AWG Proxy 3.0 — MikroTik Offline Command Generator

WireGuard client on MikroTik + awg-proxy runs inside a Docker container directly on the router

Routes traffic to selected services through the tunnel using DNS forwarding (DoH). ⓘ

All services will use this DNS-over-HTTPS (DoH) provider for domain resolution.

Monitors tunnel availability by pinging 8.8.8.8 through the WG interface (via a pinned probe route). If the tunnel is down, disables its route — traffic falls back to the next tunnel (by distance) or goes direct. Re-enables the route when the tunnel recovers.

Only IPv4 goes into the tunnel. If the ISP hands the router native IPv6, every IPv6 flow leaves straight out of WAN and the routing policy never sees it: the site opens past the VPN, or hangs for about 10 seconds until the client falls back to IPv4. These rules reject such connections (TCP with a reset, so the fallback is instant). Anything that must keep speaking IPv6 directly goes into the ...-v6-direct address list.

Adds a scheduler that runs the <prefix>-update script at 04:30. The script compares the published release with the installed one and only calls /container/repull when the version actually changed — a pull restarts the container and the tunnel is down for about ten seconds. Needs RouterOS 7.22+ and an install from the registry; the script itself is always created, so you can update by hand with /system/script/run <prefix>-update.

On a router with four cores or more the proxy gets two cores of its own, its threads are given the CPU first, and packet receive is spread over the other cores. That removes the last packet drops and makes the speed steady instead of jumping between runs. On a weaker router these settings are skipped — there they would only take the CPU away from everything else. Automatic detection asks the router itself during install, so it is the safe choice. Needs RouterOS 7.24+; on older versions the settings are accepted but do nothing.

Adds AWG_NO_DF=1 to the container ENV: the proxy clears the Don’t Fragment bit on its UDP packets. Some DPI equipment passes DF=0 UDP better than DF=1. Enable only if the tunnel has connectivity issues — with DF=0 large packets may be fragmented along the path.

The IPv6 header is 40 bytes instead of 20, so a full-size packet no longer fits a 1500-byte path and the WireGuard MTU has to come down. Ticked automatically when the endpoint is an IPv6 literal. For a DNS name the box stays off (IPv4 MTU) — tick it yourself if you know the name has an AAAA record; the generated script also asks the router with :resolve type=ipv6 and lowers the MTU if it answers.

Sets /ip/dns address-list-extra-time. Services behind Cloudflare and other CDNs hand out very short TTLs, so an address can drop out of the list while the browser is still using it and the connection leaves the tunnel. This is a router-wide DNS setting, not a per-list one: it is only applied if the router still has the default 0s, and the uninstall script only resets it if it is still exactly the value set here.

Adds a step 0 to the output: a script that changes nothing and prints exactly which files to download and where to put them. Download them elsewhere, upload them to the router, then run the install. Nothing is fetched from GitHub — no registry pull, no release download, and the RU list stops waiting a minute for a name that will never resolve.

Written to the container as AWG_DNS. The container image is scratch and has no resolver of its own, so a hostname endpoint cannot be resolved without this. It has to be reachable from the container without the tunnel — the router itself or a public resolver, not the DNS from the config, which usually lives inside the tunnel.

The MTU of the link the outer UDP datagram has to cross: 1500 for plain Ethernet, 1492 for PPPoE, lower for PPPoE over VLAN.

Change the prefix only if you need 2+ tunnels with different routing rules