mikrotik-wireguard
PHP web dashboard for managing WireGuard peers on MikroTik RouterOS 7 CHR, featuring multi-server support, auto IP allocation, X25519 key generation, config export (QR code), live status monitoring, pagination, and full i18n support.
Ficha actualizada 23 sept 2026, 9:02 · upstream 23 sept 2026, 8:57 · release sin release detectada
Qué es mikrotik-wireguard
Descripción editorial construida a partir del repositorio, su documentación y sus señales de mantenimiento.
MikroTik WireGuard Peer Manager is a lightweight PHP web dashboard designed for managing WireGuard peers on MikroTik RouterOS 7 CHR. It provides a centralized interface to create, view, edit, and delete peer configurations with automatic IP address allocation from the assigned subnet. The system supports multi-server deployments where administrators can switch between different CHR instances via a dropdown selector in the header. Key features include X25519 key pair generation using libsodium, client configuration export as both .conf and .rsc files, and a QR code generator for quick client setup. The dashboard includes live status monitoring with auto-refresh intervals, handshake timeout detection, interface online/offline indicators, configurable pagination to manage large peer lists, and full internationalization support in Italian and English.
The application follows a RESTful API architecture with two operational modes: the default HTTPS-based mode (port 443) using RouterOS REST API, and an alternative native API mode (ports 8728/8729) that requires Python 3.8+ and librouteros for communication. Both modes support machine-to-machine peer creation via a public API endpoint, enabling programmatic client configuration generation without manual intervention.
Configuration is managed through PHP files stored in the configs/ directory, each representing an independent server instance. The dashboard resolves the active server based on URL parameters or session persistence, with fallback logic to alphabetically order available config files. A comprehensive configuration template is provided in config.php.dist covering all available options including language selection, API mode choice, SSL verification settings, DNAT port calculation, export format preferences, and various monitoring and display options.
Security considerations include git-ignored storage of sensitive credentials, no persistent storage of private keys on the server after modal closure, IP-based access restrictions via .htaccess, dotfile protection against unauthorized access, Bearer token authentication for public API calls, mandatory session login with password hashing using bcrypt, brute-force
- Automated WireGuard peer management on MikroTik CHR without manual configuration
- Multi-tenant or multi-server deployments where different clients connect to separate CHRs
- Client-side QR code generation for quick client setup and configuration import
- Monitoring and status tracking of all active peers with automatic timeout detection
- Programmatic peer creation via public API from external applications or scripts
- Network security monitoring through interface online/offline indicators and traffic data display
- Supports X25519 key generation using libsodium library with regeneration capability
- Auto IP allocation that scans the assigned subnet for the next available address
- QR code export of complete WireGuard configuration including private keys for client setup
- Live peer status monitoring with configurable refresh intervals and handshake timeout detection
- Multi-server architecture allowing seamless switching between different CHR instances via header dropdown
- Full i18n support with Italian and English language options
- Requires MikroTik RouterOS 7.0+ with REST API (port 443) or Native API enabled on the CHR
- Python 3.8+ and librouteros are required for native API mode, limiting compatibility with older PHP versions
- No automatic firewall rule creation — DNAT port forwarding must be manually configured on the CHR
- Intended for LAN-only use; not designed for public internet exposure without additional security layers
- Configuration files are stored in git repository and can be exposed to untrusted sources if .htaccess protection is misconfigured
Perfil de infraestructura
Estimación inicial derivada del repositorio y de los servicios detectados.
Despliegue detectado
Qué señales reales de instalación hemos encontrado.
Deploy as a PHP web application on any server with PHP 8.0+ and required extensions (ext-sodium, ext-json). For Docker deployment, use the provided build/Dockerfile which creates an image containing all dependencies including PHP runtime, libsodium, librouteros, and the dashboard source code. The container generates configs/main.php at startup from environment variables stored in build/.env. Use Docker Compose for single-host development or Kubernetes with Helm chart for production deployment on clusters. For native API mode, ensure Python 3.8+ is installed alongside the PHP application and librouteros is available on the target system.
Stack y dependencias
Componentes inferidos a partir de manifests, configuración y documentación.
Experiencia real de la comunidad
Ayuda a contrastar la estimación automática con instalaciones reales.
Todavía no hay datos comunitarios para este proyecto.