MikroTik
VPN
Protect every device at home, smart TVs and consoles too, with IPHush on your MikroTik. Load one file and the whole home goes through IPHush, or follow the step-by-step guide. Zero connection logs.
MikroTik VPN at a glance
How to set up IPHush on MikroTik
1 · Before you start
- Check the RouterOS version
"version" must be 7.23 or newer. On RouterOS 6 stop here: it has no WireGuard.
/system resource print
- Save a backup and an export
Then download before-IPHush.backup and before-IPHush.rsc from Files to your computer.
/system backup save name=before-IPHush dont-encrypt=yes /export file=before-IPHush
- Turn on Safe Mode while you work
In the terminal press Ctrl+X (the prompt then shows SAFE); in WinBox click Safe Mode. If you lose the connection to the router while Safe Mode is on, the router undoes the changes. When everything works, press Ctrl+X again to keep them.
2 · Your file
- Make the file for your router
Sign in at iphush.com/app, open Devices, add a Router and choose MikroTik. The app makes IPHush.rsc and iphush-whole-home.rsc for your router and shows this guide with your own values filled in.
3 · Add the tunnel
- Upload the file
Files → Upload (WebFig), or drag IPHush.rsc into the WinBox Files window.
- Load it and delete the copyOr copy the commands from the file box above and paste them into the terminal instead of uploading the file. Do not photograph the terminal: the file holds the router’s private key.
/import file-name=IPHush.rsc verbose=no /file remove IPHush.rsc
- See the handshake
"last-handshake" shows a few seconds. No handshake after a minute: check that the router has internet and that UDP 51900 is not blocked upstream.
/interface wireguard peers print detail where interface=IPHush
4 · Choose who uses it
Or the shortcut: iphush-whole-home.rsc adds the tunnel and sends the whole home through it in one import, with IPv6 blocked so nothing leaks and a fallback if IPHush is down.
One device
Only the device you choose uses IPHush; the router and every other device keep your normal connection. Enter the device’s address above (give it a static lease in IP → DHCP Server → Leases so it keeps it).
- A routing table for IPHush
- Send this device through it (its LAN traffic stays local)
- NAT out of IPHush
- DNS of this device to 10.96.0.1
- TCP MSS for MTU 1280
- IPv6: no leak
The whole network
Every device on your home network uses IPHush, with its DNS; the router itself keeps your normal connection. One file does it all and changes nothing else on the router.
- Get the second file
- Upload it
- Load it and delete the copy
- What changes
- Reconnect devices that were online
5 · Check it works
- The tunnel is up
"last-handshake" under 2 minutes.
/interface wireguard peers print detail where interface=IPHush
- Check from a device
On a device that should use IPHush, open https://whoami.iphush.com/ in a browser. It must show "iphush": true and an IPHush address. A device outside the option you chose shows false: that is expected.
MikroTik VPN: questions
Which MikroTik firmware works with IPHush?
RouterOS 7.23.8 or newer. RouterOS 6 has no WireGuard and is not supported.
Can the whole home go through IPHush on MikroTik?
Every device on your home network uses IPHush, with its DNS; the router itself keeps your normal connection. One file does it all and changes nothing else on the router. Or load iphush-whole-home.rsc: one import does all of it.
Is there a kill switch on MikroTik?
The guide in your account shows the options your router offers.
Which plan includes a router?
Family and Pro each include 1 router, and the router counts as one connection: every device behind it is protected. On Pro it leaves from your dedicated IP.
Has IPHush tested these steps on MikroTik?
Yes. Our network team ran every block of this guide on a real router in our lab.
More routers
Every device at home, one router
Family and Pro include a router and all 57 locations.