Wantastic is a WireGuard central cloud management dashboard that supports secure WireGuard-based management for MikroTik, OpenWrt, Linux, Android, Windows, and other supported endpoints behind firewalls.
Wantastic USP over WireGuard carries device-management operations inside the existing encrypted tunnel—without exposing another management socket or building a second trust layer.
Control transmission path
Compact, typed and tunnel-only
USP operations
CRUD, operate, notify
WUSP envelope
Method + correlation ID
Control fragments
MTU-safe binary frames
WireGuard packet
Authenticated encrypted tunnel
Control transport
Noise fragmented datagram
Default payload
1200 bytes
Runtime model
TR-181 Device:2.20
WUSP is a purpose-built private transport for USP semantics in Wantastic. It is not a drop-in standard Broadband Forum USP Message Transfer Protocol.
A lightweight WireGuard mesh daemon for servers, desktops, OpenWrt routers and embedded IoT devices—with WUSP management and a factory-ready QR claim workflow.
One service model across modern operating systems, legacy init systems and embedded Linux.
Headless claiming, BusyBox support and compact binaries make factory provisioning practical.
Initialize USP-style device management over the same authenticated WireGuard tunnel.
/ # wantasticd genkey
Reused existing device claim key: /usrdata/wantastic/etc/device-claim-key.json
Public key: 0vNwglyJYpPOgsg9Q/AJgj7ke/48CUhWUXMQuRDG8yQ=
Stable device key
Generate once and preserve it in the manufacturer image.
Customer claim
Scan the printed QR to assign the device securely.
Mesh comes online
Create wantastic0 and establish the WireGuard peer.
Management starts
Load the runtime model and initialize WUSP.
Factory claim label
Print-ready manufacturer artwork
Scan to claim this device
Sign in to Wantastic, scan this code and the device configures its secure management tunnel automatically.
ID · 0vNwglyJYpPO…RDG8yQ
The public claim key can be printed. Keep the private claim-key JSON on the device and never place it on the label.
Platforms and device classes
Published architecture targets
One operating layer
Remote Winbox, WebSSH, WebProxy, monitoring, team access and policy live in one management layer for MikroTik, OpenWrt, Linux, Windows and Android fleets behind CGNAT, LTE, Starlink or locked-down firewalls.
MikroTik devices join with the WireGuard client already built into RouterOS 7, so field installs stay simple and reversible.
Paste the generated RouterOS script, let the router initiate outbound connectivity, and avoid custom binaries on MikroTik hardware.
RouterOS 7 native WireGuard
Each account gets isolated routing and policy so devices are reachable for work, not blindly trusted because someone joined a VPN.
Use P2P paths where possible, relay only when needed, and keep device-to-device communication explicit through topology and ACL rules.
Isolated virtual routing
Reach MikroTik routers through managed overlay endpoints instead of exposing Winbox to scanners or depending on brittle jump boxes.
Give each technician their own controlled session, rotate managed credentials, audit access, and keep native RoMON workflows available for downstream devices.
Secure Winbox + RoMON
Stop passing around admin passwords, VPN files or permanent jump-server access just to fix a customer site.
Invite teammates, grant only the workflows they need, track sessions, and revoke access centrally without rewriting every router.
Per-user access control
Open SSH terminals and internal web UIs from the portal so support work can happen from any trusted browser.
Use WebSSH for shell access, WebProxy for LAN-only HTTP/HTTPS interfaces, and persistent sessions that survive tab changes and multitasking.
WebSSH + WebProxy
WantasticCore is an MIT-licensed self-hosted WireGuard mesh portal, and wantasticd connects Linux, OpenWrt, macOS and Windows devices.
Use the hosted console for speed, or run the open-source core when customers, compliance or lab work require ownership of the control plane.
WantasticCore + wantasticd
From endpoint to console
Wantastic is built around the real support path: connect the device, isolate it, grant access, then work from the browser.
Outbound-first onboarding
Connect RouterOS with native WireGuard, or install wantasticd on OpenWrt and Linux. The device initiates the connection, so CGNAT and dynamic ISP links stop being blockers.
Policy-aware routing
Devices join an isolated overlay where access is intentional. Technicians reach the device workflows they need without joining a flat private network.
Least-privilege operations
Model groups, links and protocol-level rules from the portal. Give people access to Winbox, SSH or web interfaces without giving them permanent network keys.
Winbox, WebSSH, WebProxy, WUSP
Launch Winbox access, persistent WebSSH, LAN-only web interfaces, monitoring and WUSP-style device control from the same console.
Field notes from operators solving remote Winbox, CGNAT, OpenWrt and browser-based support workflows.
“The real win is not having to expose Winbox or maintain a separate VPN path for every customer site. Devices behind CGNAT are reachable from the console, and the support workflow is much cleaner.”
Mar 2025“Remote Winbox over the overlay solved the annoying Starlink and NAT problem for MikroTik support. I can keep native Winbox and RoMON habits without opening ports at the customer edge.”
Feb 2025“wantasticd makes the Linux and OpenWrt side feel like part of the same management plane. That matters when a site has routers, small servers, and embedded devices on unreliable LTE links.”
Jan 2025“The team access model is the feature I care about most. I can stop handing out shared router credentials and give technicians the exact workflows they need for a device.”
Dec 2024“I used to maintain a WireGuard jump server just to reach routers. Wantastic gives me the tunnel, the browser tools, and the device list in one place, which is the part generic VPN tools miss.”
Nov 2024“The P2P-first design is the right architecture for interactive work. When a direct path is possible, Winbox and SSH feel much better than a relay-only remote access stack.”
Oct 2024“The free plan was enough to test the real workflow: add a router, connect through Winbox, try WebSSH, and see whether it fits support operations before rolling it wider.”
Sep 2024“The open-source direction changed how I looked at the product. WantasticCore and wantasticd make it possible to inspect the architecture instead of trusting a black-box remote access service.”
Aug 2024Practical answers about remote Winbox, CGNAT, OpenWrt, Linux, Windows, Android, WebSSH and self-hosted WantasticCore.
Start with hosted Wantastic for speed, or explore the open-source WantasticCore when you need a self-hosted WireGuard mesh and browser management portal.
