wireguard_peers
Lists WireGuard VPN peers on MikroTik RouterOS devices, showing endpoints, handshakes, traffic counters, and allowed addresses while hiding private and preshared keys.
Instructions
List WireGuard VPN peers (/interface/wireguard/peers): name, interface, public-key, endpoint-address/endpoint-port, current-endpoint-address/current-endpoint-port, last-handshake, rx/tx byte counters, allowed-address, disabled.
SECURITY: a private-key field never appears in RouterOS's own
/interface/wireguard/peers reply (only /interface/wireguard - the
tunnel interfaces themselves - carries one; see wireguard_interfaces
below), but this strips it defensively anyway, along with any
preshared-key a configured peer may genuinely carry (a real, if
optional, RouterOS field on this menu) - see
formatting.WIREGUARD_SENSITIVE_FIELDS and
test_wireguard_peers_never_exposes_private_key/
test_wireguard_peers_never_exposes_preshared_key.
Returns an empty list (never an error) for a device with no WireGuard package/interfaces at all - same "empty, not an error" convention as wireless_registrations/system_health for optional features.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| device_name | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |