blog.masoko.net

Setting Up WireGuard VPN on MikroTik (Multi-Platform Remote Access Guide)

Thu, 25 Jun 2026 00:00:00 +0000

Remote access is a cornerstone of any robust home lab or small business network. While there are many VPN flavors out there, WireGuard has quickly become the gold standard due to its incredible speed, lightweight footprint, and cryptographic security.

If you run a MikroTik router (RouterOS v7+), you have a powerful enterprise-grade WireGuard server sitting right in your living room. In this article, we’ll walk through setting up WireGuard on your MikroTik router and configuring clients for both Android and Windows 11.

Why WireGuard on MikroTik?

Kernel-Level Speed: Unlike OpenVPN, which can bottleneck weaker router CPUs, WireGuard runs directly in the RouterOS kernel, maximizing your throughput.
Silence is Golden: WireGuard does not respond to unauthenticated packets. To a port scanner on the internet, your VPN port looks completely closed.
Roaming Support: If your phone switches from Wi-Fi to 4G/5G, the WireGuard connection transitions instantly without dropping your session.

Phase 1: Configuring the MikroTik Server

Every WireGuard topology relies on a public/private key exchange. Think of it this way: your router and your phone will each generate their own unique key pair, and then they will swap public keys to trust one another.

1. Create the WireGuard Interface

Open Winbox and navigate to WireGuard from the left menu. Click the + (Add) button.

Name: wireguard1
Listen Port: 13231 (Default)

Click Apply. RouterOS will instantly generate your unique Private Key and Public Key. Copy the Public Key somewhere safe; you will need it for the clients.

2. Assign an IP Subnet to the VPN

Go to IP -> Addresses -> + (Add). We need a dedicated internal subnet for our VPN clients.

Address: 10.0.0.1/24
Network: 10.0.0.0
Interface: wireguard1

3. Open the Firewall Port

Go to IP -> Firewall -> Filter Rules -> + (Add). WireGuard uses UDP, so we must allow incoming traffic on our listening port.

Chain: input
Protocol: udp
Dst. Port: 13231
Action: accept

Crucial: Drag this rule to the very top of your Firewall input list so the traffic isn’t dropped by default drop rules.

Phase 2: Connecting an Android Device

On mobile devices, configuration is a breeze thanks to visual key exchanges.

Download the official WireGuard app from the Google Play Store.
Tap the blue + (Plus) icon and select Create from scratch.
Under the Interface section, give it a name (e.g., HomeVPN). You will see a pre-generated Public key. Copy this key—you need to add it to MikroTik.
Fill in the Interface details:
- Addresses: 10.0.0.2/24 (This is your phone’s fixed VPN IP).
- DNS Servers: 192.168.88.1 (Your MikroTik’s local IP).
Tap Add Peer at the bottom:
- Public Key: Paste the MikroTik’s Public Key here.
- Endpoint: Your public home IP address or MikroTik DDNS, followed by the port (e.g., yourhome.sn.mynetname.net:13231).
- Allowed IPs: 0.0.0.0/0 (Redirects all mobile internet traffic securely through your home) OR 192.168.88.0/24 (Only routes traffic intended for home lab devices).
Back on MikroTik: Go to the Peers tab -> +. Select wireguard1, paste your Phone’s Public Key, and set Allowed Address to 10.0.0.2/32.
Save both sides, toggle the switch on your phone, and you are connected!

Phase 3: Connecting a Windows 11 PC

Since you can’t easily scan QR codes on a desktop, Windows configuration is done via a simple text configuration file (.conf).

Download and install WireGuard for Windows from wireguard.com.
Click the arrow next to Add Tunnel and choose Add empty tunnel….
A window will pop up showing a fresh Public Key. Copy this key and register it in MikroTik -> Peers with the IP 10.0.0.3/32.
Overwrite the text box in the Windows client with the following blueprint configuration:

[Interface]
PrivateKey = [YOUR_WINDOWS_PRIVATE_KEY_DO_NOT_TOUCH]
Address = 10.0.0.3/24
DNS = 192.168.88.1

[Peer]
PublicKey = [PASTE_YOUR_MIKROTIK_PUBLIC_KEY_HERE]
Endpoint = [YOUR_PUBLIC_IP_OR_DDNS]:13231
AllowedIPs = 192.168.88.0/24
PersistentKeepalive = 25

Pro-Tip: Split Tunneling vs. Full Tunneling on Windows

For desktops and laptops, it is usually best to use Split Tunneling by setting AllowedIPs = 192.168.88.0/24. This means your regular PC gaming, web surfing, and video streaming happen over your local network, while only requests destined for your home lab servers get routed through the VPN tunnel.

The PersistentKeepalive = 25 line ensures that your PC sends a tiny blank packet every 25 seconds, preventing aggressive cellular or public Wi-Fi firewalls from closing your idle connection.

Troubleshooting: Why am I getting 0 B Received?

If your client says “Active” but the Transfer: Received counter sits stubbornly at 0 B, your tunnel is failing its cryptographic handshake. Check these three things:

Key Swap Mishap: Double-check that you didn’t accidentally paste the router’s key into the router’s peer settings. The router must hold the client’s key, and the client must hold the router’s key.
IP Subnet Mismatch: Ensure the client IP (e.g., 10.0.0.3) matches the specific /32 allowed address you assigned to that peer inside MikroTik.
CGNAT / Dynamic IP: If your ISP hides your router behind a CGNAT (Carrier-Grade NAT), a direct WireGuard handshake won’t work without a middleman server. Use MikroTik’s built-in Cloud DDNS (/ip/cloud) to track dynamic IPs effortlessly.

Wrap Up

Once implemented, WireGuard provides a seamless, “always-on” feel. You can map network drives, access your Home Assistant dashboards, or SSH into your Linux hosts from anywhere in the world, knowing your perimeter remains completely secure.

Squeezelite Service Not Mixing with Browser Audio (PipeWire/PulseAudio Fix)

Sun, 12 Oct 2025 00:00:00 +0000

The Squeezelite audio player is a wonderful headless solution, but getting it to run as a reliable, shareable background service on modern Linux distributions (like Ubuntu, Debian, or Fedora, especially those using PipeWire) can be a nightmare.

This post documents a common, frustrating error and the simple fix that allows Squeezelite to play music alongside other applications, like your browser (YouTube, Spotify Web, etc.).

The Problem: The Audio “Host is Down” Loop

When setting up Squeezelite as a persistent systemd service (often running as a low-privilege user like daemon or squeezelite), the service either failed to start or immediately grabbed the sound card exclusively.

The Error Message

The core issue was demonstrated by this error log, which repeats when using devices like default or pulse:

[16:04:06.843393] test_open:281 playback open error: Host is down
[16:04:06.843416] output_init_common:401 unable to open output device: default

Why This Happens

Exclusive Access: When running Squeezelite with a raw hardware device (-o hw:CARD=PCH,DEV=0), the application takes exclusive control of the sound card, blocking the browser.
Environment Conflict: When attempting to use the mixing devices (-o default or -o pulse), the service fails. This is because System Services run in a minimal environment and cannot reliably connect to the User Session PipeWire/PulseAudio server that manages all desktop audio (including your browser). It’s a fundamental conflict between a system process and a user-level audio mixer. The “Host is down” error simply means the connection to the mixer server was refused or the socket was not found.

✅ The Easy Fix: Switch to a User Autostart Application

The solution is to stop treating Squeezelite as a low-level “system” component and instead run it as a normal “user” application that starts after your graphical session (and PipeWire) is fully loaded. This is the only way to guarantee it connects to the active audio mixer.

This method uses a standard Desktop Entry (.desktop) file, which works on most Linux desktop environments (GNOME, KDE, XFCE, Cinnamon, etc.).

Step 1: Disable the Broken System Service

Stop and permanently disable the old service file to prevent conflicts.

# Stop the running service:
sudo systemctl stop squeezelite.service

# Disable the service so it doesn't try to start on the next reboot:
sudo systemctl disable squeezelite.service

Step 2: Create the Autostart File

We create a configuration file that tells your desktop environment to launch Squeezelite with the correct, shareable device name when you log in.

Create the directory (if needed):
```
mkdir -p ~/.config/autostart
```
Create the autostart file (squeezelite.desktop):
```
nano ~/.config/autostart/squeezelite.desktop
```

Paste and save this content:

[Desktop Entry]
Name=Squeezelite Player
Comment=Starts Squeezelite audio player on user login
# Key Fix: Use the 'pipewire' audio output device
Exec=/usr/bin/squeezelite -n mini-pc -o pipewire
Terminal=false
Type=Application
X-GNOME-Autostart-enabled=true

If pipewire doesn’t work, try -o default or -o pulse here, as the autostart environment is much more forgiving than the system service environment.

Step 3: Log In and Enjoy Simultaneous Audio

Log out of your desktop session.
Log back in.

Squeezelite will now start automatically in the background as your user, correctly connecting to the PipeWire mixing server. You can now stream music to Squeezelite while simultaneously watching a YouTube video or listening to other audio in your browser!

How I like my Ubuntu

Fri, 10 Oct 2025 00:00:00 +0000

Widgets and Apps I install immediately after Ubuntu

Extentions:

Dash to Panel - https://extensions.gnome.org/extension/1160/dash-to-panel/

Desktop Widgets (Desktop Clock) - https://extensions.gnome.org/extension/5156/desktop-clock/

ArcMenu - https://extensions.gnome.org/extension/3628/arcmenu/

Apps:

Variety - Desktop wallpaper downloader and changer

sudo apt install variety

AppImageLauncher - https://github.com/TheAssassin/AppImageLauncher

Rename bluetooth device in Ubuntu

Tue, 18 Oct 2022 00:00:00 +0000

Use bt-device (part of the bluez-tools package).

sudo apt install bt-device

Get a list of paired devices:

bt-device -l

To set the new alias:

bt-device --set macaddress|name Alias "New Name"

ie:

bt-device --set S530 Alias "S530 Blue"

Set git origin to remember credentials

Tue, 08 Feb 2022 00:00:00 +0000

Set in your .bashrc or .zshrc file:

export username="git-hub-token"

Then run the command below to save your credentials

git remote set-url origin https://username:$username@github.com/username/repo-name.git

How to mount Samba share on boot

Tue, 08 Feb 2022 00:00:00 +0000

To mount a samba share when Ubuntu boots you need to add a line to your /etc/fstab file. You’ll have to update the path to your samba share, local mount folder and your samba credentials.

//remote/path/to/samba/share /local/mount/folder cifs username=your-user-name-here,password=your-password-here,rw,file_mode=0777,dir_mode=0777       0       0

After you update your fstab file you need to mount the newly added record, you can do that with the mount command below

mount -a

Useful CLI tools

Wed, 01 Dec 2021 00:00:00 +0000

Github repos for some usefull CLI tools

fd

https://github.com/sharkdp/fd/
fd is a program to find entries in your filesystem. It is a simple, fast and user-friendly alternative to find. While it does not aim to support all of find’s powerful functionality, it provides sensible (opinionated) defaults for a majority of use cases.

sudo apt install fd-find

Note that the binary is called fdfind as the binary name fd is already used by another package. It is recommended that after installation, you add a link to fd by executing command ln -s $(which fdfind) ~/.local/bin/fd ***

jq

https://github.com/stedolan/jq
jq is like sed for JSON data - you can use it to slice and filter and map and transform structured data with the same ease that sed, awk, grep and friends let you play with text.

sudo apt install jq

bat

https://github.com/sharkdp/bat
bat supports syntax highlighting for a large number of programming and markup languages.

bat communicates with git to show modifications with respect to the index (see left side bar):

sudo apt install bat

Important: If you install bat this way, please note that the executable may be installed as batcat instead of bat (due to a name clash with another package). You can set up a bat -> batcat symlink or alias to prevent any issues that may come up because of this and to be consistent with other distributions:

mkdir -p ~/.local/bin
ln -s /usr/bin/batcat ~/.local/bin/bat

fff

https://github.com/dylanaraps/fff
A simple file manager written in bash.

git clone https://github.com/dylanaraps/fff
cd fff
make install

CD on Exit:
To enable CD on Exit in Bash or Zsh, add this to your .bashrc, .zshrc or equivalent.
Run ‘fff’ with ‘f’ or whatever you decide to name the function.

f() {
fff "$@"
cd "$(cat "${XDG_CACHE_HOME:=${HOME}/.cache}/fff/.fff_d")"
}

duf

https://github.com/muesli/duf
Disk Usage/Free Utility (Linux, BSD, macOS & Windows)

sudo apt install duf

exa

https://github.com/ogham/exa
exa is a modern replacement for the venerable file-listing command-line program ls that ships with Unix and Linux operating systems, giving it more features and better defaults. It uses colours to distinguish file types and metadata. It knows about symlinks, extended attributes, and Git. And it’s small, fast, and just one single binary.

By deliberately making some decisions differently, exa attempts to be a more featureful, more user-friendly version of ls.

sudo apt install exa

ohmyzsh

https://github.com/ohmyzsh/ohmyzsh/

Oh My Zsh is an open source, community-driven framework for managing your zsh configuration.

sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"

Before using ohmyzsh you need to make sure that zsh is installed:
zsh installation instructions

sudo apt install zsh

Plugins for ohmyzsh:

plugins=(git macos common-aliases dirhistory zsh-autosuggestions zsh-syntax-highlighting)

All of these plugins come with ohmyzsh and they only need to be included in ~/.zshrc except zsh-syntax-highlighting and zsh-autosuggestions, which needs to be installed additionally with the commands below:

git clone https://github.com/zsh-users/zsh-syntax-highlighting.git ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-syntax-highlighting
git clone https://github.com/zsh-users/zsh-autosuggestions ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-autosuggestions

ohmyzsh themes I use:

ZSH_THEME="gallois"  
ZSH_THEME="af-magic"  

btop

https://github.com/aristocratos/btop

Resource monitor that shows usage and stats for processor, memory, disks, network and processes.

snap install btop

HTTPie

https://github.com/httpie/httpie

HTTPie is a command-line HTTP client. Its goal is to make CLI interaction with web services as human-friendly as possible. HTTPie is designed for testing, debugging, and generally interacting with APIs & HTTP servers. The http & https commands allow for creating and sending arbitrary HTTP requests. They use simple and natural syntax and provide formatted and colorized output.

sudo apt install httpie

Ubuntu Customizations CLI

Mon, 04 Oct 2021 00:00:00 +0000

How do I enable ‘minimize on click’ on Ubuntu dock

Open Terminal and run

gsettings set org.gnome.shell.extensions.dash-to-dock click-action 'minimize'

To revert to the default option, simply run

gsettings reset org.gnome.shell.extensions.dash-to-dock click-action

How to make dock background 80% transparent in Ubuntu

First enable custom colors:

gsettings set org.gnome.shell.extensions.dash-to-dock transparency-mode 'FIXED'

Then, to set transparency to 80%, issue the command

gsettings set org.gnome.shell.extensions.dash-to-dock background-opacity 0.2

Change 0.0 to any number between 0 and 1.

To reset to the default setting:

gsettings reset org.gnome.shell.extensions.dash-to-dock background-opacity

Make file manager always show full path (not only with ctrl + l)

gsettings set org.gnome.nautilus.preferences always-use-location-entry true

Create a wallpaper slideshow using bash script and cron

Save this script as a bash file, update the DIR variable to point to your photo collection and schedule it with a cronjob.

#!/usr/bin/env bash

# Update the DIR variable to point to your photos

DIR="/home/masoko/Pictures/wallpapers/reddit"
PIC=$(ls $DIR/* | shuf -n1)

RUID=$(who | awk 'FNR == 1 {print $1}')
RUSER_UID=$(id -u ${RUID})
sudo -u ${RUID} DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/${RUSER_UID}/bus" gsettings set org.gnome.desktop.background picture-uri "file://$PIC"
exit

How to ssh using a certificate (not password)

Thu, 15 Apr 2021 00:00:00 +0000

Generate the certificate on the machine you are going to login from:
```
ssh-keygen
```
Check the certificate to make sure it was generated properly:
```
cat ~/.ssh/id_rsa.pub
```
Copy the certificate to the remote machine:
```
ssh-copy-id user@host
```
When you execute ssh-copy-id you’ll be asked for the password of the remote host.

How to Install Mosquitto Broker on Raspberry Pi

Mon, 12 Apr 2021 00:00:00 +0000

How to Install Mosquitto Broker on Raspberry Pi

Install the mosquitto broker with the command below:

sudo apt install -y mosquitto mosquitto-clients

Create a password file (you’ll be promted to enter the password).

mosquitto_passwd -c passwordfile user

move the password file to /etc/mosquitto

sudo mv passwordfile /etc/mosquitto/

Update mosquitto broker config so it uses the created password file.

Create a custom config file in /etc/mosquitto/conf.d

sudo nano /etc/mosquitto/conf.d/config.cfg

Here is the configuration I am using and it works fine with Home Assistant:

user mosquitto
max_queued_messages 200
listener 1883 0.0.0.0
allow_zero_length_clientid true
allow_duplicate_messages false 
autosave_interval 900
autosave_on_changes false
persistence true
persistence_file mosquitto.db
allow_anonymous false
password_file /etc/mosquitto/passwordfile

Here is how to check mosquitto logs.

sudo cat /var/log/mosquitto/mosquitto.log