HomeHow it works

How it works

The router calls out. That is what makes it reachable.

MUA VPN reverses the usual direction of a connection. Instead of waiting for something on the internet to reach in — which CGNAT and shared lines prevent — the router opens an outbound tunnel to our server and keeps it open. We always know where the router is, so you always have an address to connect to.

The tunnel

One outbound connection, one permanent address.

The device runs a WireGuard interface that dials out to our server. Because the connection starts on your side, it passes straight through NAT and CGNAT without any inbound rule. The server assigns the device a fixed address inside the tunnel, and that address is what you connect to.

Sequence of events for a MUA VPN connection The router sends an outbound WireGuard handshake to the MUA VPN server. The server establishes the tunnel and assigns an access address. The operator later connects to that address and the server forwards the session to the router. Your router wg-mua MUA VPN server hub You, remote Winbox / SSH 1. outbound WireGuard handshake 2. tunnel up, address assigned 3. tunnel stays open, reconnects on its own 4. connect to the access address 5. session forwarded over the tunnel

The router initiates everything. Inbound sessions are carried back over the tunnel it opened.

Setup

Three steps, one command on the router.

  1. 1

    We generate the script

    We prepare a RouterOS script file for your router. It contains the WireGuard interface configuration, the peer details for our server, and the access address reserved for that device. It is specific to the router — nothing generic.

  2. 2

    You import it

    Upload the .rsc file to the router's file list and run /import file-name=router.rsc from a terminal. The interface is created, the peer is added, and the tunnel comes up.

  3. 3

    You connect

    Open Winbox, SSH, WebFig or RDP and point it at the access address. It works from anywhere with internet, including a phone on mobile data.

Open the setup guide Get my script

Reliability

It comes back by itself.

Remote access that needs a person on site to fix it is not remote access. The tunnel is designed to survive the things that happen to real networks.

  • Reboots. The tunnel is configured to start with the router, so a power cut does not mean a site visit.
  • Changing addresses. If the ISP changes your connection's address, the tunnel simply re-establishes. Your access address does not change.
  • Link drops. When the line returns, the tunnel returns, and you get a WhatsApp notification that the device is back online.
  • Bad changes. A daily configuration backup means you can restore a known-good version after a mistake.
What stays constant
  • Your access address
  • Your credentials in Winbox, SSH, WebFig or RDP
  • The router's own configuration and LAN addressing

Nothing on the LAN side has to be renumbered for remote access to work.

Route mode

When you need more than access.

Access mode keeps the tunnel for management. Some lines need more: the operator can browse and stream fine, but a handful of specific sites or services fail, and the cause is somewhere between the router and the internet. Route mode sends the router's whole traffic through our server instead.

What Route mode does

  • Routes all of the router's traffic through the MUA VPN server
  • Switched on and off from the dashboard
  • An automatic safety check reverts the change if it isn't helping
  • Requires RouterOS v7+

How to think about it

Access mode answers the question “how do I get in?” Route mode answers “why does this one thing not work?”

Because the change is reversible and the safety check is automatic, Route mode is safe to test on a line that is misbehaving. If routing the traffic through us does not improve the situation, it is turned back off rather than left in place.

A note on requirements

Both Access and Route require RouterOS v7 or later on MikroTik devices, because they rely on the built-in WireGuard implementation. Windows and Linux machines need a WireGuard client. See the setup guide for specifics.

What you get

More than a tunnel.

Access

A permanent address per device, reachable with Winbox, SSH, WebFig or RDP.

Management tools

PPPoE subscribers, expiry and renewals, hotspot vouchers and daily configuration backups.

Site-to-site

Join branch LANs into one private network, with routes pushed automatically.

Monitoring

WhatsApp alerts when a device goes offline, and again when it comes back.

Security

WireGuard encryption throughout, and risky management ports closed on static public IPs.

Route mode

Full-traffic routing with a dashboard toggle and an automatic safety revert.

Put one router behind it and see for yourself.

Seven days, no credit card, no public IP to order. If it does not fit your network, turn it off.

Start the free trial See pricing