more detailed docs.

Without Docker

Requirements

• RouterOS v7.1 beta3 or newer
• Admin user on the router with API enabled
• PHP 7.4 or newer

As of now, as the ROS is in beta stage, there are no promises of compatibility. In simple terms you should execute bin/console generate --help and configure it as you wish ;)

For more see more detailed docs.

Disclaimer

This is a beta software. As with ROSv7 it's not recommended being used in production. This software nor the author are affiliated/supported/endorsed by SIA Mikrotīkls.

mikrotik-auto-wireguard's Issues

Add usernames as peer comments

Add PHP 8 support

As of now the major show-stopper are dependencies of https://github.com/EvilFreelancer/routeros-api-php

Add PHAR and/or Docker builds

To make it easy to use by sys-admins it should be easier to use it when you're not a programmer.

PHAR (or even Docker) build should be provided and possibly automated.

Interface address should be excluded

The ff3779e excluded the network address. However this doesn't fully solve the issue as now the first address used will be .1 which is problematic if the interface has an address of .1 like so:

/ip address
    add address=10.100.0.1/24 interface=wireguard1-srv network=10.100.0.0

Endpoint configuration is not compatible with v7.1beta3

Beta 3 surprisingly (i.e. without changelog note) removed endpoint field from /interface/wireguard/peers members (previously storing IP:PORT). Instead now ROS has endpoint-address and endpoint-port fields.

Generated configuration is incompatible with newer macOS & iOS

Newer macOS and iOS patched a hacky workaround used by WG causing connections to fail with a mysterious error and no logs.

Workaround was posted by the authors and is as simple as adding any DNS to client config:

[Interface]
DNS = 1.1.1.1

Upstream fix in progress: https://git.zx2c4.com/wireguard-apple/commit/?id=20bdf46792905de8862ae7641e50e0f9f99ec946

Add option to specify DNS server

Thanks for this tool!
One key feature it's missing IMHO is allowing to specify a DNS server.
Even better: As a default it could use either the wireguard interface address assuming/if there's a DNS server running on there, or take what the mikrotik is using for its DNS queries. In my case my mikrotik uses a different DNS server but it also runs its own, caching the other one and I use this own caching DNS server for my wireguard peers: The .1 address.

Thoughts?

Exclude network address when auto-fetching addresses from interface

When interface has an address set to e.g. 10.0.1.1/24 the first peer will have an address of 10.0.1.0/32 which ROS will not like. It should be excluded.