Import one file. That is the whole setup.

Before you start

You will need:

• A MikroTik router running RouterOS v7 or later. WireGuard is built into RouterOS from v7 onwards; it is not available on v6.
• Working internet on that router.
• The ability to configure it — Winbox, WebFig, or an SSH session.
• The .rsc script file we generate for that specific router.

MikroTik / RouterOS setup

1. Get your script file

After you start the trial we generate a script named for your router, for example router.rsc. It contains the WireGuard interface, the peer details for our server, and the access address reserved for this device.

2. Upload it to the router

In Winbox, open Files and drag router.rsc into the file list. In WebFig, use Files → Upload. You can also upload it over FTP or SCP if you prefer.

3. Import it

Open a terminal on the router and run:

/import file-name=router.rsc

The script creates the WireGuard interface, adds our server as a peer, assigns the access address and adds the route to the hub. The tunnel comes up within a few seconds.

4. What the script contains

For reference, this is the shape of the configuration that gets imported:

# WireGuard interface
/interface/wireguard/add name=wg-mua listen-port=13231

# Peer: the MUA VPN server
/interface/wireguard/peers/add interface=wg-mua \
  public-key="<server-public-key>" \
  endpoint-address=vpn.muatim.co.ke endpoint-port=13231 \
  allowed-address=10.66.0.0/24 \
  persistent-keepalive=25s

# Permanent access address for this router
/ip/address/add address=10.66.0.14/32 interface=wg-mua

# Route to the hub network
/ip/route/add dst-address=10.66.0.0/24 gateway=wg-mua

# Allow management over the tunnel
/ip/firewall/filter/add chain=input action=accept \
  in-interface=wg-mua comment="MUA VPN management"

Values such as the public key and the address are unique to your router. The example above is illustrative.

5. Connect

From a machine that also has access to the tunnel network, open Winbox, WebFig or an SSH client and connect to the access address instead of the router's LAN address. RDP works the same way for Windows machines.

Verify the tunnel

These commands confirm the interface, the peer and the address are in place:

# interface should show wg-mua as running
/interface/wireguard/print

# peer detail shows the last handshake time
/interface/wireguard/peers/print detail where interface=wg-mua

# the access address assigned to this router
/ip/address/print where interface=wg-mua

# reach the hub
/ping 10.66.0.1 count=4

A recent last-handshake value and a reply from the hub mean the tunnel is up. If the handshake is empty and the ping fails, work through the troubleshooting section below.

Troubleshooting

The tunnel is up but I cannot reach the hub

Check that allowed-address on the peer includes the hub network (10.66.0.0/24) and that a route to 10.66.0.0/24 points at wg-mua. If you have a restrictive firewall, make sure input from wg-mua is accepted.

No handshake at all

Confirm the router has working internet and can resolve the server name. Check that outbound UDP to port 13231 is not blocked by an upstream firewall. If your provider blocks that port, tell us and we will provide an alternative endpoint port.

The handshake works, then stops

This usually means something is dropping the keepalive. The generated script sets persistent-keepalive=25s, which keeps NAT mappings alive. If your line is very unstable, the tunnel will re-establish on its own — you will see a gap in the connection history and a WhatsApp alert.

I lost access after a firewall change

Restore a configuration backup. MUA VPN takes an automatic daily backup of each router's configuration, so you can roll back to a version that worked.

Windows and Linux

MUA VPN is not only for routers. A Windows or Linux machine can hold a permanent access address the same way, which is useful for a workstation or server sitting behind a NAT you do not control.

Windows

1. Install the official WireGuard client for Windows.
2. We provide a .conf file generated for that machine.
3. Import the tunnel in the client and activate it.
4. Connect to the machine with RDP, or to any service it runs, using its access address.

Linux

Install the WireGuard tools for your distribution, then place the generated configuration in place:

# example: Debian / Ubuntu
sudo apt install wireguard-tools

# the generated config, saved as wg-mua
sudo install -m 600 wg-mua.conf /etc/wireguard/wg-mua.conf

# bring the tunnel up
sudo wg-quick up wg-mua

# start it automatically on boot
sudo systemctl enable wg-quick@wg-mua

Once the tunnel is up, SSH to the machine using its access address from anywhere you have internet.

Enabling Route mode

Route mode is switched on from the dashboard, not from the router. Turn it on for a line where specific sites or services fail while everything else works. The router's traffic is then routed through our server.

An automatic safety check watches the effect of the change. If routing through us is not helping, it is reverted rather than left in place. Route mode requires RouterOS v7 or later.