AWG Proxy 3.0 — MikroTik Offline Command Generator

Paste an AmneziaWG .conf (1.0 through 3.0) to generate ready-to-use MikroTik RouterOS commands

First, prepare the router Click to open: the container package, device-mode, your own VPN server and how to check them

Without these four steps the commands below will not run. Each one is done once.

  1. The router fits. An ARM, ARM64 or x86 CPU and RouterOS 7.4 or newer. In the terminal: /system/resource/print — architecture-name must say arm64, arm or x86_64. MIPS (hEX, hEX S, hAP ac lite, hAP lite) will not do: MikroTik makes no container package for it.
  2. The container package is installed. Check: /system/package/print must list container. If it does not, install it one of these ways:
    • WinBox, RouterOS 7.18 or newer. System → Packages → Check For Updates. container shows up in the list: select it, press Enable, then Apply Changes. The router downloads the package and reboots.
    • The same in the terminal: 
      /system/package/update/check-for-updates
/system/package/enable container
/system/package/apply-changes
    • RouterOS older than 7.18. Download the Extra packages for your architecture and exactly your RouterOS version from mikrotik.com/download, drag container-….npk from the archive into the Files window of WinBox and reboot the router.
  3. Containers are allowed in device mode. Run: 
    /system/device-mode/update container=yes fetch=yes bandwidth-test=yes scheduler=yes
    Then, within 5 minutes, press a button on the router (Reset or Mode) or power it off and on: that is how RouterOS makes sure you are next to it. Check: /system/device-mode/print shows yes everywhere.
  4. You have your own VPN server. Rent a VPS and install AmneziaVPN on it: the app sets up the AmneziaWG server over SSH by itself and gives you the .conf for the router.
    Which server to take:
All four done? Paste the .conf below. After Generate, the "Router check" block prints a script that looks at the router and says what is still missing.
AmneziaWG Configuration File

All configuration and data is processed locally in your browser. Nothing is transmitted anywhere. Your private keys are safe.

WireGuard client on MikroTik + awg-proxy runs inside a Docker container directly on the router
Written to the container as AWG_DNS. The container image is scratch and has no resolver of its own, so a hostname endpoint cannot be resolved without this. It has to be reachable from the container without the tunnel — the router itself or a public resolver. Left empty, a public DNS from the config (1.1.1.1 and the like) is taken by itself; a private one (10.x, 100.64.x...) is not — it usually lives inside the tunnel.
VPS без ограничений по трафику
Простой и дешёвый
Для своего VPN хватает с запасом
Freakhosting · BVPS-2
2 vCPU · 2 ГБ RAM · 40 ГБ NVMe
1 Гбит/с, трафик без лимита
$34 в год ≈ 2700 ₽
Перейти
Мощный и производительный
Тянет не только VPN, но и тяжёлые задачи
netcup · VPS 500 G12.5
2 vCore x86 · 4 ГБ RAM · 64 ГБ
2,5 Гбит/с, трафик без лимита, IPv4 + IPv6 (выдаётся подсеть /64)
8 € в месяц ≈ 732 ₽
−5 € по промокоду 36nc17781681630
netcup сначала показывает цену с немецким НДС 19 %. Вверху сайта нажмите на флаг с процентом и выберите вариант с 0 %: покупатели вне ЕС НДС не платят.
Перейти
Цены на момент проверки, могут меняться.
Routes traffic to selected services through the tunnel using DNS forwarding (DoH). ⓘ
FastTrack rules will be modified (out-interface-list=WAN) to keep FastTrack active for non-VPN traffic. Uninstall script restores them.
All services will use this DNS-over-HTTPS (DoH) provider for domain resolution.
Monitors tunnel availability by pinging 8.8.8.8 through the WG interface (via a pinned probe route). If the tunnel is down, disables its route — traffic falls back to the next tunnel (by distance) or goes direct. Re-enables the route when the tunnel recovers.
Only IPv4 goes into the tunnel. If the ISP hands the router native IPv6, every IPv6 flow leaves straight out of WAN and the routing policy never sees it: the site opens past the VPN, or hangs for about 10 seconds until the client falls back to IPv4. These rules reject such connections (TCP with a reset, so the fallback is instant). Anything that must keep speaking IPv6 directly goes into the ...-v6-direct address list.
Adds a scheduler that runs the <prefix>-update script at 04:30. The script compares the published release with the installed one and only calls /container/repull when the version actually changed — a pull restarts the container and the tunnel is down for about ten seconds. Needs RouterOS 7.22+ and an install from the registry; the script itself is always created, so you can update by hand with /system/script/run <prefix>-update.
On a router with four cores or more and a 64-bit CPU (hAP ax2, ax3) the proxy gets two cores of its own, its threads are given the CPU first, and packet receive is spread over the other cores. That removes the last packet drops and makes the speed steady instead of jumping between runs. On a weaker router — fewer cores, or a 32-bit arm such as the hAP ac2 — these settings are skipped: there they take the CPU away from WireGuard, and the container drops them by itself even if they are set. Automatic detection asks the router itself during install, so it is the safe choice. Needs RouterOS 7.24+; on older versions the settings are accepted but do nothing.
Adds AWG_NO_DF=1 to the container ENV: the proxy clears the Don’t Fragment bit on its UDP packets. Some DPI equipment passes DF=0 UDP better than DF=1. Enable only if the tunnel has connectivity issues — with DF=0 large packets may be fragmented along the path.
The IPv6 header is 40 bytes instead of 20, so a full-size packet no longer fits a 1500-byte path and the WireGuard MTU has to come down. Ticked automatically when the endpoint is an IPv6 literal. For a DNS name the box stays off (IPv4 MTU) — tick it yourself if you know the name has an AAAA record; the generated script also asks the router with :resolve type=ipv6 and lowers the MTU if it answers.
Sets /ip/dns address-list-extra-time. Services behind Cloudflare and other CDNs hand out very short TTLs, so an address can drop out of the list while the browser is still using it and the connection leaves the tunnel. This is a router-wide DNS setting, not a per-list one: it is only applied if the router still has the default 0s, and the uninstall script only resets it if it is still exactly the value set here.
Adds a step 0 to the output: a script that changes nothing and prints exactly which files to download and where to put them. Download them elsewhere, upload them to the router, then run the install. Nothing is fetched from GitHub — no registry pull, no release download, and the RU list stops waiting a minute for a name that will never resolve.
The MTU of the link the outer UDP datagram has to cross: 1500 for plain Ethernet, 1492 for PPPoE, lower for PPPoE over VLAN.
Change the prefix only if you need 2+ tunnels with different routing rules
Parsed parameters
MikroTik RouterOS Commands

        
    


    

    

    

        

            
Uninstall Commands

            
        

        

        
    


    

        

            

                
Side A (MikroTik 1) — client

                
            

            

            

                
Uninstall Side A (client)

                

            

        

        

            

                
Side B (MikroTik 2) — server

                
            

            

            

                
Uninstall Side B (server)