$ show catesin/AmneziaWG-MikroTik
This repository provides a complete solution for integrating AmneziaWG (a WireGuard fork with traffic obfuscation) with MikroTik RouterOS. It includes multi-architecture Dockerfiles (amd64, arm, arm64) that build minimal Alpine-based containers running the AmneziaWG client, along with OpenRC init scripts to manage the VPN tunnel and configure NAT/MSS clamping via nftables or iptables. The repository also contains pre-built container images and a detailed step-by-step guide (in Russian) covering two deployment options: running the container directly inside RouterOS (for devices that support containers) or using a separate Linux machine as a VPN gateway. The actual code is limited to Dockerfiles and shell scripts; the bulk of the repository is documentation and build artifacts. It is not a standalone application but a deployment pattern and configuration toolkit for network engineers.
The LLM identified 2 files worth highlighting for reuse:
A multi-stage Dockerfile that cross-compiles AmneziaWG tools (amneziawg-go and amneziawg-tools) for the amd64 architecture using a Go builder image, then packages them into a minimal Alpine runtime image with OpenRC, nftables, and iproute2. The build is parameterized by architecture, making it reusable for arm and arm64 targets with minimal changes. This demonstrates a clean pattern for building and deploying custom VPN clients in constrained environments like MikroTik containers.
An OpenRC init script that manages the AmneziaWG VPN interface. The start_pre() function dynamically generates an nftables ruleset to flush existing rules, set up MSS clamping for TCP SYN packets on the awg0 interface, and configure NAT masquerade for both IPv4 and IPv6. It also sets the DNS server to the container's gateway and applies sysctl settings. The start() function iterates over all .conf files in /etc/amnezia/amneziawg/ and brings up each interface using awg-quick. This script is a self-contained, reusable pattern for integrating a WireGuard-like VPN into an OpenRC-based container with proper firewall and routing setup.