ulfrasark/awg-server repository overview

⁠ulfrasark/awg-server

AmneziaWG 2.0 server for MikroTik RouterOS containers (x86_64 / ARM64 / ARMv7).

Multi-profile obfuscation support — run multiple AWG interfaces with different traffic masking profiles simultaneously (DNS, QUIC, DTLS, etc).

Built from source: amneziawg-go⁠ + amneziawg-tools⁠. Userspace implementation — no kernel module required.

⁠Image size

⁠How it works

• Place awg0.conf, awg1.conf, awg2.conf ... in the mount directory
• Set PrivateKey = AUTO — keys are generated automatically on first start and saved back to the config file
• Container auto-detects all awgN.conf files and brings up a separate interface for each
• Use add_client.sh inside the container shell to generate client configs and QR codes

⁠Prepare config files

Create one config file per obfuscation profile. Place them in your mount directory (e.g. /docker/AWG-confs/).

Template (awg0.conf, awg1.conf, awg2.conf — change Address, ListenPort and obfuscation params for each):

# AmneziaWG 2.0
# Profile: your-profile-name-here

[Interface]
PrivateKey = AUTO
Address = 10.8.0.1/24
ListenPort = 51820

H1 = 
H2 = 
H3 = 
H4 = 
S1 = 
S2 = 
S3 = 
S4 = 
Jc = 
Jmin = 
Jmax = 
I1 = 
I2 = 
I3 = 
I4 = 
I5 = 

PostUp = iptables -A FORWARD -i %i -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostUp = iptables -I FORWARD -i %i -o %i -j DROP
PostDown = iptables -D FORWARD -i awg0 -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -o %i -j DROP

Address and ListenPort per interface:

⁠MikroTik setup

⁠1. Network

/interface/veth add name=veth-awg address=172.16.172.2/24 gateway=172.16.172.1
/interface/bridge add name=bridge-awg
/interface/bridge/port add bridge=bridge-awg interface=veth-awg
/ip/address add address=172.16.172.1/24 interface=bridge-awg

⁠2. Public IP for client configs

add_client.sh needs to know your public IP to put it in client configs as Endpoint.

Option A — environment variable (preferred):

/container/envs/add name=AWG key=AWG_HOST value=YOUR.SERVER.IP

Option B — file in mount directory (fallback):

Create file awg_host.txt in your mount directory (/docker/AWG-confs/) with a single line — your public IP:

YOUR.SERVER.IP

The file takes priority over the env variable. When changing servers — just update this file, no container rebuild needed.

⁠3. Mount

/container/mounts/add name=awg_config src=/docker/AWG-confs dst=/etc/amnezia/amneziawg

Place your awg0.conf, awg1.conf, awg2.conf files in /docker/AWG-confs/ before starting.

⁠4. Install container

/container/add \
  remote-image=ulfrasark/awg-server:latest \
  interface=veth-awg \
  root-dir=disk1/docker/AWG \
  mounts=awg_config \
  envlist=AWG \
  dns=1.1.1.1 \
  logging=yes \
  start-on-boot=yes

⁠5. Enable container mode (x86 CHR)

/system/device-mode/update container=yes

Confirm with cold reboot (power off + power on via your VPS control panel).

⁠6. Start

/container/start [find tag~"awg-server"]

⁠NAT / Port forwarding

Add one DST-NAT rule per interface:

/ip/firewall/nat/add chain=dstnat protocol=udp dst-port=51820 \
  action=dst-nat to-addresses=172.16.172.2 to-ports=51820 comment="AWG0"

/ip/firewall/nat/add chain=dstnat protocol=udp dst-port=51821 \
  action=dst-nat to-addresses=172.16.172.2 to-ports=51821 comment="AWG1"

/ip/firewall/nat/add chain=dstnat protocol=udp dst-port=51822 \
  action=dst-nat to-addresses=172.16.172.2 to-ports=51822 comment="AWG2"

Also add masquerade for container outbound traffic:

/ip/firewall/nat/add chain=srcnat src-address=172.16.172.0/24 \
  action=masquerade comment="AWG container out"

Also add route for traffic from veth-interface ip to in-container ip (you can use lesser masks):

 ip route/add dst-address=10.8.0.0/16 gateway=172.16.172.2 \
   comment="route to AWG"

⁠Adding clients

Enter container shell:

/container/shell [find tag~"awg-server"]

Generate client for one profile:

add_client.sh vasya 0

Generate client for multiple profiles at once:

add_client.sh vasya 0 1 2

Generate client for all available profiles:

add_client.sh vasya

Client configs and QR code PNGs are saved to /etc/amnezia/amneziawg/clients/ which maps to your mount directory:

/docker/AWG-confs/clients/
├── vasya_awg0.conf
├── vasya_awg0.png
├── vasya_awg1.conf
├── vasya_awg1.png
├── vasya_awg2.conf
└── vasya_awg2.png

Download PNG files via Winbox → Files and scan with amneziawg app.

⁠Client app

Use amneziawg (not AmneziaVPN) for importing .conf files or scanning QR codes:

• Android: https://github.com/amnezia-vpn/amneziawg-android/releases⁠
• Windows: https://github.com/amnezia-vpn/amneziawg-windows-client/releases⁠

⁠Check logs

/log/print where topics~"container"

⁠Port reference