TunGuard
Open Source MikroTik Provisioning

Provision your MikroTik routers, WireGuard or IPsec.

Two deployment methods, one dashboard. Use TunGuard for automated WireGuard with peer management and jump-host access behind CGNAT, or generate a native IPsec script for your existing gateway. Generate a RouterOS script and connect in seconds.

Generate Script View on GitHub

TunGuard vs Native IPsec

Two deployment methods. Pick the one that fits your setup.

TunGuard WireGuard

Automated WireGuard with a peer dashboard

  • Self-hosted server with a dashboard for every peer and keypair
  • Jump host + built-in SSH terminal to reach any router
  • Works behind CGNAT: routers dial out and reconnect automatically
  • Auto-assigned IPs, no manual config per router
Best when: You manage many routers, especially behind CGNAT or dynamic IPs, and want one control plane.

Native IPsec

Site-to-site script for an existing gateway

  • Generates a RouterOS IPsec script, no TunGuard server needed
  • Connects your local LAN to a remote LAN
  • Works with MikroTik CHR, strongSwan, or any IKEv2 gateway
  • No peer dashboard: peers are managed on your own gateway
Best when: You already run an IPsec gateway and just need a router pointed at it.

How It Works

1

Choose a Method

Pick TunGuard WireGuard or Native IPsec, enter the few details, and get a complete RouterOS bootstrap script.

2

Import into MikroTik

Copy the script or download the .rsc file. Import it on your router with a single command.

3

Router Connects

WireGuard registers with your TunGuard server; IPsec dials your gateway. The tunnel comes up automatically.

Why This Dashboard?

Everything you need to provision MikroTik routers, for WireGuard or IPsec.

Zero Config

Pick a method, enter a few details, and get a complete RouterOS bootstrap script. That's it.

WireGuard Userspace

TunGuard runs WireGuard in userspace with no kernel modules needed.

Auto Provisioning

The server creates the keypair and config. Your router just applies it.

RouterOS v7

Fully compatible bootstrap scripts for MikroTik RouterOS version 7.

Copy or Download

Copy to clipboard or download as .rsc and import directly into your router.

Open Source

TunGuard is fully open source. Self-host on your own infrastructure.

Provision Generator

Choose your deployment method and generate a RouterOS bootstrap script.

Calls http://{ip}:9000/api/peer/generate-config

Sent as X-API-Keyheader (Settings → API Key)

Troubleshooting

WireGuard tunnel is up but UDP traffic is being dropped? Check your firewall rule order.

Firewall Rule Order

MikroTik firewall rules are processed from top to bottom. If your router has a default drop rule, the TunGuard allow rule must be placed above that rule. If the allow rule is below the drop rule, TunGuard will connect but management access will fail.

Check your firewall order:

/ip firewall filter print

Move the TunGuard rule above the drop rule:

/ip firewall filter move <TunGuard-rule-number> <drop-rule-number>

Replace the numbers with the actual rule positions shown by your router. TunGuard does not automatically reorder firewall rules because existing MikroTik firewall policies vary between installations.

Trusted by Network Engineers

But don't just take our word for it.

“Setting up WireGuard on MikroTik was a nightmare until TunGuard. Now it's one command.”

Alex K.

Network Engineer

“No more fighting with public IPs or complex configs. TunGuard just works.”

Sarah M.

IT Director

“The provisioning generator saved us hours of manual config per router. Absolute game changer.”

David L.

DevOps Lead

Get Started

Choose TunGuard WireGuard or Native IPsec, generate a script, and connect your MikroTik router in minutes.

Generate Script GitHub