Remote device management without exposed ports

WireGuard central cloud management dashboard

Wantastic is a WireGuard central cloud management dashboard with secure remote Winbox access to MikroTik routers and OpenWrt devices behind firewalls and Starlink.

Start Managing Devices View Open Source

WireGuard meshMIT open sourceNo port forwarding

Features

WireGuard central cloud management dashboard

Wantastic is a WireGuard central cloud management dashboard with secure remote Winbox access to MikroTik routers and OpenWrt devices behind firewalls and Starlink.

Wantastic consoleConnected

Devices

3 online

Access

Team scoped

Transport

Encrypted

The problems network teams keep duct-taping are now one workflow.

Remote Winbox, WebSSH, WebProxy, monitoring, team access and policy live in one management layer for MikroTik, OpenWrt, Linux, Windows and Android fleets behind CGNAT, LTE, Starlink or locked-down firewalls.

Native RouterOS onboarding, no router package

MikroTik devices join with the WireGuard client already built into RouterOS 7, so field installs stay simple and reversible.

Paste the generated RouterOS script, let the router initiate outbound connectivity, and avoid custom binaries on MikroTik hardware.

RouterOS 7 native WireGuard

A management mesh, not another flat VPN

Each account gets isolated routing and policy so devices are reachable for work, not blindly trusted because someone joined a VPN.

Use P2P paths where possible, relay only when needed, and keep device-to-device communication explicit through topology and ACL rules.

Isolated virtual routing

Winbox access without opening port 8291

Reach MikroTik routers through managed overlay endpoints instead of exposing Winbox to scanners or depending on brittle jump boxes.

Give each technician their own controlled session, rotate managed credentials, audit access, and keep native RoMON workflows available for downstream devices.

Secure Winbox + RoMON

Team access without sharing router secrets

Stop passing around admin passwords, VPN files or permanent jump-server access just to fix a customer site.

Invite teammates, grant only the workflows they need, track sessions, and revoke access centrally without rewriting every router.

Per-user access control

Browser tools for the work after connectivity

Open SSH terminals and internal web UIs from the portal so support work can happen from any trusted browser.

Use WebSSH for shell access, WebProxy for LAN-only HTTP/HTTPS interfaces, and persistent sessions that survive tab changes and multitasking.

WebSSH + WebProxy

Open-source agents and a self-hosted core

WantasticCore is an MIT-licensed self-hosted WireGuard mesh portal, and wantasticd connects Linux, OpenWrt, macOS and Windows devices.

Use the hosted console for speed, or run the open-source core when customers, compliance or lab work require ownership of the control plane.

WantasticCore + wantasticd

From unreachable device to managed endpoint.

Wantastic is built around the real support path: connect the device, isolate it, grant access, then work from the browser.

Connect without inbound firewall holes

Start here

Outbound-first onboarding

Connect RouterOS with native WireGuard, or install wantasticd on OpenWrt and Linux. The device initiates the connection, so CGNAT and dynamic ISP links stop being blockers.

What You Get

No public Winbox port
RouterOS native WireGuard
wantasticd for Linux and OpenWrt
Works behind NAT and CGNAT
Automatable provisioning

Good to Know

RouterOS 7 required for native WireGuard
Internet access required

Place every device in a private management mesh

Policy-aware routing

Devices join an isolated overlay where access is intentional. Technicians reach the device workflows they need without joining a flat private network.

What You Get

Per-tenant virtual routing
Automatic overlay addressing
P2P when possible
Relay fallback when required
No shared router passwords

Good to Know

Some NAT types need relay fallback
Topology policies still need intent

Control sessions, credentials and device-to-device paths

Least-privilege operations

Model groups, links and protocol-level rules from the portal. Give people access to Winbox, SSH or web interfaces without giving them permanent network keys.

What You Get

Granular access policies
Managed Winbox credentials
Team invites and revocation
Protocol-level controls
Audit-ready access history

Good to Know

Policies should mirror operations
Admin approval remains required

Work inside the browser, not inside a VPN client

Winbox, WebSSH, WebProxy, WUSP

Launch Winbox access, persistent WebSSH, LAN-only web interfaces, monitoring and WUSP-style device control from the same console.

What You Get

Remote Winbox workflows
Persistent WebSSH sessions
WebProxy for private UIs
Uptime and reachability views
WUSP device management

Good to Know

Feature limits depend on plan

Transmission protocol

Meet WUSP: USP semantics, WireGuard native.

Wantastic USP over WireGuard carries device-management operations inside the existing encrypted tunnel—without exposing another management socket or building a second trust layer.

Download white paper Read on GitHub

WUSP protocol inspectorTunnel active

Control transmission path

Compact, typed and tunnel-only

USP operations

CRUD, operate, notify

WUSP envelope

Method + correlation ID

Control fragments

MTU-safe binary frames

WireGuard packet

Authenticated encrypted tunnel

GetSetAddDeleteOperateNotifyUploadDownload

Control transport

Noise fragmented datagram

Default payload

1200 bytes

Runtime model

TR-181 Device:2.20

WUSP is a purpose-built private transport for USP semantics in Wantastic. It is not a drop-in standard Broadband Forum USP Message Transfer Protocol.

Open-source edge client

One agent. Every edge. wantasticd.

A lightweight WireGuard mesh daemon for servers, desktops, OpenWrt routers and embedded IoT devices—with WUSP management and a factory-ready QR claim workflow.

Explore wantasticd

Cross-platform by design

One service model across modern operating systems, legacy init systems and embedded Linux.

Built for constrained devices

Headless claiming, BusyBox support and compact binaries make factory provisioning practical.

WUSP management included

Initialize USP-style device management over the same authenticated WireGuard tunnel.

root@factory-device — wantasticd genkey

/ # wantasticd genkey

Reused existing device claim key: /usrdata/wantastic/etc/device-claim-key.json

Public key: 0vNwglyJYpPOgsg9Q/AJgj7ke/48CUhWUXMQuRDG8yQ=

Stable device key

Generate once and preserve it in the manufacturer image.

Customer claim

Scan the printed QR to assign the device securely.

Mesh comes online

Create wantastic0 and establish the WireGuard peer.

Management starts

Load the runtime model and initialize WUSP.

Wantastic agent started successfully — System TUN + WUSP ready

Factory claim label

Print-ready manufacturer artwork

Wantastic ready

Scan to claim this device

ID · 0vNwglyJYpPO…RDG8yQ

WireGuard securedWUSP enabled

The public claim key can be printed. Keep the private claim-key JSON on the device and never place it on the label.

Platforms and device classes

LinuxOpenWrtAlpinemacOSWindowsAndroidIoT / BusyBox

Published architecture targets

amd64arm64arm386mipsmipslemips64riscv64ppc64le

What users are saying

Loved by network engineers worldwide

Field notes from operators solving remote Winbox, CGNAT, OpenWrt and browser-based support workflows.

r/wantastic_app·@wantasticapp

WISP Network Admin

“The real win is not having to expose Winbox or maintain a separate VPN path for every customer site. Devices behind CGNAT are reachable from the console, and the support workflow is much cleaner.”

Mar 2025

K. Solis — Network Consultant

“Remote Winbox over the overlay solved the annoying Starlink and NAT problem for MikroTik support. I can keep native Winbox and RoMON habits without opening ports at the customer edge.”

Feb 2025

Field Network Engineer

“wantasticd makes the Linux and OpenWrt side feel like part of the same management plane. That matters when a site has routers, small servers, and embedded devices on unreliable LTE links.”

Jan 2025

NOC Lead — ISP Operations

“The team access model is the feature I care about most. I can stop handing out shared router credentials and give technicians the exact workflows they need for a device.”

Dec 2024

RouterOS Administrator

“I used to maintain a WireGuard jump server just to reach routers. Wantastic gives me the tunnel, the browser tools, and the device list in one place, which is the part generic VPN tools miss.”

Nov 2024

ISP SysAdmin — Texas

“The P2P-first design is the right architecture for interactive work. When a direct path is possible, Winbox and SSH feel much better than a relay-only remote access stack.”

Oct 2024

MikroTik Fleet Manager

“The free plan was enough to test the real workflow: add a router, connect through Winbox, try WebSSH, and see whether it fits support operations before rolling it wider.”

Sep 2024

Security Researcher

“The open-source direction changed how I looked at the product. WantasticCore and wantasticd make it possible to inspect the architecture instead of trusting a black-box remote access service.”

Aug 2024

WISP Network Admin

Mar 2025

K. Solis — Network Consultant

“Remote Winbox over the overlay solved the annoying Starlink and NAT problem for MikroTik support. I can keep native Winbox and RoMON habits without opening ports at the customer edge.”

Feb 2025

Field Network Engineer

“wantasticd makes the Linux and OpenWrt side feel like part of the same management plane. That matters when a site has routers, small servers, and embedded devices on unreliable LTE links.”

Jan 2025

NOC Lead — ISP Operations

“The team access model is the feature I care about most. I can stop handing out shared router credentials and give technicians the exact workflows they need for a device.”

Dec 2024

RouterOS Administrator

“I used to maintain a WireGuard jump server just to reach routers. Wantastic gives me the tunnel, the browser tools, and the device list in one place, which is the part generic VPN tools miss.”

Nov 2024

ISP SysAdmin — Texas

“The P2P-first design is the right architecture for interactive work. When a direct path is possible, Winbox and SSH feel much better than a relay-only remote access stack.”

Oct 2024

MikroTik Fleet Manager

“The free plan was enough to test the real workflow: add a router, connect through Winbox, try WebSSH, and see whether it fits support operations before rolling it wider.”

Sep 2024

Security Researcher

“The open-source direction changed how I looked at the product. WantasticCore and wantasticd make it possible to inspect the architecture instead of trusting a black-box remote access service.”

Aug 2024

Frequently Asked Questions

Common Questions

Practical answers about remote Winbox, CGNAT, OpenWrt, Linux, Windows, Android, WebSSH and self-hosted WantasticCore.

View all frequently asked questions

Stop building one-off access paths for every site.

Start with hosted Wantastic for speed, or explore the open-source WantasticCore when you need a self-hosted WireGuard mesh and browser management portal.

Free plan for small fleets

Remote Winbox without port forwarding

WebSSH, WebProxy and device onboarding

No credit card required

Start Free Login

What users are saying

Loved by network engineers worldwide

Field notes from operators solving remote Winbox, CGNAT, OpenWrt and browser-based support workflows.

r/wantastic_app·@wantasticapp

WISP Network Admin

Mar 2025

K. Solis — Network Consultant

“Remote Winbox over the overlay solved the annoying Starlink and NAT problem for MikroTik support. I can keep native Winbox and RoMON habits without opening ports at the customer edge.”

Feb 2025

Field Network Engineer

“wantasticd makes the Linux and OpenWrt side feel like part of the same management plane. That matters when a site has routers, small servers, and embedded devices on unreliable LTE links.”

Jan 2025

NOC Lead — ISP Operations

“The team access model is the feature I care about most. I can stop handing out shared router credentials and give technicians the exact workflows they need for a device.”

Dec 2024

RouterOS Administrator

“I used to maintain a WireGuard jump server just to reach routers. Wantastic gives me the tunnel, the browser tools, and the device list in one place, which is the part generic VPN tools miss.”

Nov 2024

ISP SysAdmin — Texas

“The P2P-first design is the right architecture for interactive work. When a direct path is possible, Winbox and SSH feel much better than a relay-only remote access stack.”

Oct 2024

MikroTik Fleet Manager

“The free plan was enough to test the real workflow: add a router, connect through Winbox, try WebSSH, and see whether it fits support operations before rolling it wider.”

Sep 2024

Security Researcher

“The open-source direction changed how I looked at the product. WantasticCore and wantasticd make it possible to inspect the architecture instead of trusting a black-box remote access service.”

Aug 2024

WISP Network Admin

Mar 2025

K. Solis — Network Consultant

“Remote Winbox over the overlay solved the annoying Starlink and NAT problem for MikroTik support. I can keep native Winbox and RoMON habits without opening ports at the customer edge.”

Feb 2025

Field Network Engineer

“wantasticd makes the Linux and OpenWrt side feel like part of the same management plane. That matters when a site has routers, small servers, and embedded devices on unreliable LTE links.”

Jan 2025

NOC Lead — ISP Operations

“The team access model is the feature I care about most. I can stop handing out shared router credentials and give technicians the exact workflows they need for a device.”

Dec 2024

RouterOS Administrator

“I used to maintain a WireGuard jump server just to reach routers. Wantastic gives me the tunnel, the browser tools, and the device list in one place, which is the part generic VPN tools miss.”

Nov 2024

ISP SysAdmin — Texas

“The P2P-first design is the right architecture for interactive work. When a direct path is possible, Winbox and SSH feel much better than a relay-only remote access stack.”

Oct 2024

MikroTik Fleet Manager

“The free plan was enough to test the real workflow: add a router, connect through Winbox, try WebSSH, and see whether it fits support operations before rolling it wider.”

Sep 2024

Security Researcher

“The open-source direction changed how I looked at the product. WantasticCore and wantasticd make it possible to inspect the architecture instead of trusting a black-box remote access service.”

Aug 2024

WireGuard central cloud management dashboard

WireGuard central cloud management dashboard

The problems network teams keep duct-taping are now one workflow.

Native RouterOS onboarding, no router package

A management mesh, not another flat VPN

Winbox access without opening port 8291

Team access without sharing router secrets

Browser tools for the work after connectivity

Open-source agents and a self-hosted core

From unreachable device to managed endpoint.

Connect without inbound firewall holes

What You Get

Good to Know

Place every device in a private management mesh

What You Get

Good to Know

Control sessions, credentials and device-to-device paths

What You Get

Good to Know

Work inside the browser, not inside a VPN client

What You Get

Good to Know

Meet WUSP: USP semantics, WireGuard native.

One agent. Every edge. wantasticd.

Cross-platform by design

Built for constrained devices

WUSP management included

Loved by network engineers worldwide

Common Questions

Do I need a public IP address to use Wantastic?

Do I need to install an agent on my MikroTik router?

Is Wantastic free to use?

How does Winbox remote access work?

Does it work with OpenWrt, Linux, Windows, and Android devices?

What security model does Wantastic use?

Can multiple team members manage devices at the same time?

What is WebSSH and does the session persist?

Stop building one-off access paths for every site.

The problems network teams keep duct-taping are now one workflow.

Native RouterOS onboarding, no router package

A management mesh, not another flat VPN

Winbox access without opening port 8291

Team access without sharing router secrets

Browser tools for the work after connectivity

Open-source agents and a self-hosted core

From unreachable device to managed endpoint.

Connect without inbound firewall holes

What You Get

Good to Know

Place every device in a private management mesh

What You Get

Good to Know

Control sessions, credentials and device-to-device paths

What You Get

Good to Know

Work inside the browser, not inside a VPN client

What You Get

Good to Know

Loved by network engineers worldwide

Common Questions

Do I need a public IP address to use Wantastic?

Do I need to install an agent on my MikroTik router?

Is Wantastic free to use?

How does Winbox remote access work?

Does it work with OpenWrt, Linux, Windows, and Android devices?

What security model does Wantastic use?

Can multiple team members manage devices at the same time?

What is WebSSH and does the session persist?

Stop building one-off access paths for every site.