To configure a Linux laptop and MikroTik router as WireGuard exit nodes for multiple clients, you must set up the server endpoints with proper IP forwarding, enable masquerading on the public interface, and ensure the firewall allows forwarded traffic. Clients connect to these servers using specific configuration files that define the allowed IPs and DNS settings.
Prerequisites and Network Planning
Before configuring the hardware, you need a consistent IP scheme for your WireGuard network. It is highly recommended to use a private RFC1918 range that does not conflict with your local LANs. For example, if your home network uses 192.168.1.0/24, choose 10.8.0.0/24 for your VPN clients. This prevents routing loops when clients try to access their local resources through the tunnel.
You will also need static IP addresses or dynamic DNS (DDNS) records for your exit nodes. If your ISP provides dynamic public IPs, services like DynDNS or Cloudflare API can update your domain name automatically. For detailed guidance on managing IP ranges and DDNS, see Setting up Wireguard VPN with a custom IP range and Enabling Home Network Access with WireGuard and FRITZ!Box using DynDNS.
Configuring the Linux Laptop Exit Node
The Linux laptop acts as a standard WireGuard server. First, install the wireguard-tools package. Generate keys using wg genkey | tee server_private.key | wg pubkey > server_public.key. Create a configuration file, typically at /etc/wireguard/wg0.conf.
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
[Peer]
# Client 1
PublicKey = CLIENT_1_PUBLIC_KEY
AllowedIPs = 10.8.0.2/32
The critical components here are the PostUp and PostDown scripts. These commands enable IP forwarding and NAT (masquerading) only while the tunnel is active. Ensure that IP forwarding is enabled in /etc/sysctl.conf by setting net.ipv4.ip_forward=1 and applying it with sysctl -p. Replace eth0 with your actual internet-facing interface name.
Configuring the MikroTik Router Exit Node
MikroTik routers require configuration via WinBox or the CLI. Navigate to IP > Services to open port 51821 (UDP). Then go to Interfaces > Wireguard and add a new interface. Set the mode to static-server, assign the address 10.8.1.1/24, and input your private key.
Create peers under the Wireguard interface section. Each peer needs a unique Public Key, a PreShared Key (optional but recommended for security), and Allowed IPs. For example, allow 10.8.1.2/32 for the first client. To route traffic out through the MikroTik, you must enable NAT. Go to IP > Firewall > NAT and add a rule: Chain srcnat, Out Interface set to your WAN interface (e.g., wan1), and Action set to masquerade. Also, ensure the firewall filter allows forwarding between the wireguard interface and the WAN interface.
Client Configuration and Testing
Each client device (phone, tablet, secondary PC) needs its own WireGuard configuration. The client config mirrors the server setup but with roles reversed. The client’s PrivateKey matches the server’s PublicKey entry. Crucially, the AllowedIPs field on the client must be set to 0.0.0.0/0 (or ::/0 for IPv6) to route all internet traffic through the tunnel. If you only want specific traffic, specify those subnets instead.
Test the connection by pinging the server’s VPN IP (10.8.0.1 or 10.8.1.1). Then, verify external IP by visiting an IP lookup site. If the site shows your exit node’s public IP, the setup is successful. For troubleshooting port forwarding issues, refer to How to Forward a Port Outside a VPN Network.
Troubleshooting Common Issues
If clients cannot connect, check the firewall on both the Linux host and MikroTik router. On Linux, ensure ufw or firewalld allows UDP port 51820. On MikroTik, verify the firewall filter chain permits input from the wireguard interface. Another common issue is split tunneling misconfiguration. If clients can ping the server but have no internet, the NAT/masquerade rules are likely missing or incorrect. Ensure the post-up script on Linux targets the correct outgoing interface.
Frequently Asked Questions
Can I use the same WireGuard server for both LAN access and internet exit?
Yes, but you must carefully manage AllowedIPs. Set AllowedIPs to 10.8.0.0/24 for LAN access only, or 0.0.0.0/0 for full internet exit. Mixing them requires advanced routing rules to prevent leaking local traffic to the public internet.
Why is my Ping working but I have no Internet access?
This indicates that the tunnel is established but NAT is not functioning. Verify that masquerading is correctly configured on the WAN interface of your exit node. On Linux, check the PostUp script; on MikroTik, ensure the srcnat rule is active.
How do I add a new client without disrupting existing ones?
Generate a new key pair for the new client. Add a new [Peer] section in the server configuration file with the new public key and a unique AllowedIP. Restart the WireGuard service on the server and import the new config on the client device.
Is it safe to expose WireGuard ports to the internet?
WireGuard uses strong cryptography, so exposing the port is generally safe if you use pre-shared keys and valid client certificates. However, consider using fail2ban or similar tools to block brute-force attempts if you are running many clients.
What happens if my Linux laptop goes to sleep?
Most Linux distributions suspend network interfaces during sleep, which breaks the WireGuard tunnel. You may need to disable suspend for the network interface or use systemd sleep hooks to keep the interface up, though this drains battery significantly.