Manage WireGuard on Mikrotik RouterBoards straight from the panel
Plenty of self-hosters already run a Mikrotik at the edge — and asked us to let them treat that hardware as a first-class VPN server. So we added a full RouterOS integration. Add the router by URL + credentials, the panel inherits its WireGuard interface, address pool and public key in one probe, and from then on manages peers, bandwidth caps and live stats over the RouterOS REST API. No SSH access required, no agent to deploy on the box.
RouterOS REST, not SSH
Talks to /interface/wireguard/peers directly over HTTPS. Authenticated with a router user, never touches the router's shell.
Inherits your pool
Reads the wg interface's IPv4 / IPv6 addresses from the router on adoption — no retyping subnets the device already knows about.
Per-peer bandwidth caps
Limits applied per client are pushed to RouterOS /queue/simple with a flirexa-peer- prefix, living alongside queues your operator created by hand.
Live stats and online users
Handshake recency, transfer counters and per-client online state flow through the same reconciler the agent path uses.
How it works in the panel
- Add Server → Mikrotik (RouterOS) — enter the router URL, a user with REST API privileges, the wg interface name, and you're done.
- Operator-owned interface is protected — the panel never enables, disables or deletes the wg interface itself. It only manages peers and queues on top.
- State reconciliation — disabled clients have their peers removed, manual additions are left alone, drift is detected on the regular tick.
- Hiddify / sing-box / WireGuard official client — generated client configs work everywhere standard WireGuard works.
