Manage WireGuard Peer
manage_wireguard_peerAdd or remove WireGuard peers on a MikroTik RouterOS interface; use dry-run to preview changes and avoid unintended configuration updates.
Instructions
Add or remove a WireGuard peer. Add returns already_exists when the public key and explicitly requested endpoint/allowed addresses match; different settings produce CONFLICT without changing the peer. Omitted settings are left unchanged.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| dryRun | No | Preview changes without applying. | |
| comment | No | Optional comment | |
| endpoint | No | Add only: IPv4:port, hostname:port or [IPv6]:port (port 1–65535); hostname labels may contain underscores. Address-only IPv4/hostname/IPv6 (bare or bracketed) leaves the RouterOS port default unchanged, which may not allow initiation. Ignored for remove; omit for a roaming peer. | |
| routerId | No | Router ID; omit to use the default router. | |
| interface | Yes | WireGuard interface name (e.g. wg0) | |
| publicKey | Yes | Peer public key in base64 format (44 characters) | |
| allowedAddress | No | Allowed IP address/CIDR for this peer (e.g. 10.0.0.2/32) | |
| confirmationToken | No | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |