MikroTik router
Updated October 24, 2026
Beta: this way of connecting is not checked on real devices yet. If it does not work, write to support — we will help and fix the guide.
The router connects over WireGuard and counts as one device of your plan. You set it up once; later you change the country for the whole home from your account, without touching the router. You need RouterOS 7.
Get the files
- Sign in to your Tayra account, open Devices and choose Connect a device.
- Choose Router (beta), the firmware MikroTik and the Entry country (or leave Chosen by the service).
- Tap Create the config and download both files: the RouterOS script
.rscand the.conffile. They have the private key of the router and are shown only once.
Import the script
Upload the .rsc file in Files, then run in the terminal (put the name of your file instead of vpn-router-N.rsc):
/import file-name=vpn-router-N.rsc
Traffic of the bridge interface goes through the VPN. The script adds NAT and MSS clamping and takes VPN connections out of FastTrack. You can run it again safely: it replaces the previous VPN settings.
Leak protection
- The home network (
bridge) reaches the internet only through the tunnel. If the tunnel does not work or is turned off, home devices have no internet: they do not go out directly through your provider. - IPv6 is not carried through the tunnel yet, so IPv6 from the home network is rejected. With working IPv6 from your provider, devices fall back to IPv4 through the VPN.
- DNS queries of home devices to the router go to the VPN DNS through the tunnel, not to the DNS of your provider.
- Only the router itself works directly through your provider: it connects to the entry server and looks up its address.
Connections opened before the import keep their path until they close. To remove the VPN and give the home network direct internet again, run the lines of the script with remove (at the start of the file) in the terminal, then set your DNS servers again: /ip dns set servers=….
Good to know
- The exit place of the router is changed in your account, in Places: the router keeps its config.
- If the entry server is not available, the router has no VPN until the server is back or you import a new script (New key and config in Devices).