I have a user that will use a residential StarLink on location, and that thing is behind a CGNAT.

How to punch through to make a WireGuard work for remote access / admin?

BTH function is done exactly for such cases.

Thank you very much!

But don't do it in prod.

It's only for HO.

But don't do it in prod.

It's only for HO.

Why? It is WireGuard, with specific client in. Should be quite safe. Or? What am I missing?

(I have done some tests today, but nothing much. Didn't work out of the box, need some tweaking.)

It's working today, but maybe not tomorrow.
Take a look at this answer from Mikrotik Own Support Technician.
viewtopic.php?p=1114268#p1114268

A bit over the top, but it should not be used as a business entity as on occasion, not very frequently the Mikrotik servers have gone offline. A couple of times a year is probably a safe bet.
Nothing for you to worry about unless your a hospital, a bank or any business requiring 24/7 VPN up time.
If that is concern then rent a server in the cloud, for like $7 a month and put a CHR on it and use that as the wireguard server.

A bit over the top, but it should not be used as a business entity as on occasion, not very frequently the Mikrotik servers have gone offline. A couple of times a year is probably a safe bet.

Exactly my point. If a client is not willing to shelve out for a business connection with an fixed IP, then I don't really see them willing to finance a CHR instance configuration and maintenance.

Nothing for you to worry about unless your a hospital, a bank or any business requiring 24/7 VPN up time.
If that is concern then rent a server in the cloud, for like $7 a month and put a CHR on it and use that as the wireguard server.

As on the price of the cloud server - the issue is not a few bucks needed to make it work, but time to do so. All these costs need to be passed onto the client, and it adds up. It is simply more cost effective to have a business class internet access.

Also, 24/7 is overrated for most use cases.

(Also, I haven't forgot about that EAP I promised you, but I have so much work to do that I couldn't yet muster time to do a write up.)

Why is CHR necessary just for Wireguard peer? It can be setup on Linux running on cloud server and save some money for CHR licence. Once setup on Linux is created, image can be made of it for reuse.
Initially some time will be spent to create setup, but later it should be more faster and charge more know-how than spent time and profit from such clients.

So we must clarify what business use means. If the BTH is used for occasional management access for a support company, then support intervention is not possible if the BTH infrastructure is unavailable. That's definitely unpleasant but it is not the same like if BTH was hypothetically used to provide service for end customers, because support interventions are only required at random times and the BTH infrastructure becomes unavailable at other random times, so the probability that these two events coincide is not that high.

But looking at it from the other side, if I provide support, it should not be a big deal for me to have a public (or global) IP address and let these customers actively connect to it so that I could reach their router for support interventions?

Concur with Sindy, if you are providing a paid service, then having your own cloud wireguard to support all your clients ( shared cost ), is the smart way to go.