Mikrotik compatible Docker image to run Amnezia WG on Mikrotik routers. As of now, support Arm v7 boards
This is a highly experimental attempt to run Amnezia-WG on a Mikrotik router.
Follow the Mikrotik guidelines to enable container support.
Install Docker buildx subsystem, make and go.
You may need to initialize submodules
git submodule init
git submodule update
To build a Docker container for the ARM7 run
make build-arm7
This command should cross-compile amnezia-wg locally and then build a docker image for ARM7 arch.
To export a generated image, use
make export-arm7
You will get the docker-awg-arm7.tar archive ready to upload to the Mikrotik router.
Just run docker compose up
Make sure to create a awg folder with the wg0.conf file.
Example wg0.conf:
[Interface]
PrivateKey = gG...Y3s=
Address = 10.0.0.1/32
ListenPort = 51820
# Jc лучше брать в интервале [3,10], Jmin = 100, Jmax = 1000,
Jc = 3
Jmin = 100
Jmax = 1000
# Parameters below will not work with the existing WireGuarg implementation.
# Use if your peer running Amnesia-WG
# S1 = 324
# S2 = 452
# H1 = 25
# IP masquerading
PreUp = iptables -t nat -A POSTROUTING ! -o %i -j MASQUERADE
# Firewall wg peers from other hosts
PreUp = iptables -A FORWARD -o %i -m state --state ESTABLISHED,RELATED -j ACCEPT
PreUp = iptables -A FORWARD -o %i -j REJECT
# Remote settings for my workstation
[Peer]
PublicKey = wx...U=
AllowedIPs = 10.0.0.2/32
# An IP address to check peer connectivity (specific to this repo)
TestIP = 10.0.0.2
# Your existing Wireguard server
Endpoint=xx.xx.xx.xx:51820
PersistentKeepalive = 25
Set up interface and IP address for the containers
/interface bridge
add name=containers
/interface veth
add address=172.17.0.2/24 gateway=172.17.0.1 gateway6="" name=veth1
/interface bridge port
add bridge=containers interface=veth1
/ip address
add address=172.17.0.1/24 interface=containers network=172.17.0.0
Set up masquerading for the outgoing traffic and dstnat
/ip firewall nat
add action=masquerade chain=srcnat comment="Outgoing NAT for containers" src-address=172.17.0.0/24
/ip firewall nat
add action=dst-nat chain=dstnat comment=amnezia-wg dst-port=51820 protocol=udp to-addresses=172.17.0.2 to-ports=51820
Set up mount with the Wireguard configuration
/container mounts
add dst=/etc/amnezia/amneziawg/ name=awg_config src=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/awg
/container/add cmd=/sbin/init hostname=amnezia interface=veth1 logging=yes mounts=awg_config file=docker-awg-arm7.tar
To start the container run
/container/start 0
To get the container shell
/container/shell 0