Hub-and-Spoke WireGuard VPN Deployment

WireGuard Hub-and-Spoke VPN Expert Needed
Project Goal
Implement a WireGuard VPN hub-and-spoke network connecting a central office with 10-20 branch locations through a cloud VPS.
Critical Requirement: Branch locations have limited mobile data plans. The solution must use branch mobile connections ONLY for VPN tunnel maintenance, while routing ALL user traffic through the central office's internet circuit.

Equipment

Central: MikroTik L009 (RouterOS v7+) with dedicated ISP circuit
Branches: MikroTik hAP ax² (RouterOS v7+) with 4G/5G mobile internet
Hub: AlmaLinux 9.6 VPS

What You'll Deliver

VPS Setup Script (Bash) - WireGuard hub configuration
Central Router Script (RouterOS) - Connect to VPS and route traffic
Branch Router Script (RouterOS) - Connect to VPS, route all traffic through central office
Backup Scripts - Automated backup/restore for all devices
Testing Guide - Commands to verify everything works

All scripts must be copy-paste ready with minimal editing required.

Success Criteria

Branch mobile data used only for tunnel maintenance (~300-400 MB/month)
All branch internet traffic flows through central office
All branches show central office's public IP
Tunnels auto-reconnect after interruptions
Minimal latency increase ( 5ms)

Required Skills

Expert WireGuard configuration

MikroTik RouterOS v7+ proficiency

Linux administration (RHEL-based)

Routing, NAT, and firewall expertise

Experience with hub-and-spoke VPN topologies

Technical Details
You'll configure:

WireGuard on VPS, central router, and branch routers

NAT masquerading on central router

Routing rules to direct all branch traffic through central office

Persistent KeepAlive (optimized for low data usage)

Port 443 UDP (to bypass ISP restrictions)

Firewall rules and IP forwarding

Optimized MTU settings

Please include:
Similar WireGuard projects you've completed

Your MikroTik experience level

How you'll minimize branch data usage

Your estimated timeline

Any questions about the setup