Normally the setup is done with Ansible

There are situation where a Aplliance needs to be connected that can not be configured through ansible. This manual is for that situation.

Log in to a Rocky9 server with the wireguard-tools software installed:

dnf install -y wireguard-tools

make a directory in the root home directory for the client with a name you would remember:

sudo -i
mkdir wireguard_appliance1
cd wireguard_appliance1

create a private and public key pair for the appliance:

/bin/wg genkey | tee ./private.key | /bin/wg pubkey > ./public.key

create the config file for the appliance: vi ./wg0.conf and fill it with:

[Interface]
# use the private key created earlier
PrivateKey = 0CncJ5isB6BzgCwVt51q97BIKV6/2gzfSMtpYRyJX2s=
#this should be an available IP in the Microtik router
Address = 192.168.2.4/24
DNS = 8.8.8.8

[Peer]
#Puublic key of the mikrotik router wireguard instance
PublicKey = BB8XXa2ZXPgX7MihsUKrBKLPlZ4hQ7pnksOphRNDvSA=
#allow trafic from other wireguard peers and 2 workstations in the home LAN
AllowedIPs = 192.168.2.0/24, 192.168.1.20, 192.168.1.46
#enter the URL poinbting to the mikrotik router from the internet
Endpoint = external.domain.nl:13231
PersistentKeepalive = 15

log in to the Mikrotik web interface and in the Advanced view select WireGuard in the menu on the left.

On the top choose the button WireGuard and select your configuration entry. Almost at the bottom you find the Public Key you need for the client configuration file you create in the paragraph above.

Then go back and on the top choose the button Peers.
In the list check under the column Allowed Addresses and identify a free IP. Note this for the paragraph above. Notice you use /24 in the wg0.cof and /32 in the Mikrotik configuration in the next step.

Next press +New in the top. fill in the form, you need to press + at Allowed Address the public key is the client public key you created in the previous paragraph.

Press OK

In the appliance you often find an interface where you can enter the keys and configuration. If the interface insists on creating the keys itself, use those for all the steps above, (except the Mikrotik Public Key ofcourse)

Start the client and see.