add_wireguard_peer
Add a WireGuard peer to an existing RouterOS tunnel interface using its public key and allowed addresses, previewing the change before confirming.
Instructions
Add a WireGuard peer (/interface/wireguard/peers add) to an
existing tunnel interface.
public_key is the REMOTE peer's own public key (base64, 44 chars).
allowed_address is a comma-separated list of CIDR ranges routed
through this peer (e.g. "10.0.0.2/32,10.0.0.3/32").
endpoint_address/endpoint_port (the peer's reachable
address/port, if any) and persistent_keepalive (a RouterOS
duration, e.g. "25s") are optional.
Does NOT accept a private-key or preshared-key parameter - the remote peer's own private key, and any preshared key, are entirely out of this tool's scope.
interface must already exist - create it first with
add_wireguard_interface; errors clearly if it doesn't. Refuses to
add a duplicate peer (same public_key already registered on the
same interface) - never creates a duplicate.
WRITE tool, guarded: blocked entirely unless the server is running with MIKROTIK_ALLOW_WRITE=true. Call with confirm=False (the default) to preview without changing anything; call again with confirm=True to actually add it.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| comment | No | ||
| confirm | No | ||
| interface | Yes | ||
| public_key | Yes | ||
| device_name | Yes | ||
| endpoint_port | No | ||
| allowed_address | Yes | ||
| endpoint_address | No | ||
| persistent_keepalive | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||