All documentation
Remote access12 min

Remote MikroTik setup

Connect RouterOS 7 behind CGNAT and prove remote management without exposing Winbox.

Outcome

A RouterOS device connected by native WireGuard with controlled Winbox access.

Before you start

  • MikroTik RouterOS 7
  • Terminal access
  • Outbound internet access
  • A backup or export of the current router configuration

Prepare RouterOS

  1. 1Confirm RouterOS 7 and correct system time.
  2. 2Back up the current configuration.
  3. 3Confirm DNS and outbound internet work.
  4. 4Do not publish TCP 8291 on the WAN for this workflow.

Generate and apply the script

  1. 1In Devices, select Add device and MikroTik.
  2. 2Name the router after its site and role.
  3. 3Copy the RouterOS script from Device Client Config.
  4. 4Paste the complete script into Terminal once.
  5. 5Resolve any duplicate-name, route-conflict or syntax error before retrying.
Operational note: This path uses WireGuard built into RouterOS 7. It does not install wantasticd on the router.

Create controlled Winbox access

  1. 1Wait for Online and a current last-seen time.
  2. 2Open Winbox in Wantastic and add an account for this device.
  3. 3Use the generated connection details in native Winbox.
  4. 4Confirm the router identity with a read-only view.
  5. 5Remove any temporary WAN port-forward used during migration.

Reach downstream routers with RoMON

  1. 1Validate RoMON locally on the intended interface path.
  2. 2Connect to the Wantastic-managed gateway.
  3. 3Choose the downstream RoMON neighbor.
  4. 4Confirm the downstream MAC and RouterBOARD identity before changing configuration.

Verify the result

The router is Online without an inbound WAN rule.
Winbox opens the intended router.
Last seen changes after reconnect.
Public TCP 8291 remains closed.

Common issues

RouterOS reports a script error.
Likely cause

An object already exists, RouterOS is too old or a partial import left conflicts.

Fix

Read the first failing line, inspect existing WireGuard/address objects, remove only incomplete Wantastic objects and regenerate.

Router is online but Winbox times out.
Likely cause

Winbox is disabled, restricted by source, on another port or unreachable by policy.

Fix

Check /ip service print locally, confirm the port and address policy, then update the access entry.

RoMON neighbors do not appear.
Likely cause

RoMON is disabled or blocked on the gateway/downstream path.

Fix

Prove RoMON locally from the gateway before retrying through Wantastic.

Continue with

Winbox and RoMONCreate per-workflow Winbox access and reach downstream RouterOS devices.Topology and access policySeparate the network you observe from the paths you intend to allow.Common issues and fixesStart from the symptom, isolate the failing layer and verify recovery at the target.
Remote MikroTik setup | Wantastic Docs