Mikro Manager
en

WireGuard on MikroTik, from your Mac

Setting up a WireGuard client on RouterOS normally means generating a keypair somewhere, pasting the public half into the router, and assembling the client's configuration by hand. Mikro Manager does the whole sequence and gives you something the client can actually use.

Keys stay where they belong

Client keypairs are generated on your Mac. Only the public key is ever sent to the router; the private key is shown once, for you to hand over, and is never written to disk or to the Keychain. Interface keys are generated by RouterOS itself, so no key material travels in that direction either.

A configuration the client can use

Issue a peer and get the finished client configuration — interface address, DNS, allowed addresses, endpoint and keys — as text to copy, a .conf file to send, or a QR code the WireGuard mobile app scans directly.

Peers you can keep track of

Every peer lists its last handshake, current endpoint and transfer counters, so a tunnel that stopped working is obvious rather than something you discover when someone complains.

A configuration the client can use
A configuration the client can use

Questions

Does my private key go to the router?
Never. The keypair is generated on your Mac and only the public key is sent. The private key appears once so you can pass it to the client, and is not stored anywhere afterwards.
Can I use the QR code with the phone apps?
Yes. It encodes a standard WireGuard configuration, which the official iOS and Android apps scan directly.
Does it manage the firewall rules a tunnel needs?
No. It creates the interface, the address and the peers; routing and firewall policy stay yours to decide, since only you know what the tunnel is for.
What if a peer's key is compromised?
Delete the peer and issue a new one. Removing it on the router revokes access immediately, and the replacement gets a fresh keypair.

Get Mikro Manager

Distributed through the Mac App Store — sandboxed, signed, and updated automatically.

Coming soon to the Mac App Store.

Requires macOS 14 or later, and a RouterOS v7 device with the REST API enabled.