← All guides

MikroTik guide

This guide sets up your fixed IP on a MikroTik router running RouterOS 7. Your router builds two tunnels, one to each PoP, and fails over automatically if one of them drops. Only the traffic of your fixed IP runs through the tunnels; all other traffic keeps going directly over your own internet connection.

The fixed IP arrives on the router, which forwards it to a device on your network (for example a NAS or server at LAN_HOST). Do you have several addresses (a subnet)? Then also read the Multiple addresses section at the bottom.

Paste all commands into Terminal (WinBox or WebFig → New Terminal). Every line gets the label fixedip.be, so you can find or remove everything in one go later.

1. Two WireGuard tunnels

One tunnel to each PoP, with the same key:

/interface/wireguard/add name=wg-fixedip-1 listen-port=13241 mtu=1420 private-key="PRIVATE_KEY" comment="fixedip.be"
/interface/wireguard/add name=wg-fixedip-2 listen-port=13242 mtu=1420 private-key="PRIVATE_KEY" comment="fixedip.be"

/interface/wireguard/peers/add interface=wg-fixedip-1 public-key="SERVER_PUBLIC_KEY_1" \
    endpoint-address=ENDPOINT_1 endpoint-port=PORT allowed-address=0.0.0.0/0,::/0 \
    persistent-keepalive=25s comment="fixedip.be"
/interface/wireguard/peers/add interface=wg-fixedip-2 public-key="SERVER_PUBLIC_KEY_2" \
    endpoint-address=ENDPOINT_2 endpoint-port=PORT allowed-address=0.0.0.0/0,::/0 \
    persistent-keepalive=25s comment="fixedip.be"

/ip/address/add address=TUNNEL_IP_1/32 network=SERVER_TUNNEL_IP_1 interface=wg-fixedip-1 comment="fixedip.be"
/ip/address/add address=TUNNEL_IP_2/32 network=SERVER_TUNNEL_IP_2 interface=wg-fixedip-2 comment="fixedip.be"

allowed-address=0.0.0.0/0 only means the tunnels may carry traffic to any address. RouterOS does not create a route for it by itself, so your regular internet traffic stays where it was.

Do not add the tunnels to the WAN interface list. Otherwise the default masquerade rule will also apply to the tunnels.

2. Your fixed IP on the router

The fixed IP goes on a separate, empty bridge. That way it is not tied to either tunnel and stays in place whichever tunnel is active.

/interface/bridge/add name=lo-fixedip comment="fixedip.be"
/ip/address/add address=FIXED_IP/32 interface=lo-fixedip comment="fixedip.be"

3. Routing with automatic failover

Three routing tables:

• fixedip: for traffic that leaves from your fixed IP. PoP 1 is preferred; if it drops (the router pings the tunnel address on our side), PoP 2 takes over.
• fixedip-1 and fixedip-2: replies always go back through the tunnel the connection came in on.

/routing/table/add name=fixedip fib comment="fixedip.be"
/routing/table/add name=fixedip-1 fib comment="fixedip.be"
/routing/table/add name=fixedip-2 fib comment="fixedip.be"

/ip/route/add dst-address=0.0.0.0/0 gateway=SERVER_TUNNEL_IP_1 routing-table=fixedip distance=1 \
    check-gateway=ping comment="fixedip.be"
/ip/route/add dst-address=0.0.0.0/0 gateway=SERVER_TUNNEL_IP_2 routing-table=fixedip distance=2 \
    check-gateway=ping comment="fixedip.be"
/ip/route/add dst-address=0.0.0.0/0 gateway=wg-fixedip-1 routing-table=fixedip-1 comment="fixedip.be"
/ip/route/add dst-address=0.0.0.0/0 gateway=wg-fixedip-2 routing-table=fixedip-2 comment="fixedip.be"

Mark the connections that come in through a tunnel, and send their replies back through that same tunnel:

/ip/firewall/mangle/add chain=prerouting in-interface=wg-fixedip-1 connection-state=new \
    action=mark-connection new-connection-mark=fixedip-1 passthrough=yes comment="fixedip.be"
/ip/firewall/mangle/add chain=prerouting in-interface=wg-fixedip-2 connection-state=new \
    action=mark-connection new-connection-mark=fixedip-2 passthrough=yes comment="fixedip.be"
/ip/firewall/mangle/add chain=prerouting in-interface-list=LAN connection-mark=fixedip-1 \
    action=mark-routing new-routing-mark=fixedip-1 passthrough=no comment="fixedip.be"
/ip/firewall/mangle/add chain=prerouting in-interface-list=LAN connection-mark=fixedip-2 \
    action=mark-routing new-routing-mark=fixedip-2 passthrough=no comment="fixedip.be"
/ip/firewall/mangle/add chain=output connection-mark=fixedip-1 \
    action=mark-routing new-routing-mark=fixedip-1 passthrough=no comment="fixedip.be"
/ip/firewall/mangle/add chain=output connection-mark=fixedip-2 \
    action=mark-routing new-routing-mark=fixedip-2 passthrough=no comment="fixedip.be"

Finally, the rules that decide which table is used. The order matters: first the marks, then your fixed IP.

/routing/rule/add routing-mark=fixedip-1 action=lookup-only-in-table table=fixedip-1 comment="fixedip.be"
/routing/rule/add routing-mark=fixedip-2 action=lookup-only-in-table table=fixedip-2 comment="fixedip.be"
/routing/rule/add src-address=FIXED_IP/32 action=lookup-only-in-table table=fixedip comment="fixedip.be"

FastTrack skips the mangle rules. So exclude the marked connections from FastTrack:

/ip/firewall/filter/set [find action=fasttrack-connection] connection-mark=no-mark

4. Forwarding to your server

Forward a single port (HTTPS here):

/ip/firewall/nat/add chain=dstnat dst-address=FIXED_IP protocol=tcp dst-port=443 \
    action=dst-nat to-addresses=LAN_HOST comment="fixedip.be"

Or forward all ports to the same device (1-to-1):

/ip/firewall/nat/add chain=dstnat dst-address=FIXED_IP action=dst-nat to-addresses=LAN_HOST comment="fixedip.be"

Only let the router pass traffic from the tunnels that you have forwarded yourself, and put these rules at the top:

/ip/firewall/filter/add chain=forward in-interface=wg-fixedip-1 connection-nat-state=!dstnat \
    action=drop comment="fixedip.be" place-before=0
/ip/firewall/filter/add chain=forward in-interface=wg-fixedip-2 connection-nat-state=!dstnat \
    action=drop comment="fixedip.be" place-before=0

The default RouterOS input rules allow nothing from outside the LAN, so the router itself is not reachable on your fixed IP.

RouterOS's default input rules allow ping. Keep it that way: our tunnel servers ping TUNNEL_IP_1 and TUNNEL_IP_2 to know which tunnel works. Without a reply, we don't send your fixed IP to that tunnel.

5. Outgoing traffic from your fixed IP too (optional)

Do you want your server to also go out to the internet with your fixed IP (for example for whitelisting with a supplier)?

/routing/rule/add src-address=LAN_HOST/32 action=lookup-only-in-table table=fixedip comment="fixedip.be"
/ip/firewall/nat/add chain=srcnat src-address=LAN_HOST out-interface=wg-fixedip-1 \
    action=src-nat to-addresses=FIXED_IP comment="fixedip.be"
/ip/firewall/nat/add chain=srcnat src-address=LAN_HOST out-interface=wg-fixedip-2 \
    action=src-nat to-addresses=FIXED_IP comment="fixedip.be"

All internet traffic from LAN_HOST then runs over your fixed IP, and fails over along with it if PoP 1 drops. The other devices on your network notice nothing.

6. IPv6

Your IPv6 subnet is routed to both tunnels. Give the tunnels their IPv6 tunnel address, put a /64 on your LAN bridge (IPV6_LAN) and send the traffic from your subnet through the tunnels, with the same failover:

/ipv6/address/add address=TUNNEL_IP6_1/128 interface=wg-fixedip-1 advertise=no comment="fixedip.be"
/ipv6/address/add address=TUNNEL_IP6_2/128 interface=wg-fixedip-2 advertise=no comment="fixedip.be"
/ipv6/address/add address=IPV6_LAN::1/64 interface=bridge advertise=yes comment="fixedip.be"
/ipv6/route/add dst-address=::/0 gateway=SERVER_TUNNEL_IP6_1%wg-fixedip-1 routing-table=fixedip \
    distance=1 check-gateway=ping comment="fixedip.be"
/ipv6/route/add dst-address=::/0 gateway=SERVER_TUNNEL_IP6_2%wg-fixedip-2 routing-table=fixedip \
    distance=2 check-gateway=ping comment="fixedip.be"
/routing/rule/add src-address=IPV6_PREFIX action=lookup-only-in-table table=fixedip comment="fixedip.be"

The default IPv6 firewall allows no incoming traffic to your LAN. Open up what you want to reach, per device, for example:

/ipv6/firewall/filter/add chain=forward in-interface=wg-fixedip-1 dst-address=IPV6_LAN::10/128 \
    protocol=tcp dst-port=443 action=accept comment="fixedip.be" place-before=0
/ipv6/firewall/filter/add chain=forward in-interface=wg-fixedip-2 dst-address=IPV6_LAN::10/128 \
    protocol=tcp dst-port=443 action=accept comment="fixedip.be" place-before=0

Multiple addresses

Have you been given a subnet (FIXED_SUBNET)? Then you can use it in two ways:

• Through your router (all addresses usable): put each address as a /32 on lo-fixedip as in step 2, and forward each address with its own dst-nat rule to a different device, as in step 4. Add the rule from step 3 for the whole subnet (src-address=FIXED_SUBNET).
• Directly on your network: put the subnet on its own bridge or VLAN, so your public devices are kept apart from your home network. The first usable address goes to the router; the network and broadcast addresses are lost.

/ip/address/add address=FIRST_USABLE/PREFIX_LENGTH interface=bridge-public comment="fixedip.be"
/routing/rule/add src-address=FIXED_SUBNET action=lookup-only-in-table table=fixedip comment="fixedip.be"

With the second approach you need no NAT: the devices use their public address directly. Protect them with their own forward rules.

Checking

/interface/wireguard/peers/print detail where comment="fixedip.be"
/ip/route/print where routing-table=fixedip
/ping 9.9.9.9 src-address=FIXED_IP count=3

Both peers should show a recent last-handshake, and in the fixedip table the route via PoP 1 is active. Then test from outside, for example with your phone on mobile data: https://FIXED_IP should end up at your server.

Testing failover: briefly disable wg-fixedip-1 (/interface/wireguard/disable wg-fixedip-1). Within half a minute the route via PoP 2 takes over and your fixed IP stays reachable. Then enable the tunnel again.

Rolling back

/ip/firewall/filter/remove [find comment="fixedip.be"]
/ip/firewall/nat/remove [find comment="fixedip.be"]
/ip/firewall/mangle/remove [find comment="fixedip.be"]
/ipv6/firewall/filter/remove [find comment="fixedip.be"]
/routing/rule/remove [find comment="fixedip.be"]
/ip/route/remove [find comment="fixedip.be"]
/ipv6/route/remove [find comment="fixedip.be"]
/routing/table/remove [find comment="fixedip.be"]
/ip/address/remove [find comment="fixedip.be"]
/ipv6/address/remove [find comment="fixedip.be"]
/interface/wireguard/peers/remove [find comment="fixedip.be"]
/interface/wireguard/remove [find comment="fixedip.be"]
/interface/bridge/remove [find comment="fixedip.be"]

Then restore FastTrack to how it was: /ip/firewall/filter/set [find action=fasttrack-connection] !connection-mark.

Problems?

• No handshake: check ENDPOINT_1/ENDPOINT_2, PORT and the keys. Allow outgoing UDP traffic to PORT if you have an extra firewall in front of your router.
• Both routes in fixedip unreachable: the router gets no reply to its ping to SERVER_TUNNEL_IP_1 and SERVER_TUNNEL_IP_2. Check whether there is a handshake and whether the network= part of the tunnel addresses is correct.
• Handshake OK, but pages do not load or hang: lower the MTU to 1360 on both tunnels. On 4G/5G and some fibre or Starlink connections, 1420 is too much.
• Nothing reachable from outside: check that the FastTrack rule has connection-mark=no-mark and that the dst-nat rule is counting packets (/ip/firewall/nat/print stats).

Stuck? E-mail us at info@fixedip.be