Routes traffic to selected services through the tunnel using DNS forwarding (DoH). ⓘ
+
+
FastTrack rules will be modified (out-interface-list=WAN) to keep FastTrack active for non-VPN traffic. Uninstall script restores them.
+
+
+
+
+
+
+
+
+
+
+
+
+
All services will use this DNS-over-HTTPS (DoH) provider for domain resolution.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Monitors tunnel availability by pinging 8.8.8.8 through the WG interface (via a pinned probe route). If the tunnel is down, disables its route — traffic falls back to the next tunnel (by distance) or goes direct. Re-enables the route when the tunnel recovers.
+
+
+
+
Only IPv4 goes into the tunnel. If the ISP hands the router native IPv6, every IPv6 flow leaves straight out of WAN and the routing policy never sees it: the site opens past the VPN, or hangs for about 10 seconds until the client falls back to IPv4. These rules reject such connections (TCP with a reset, so the fallback is instant). Anything that must keep speaking IPv6 directly goes into the ...-v6-direct address list.
+
+
+
+
Adds a scheduler that runs the <prefix>-update script at 04:30. The script compares the published release with the installed one and only calls /container/repull when the version actually changed — a pull restarts the container and the tunnel is down for about ten seconds. Needs RouterOS 7.22+ and an install from the registry; the script itself is always created, so you can update by hand with /system/script/run <prefix>-update.
+
+
+
+
Adds AWG_NO_DF=1 to the container ENV: the proxy clears the Don’t Fragment bit on its UDP packets. Some DPI equipment passes DF=0 UDP better than DF=1. Enable only if the tunnel has connectivity issues — with DF=0 large packets may be fragmented along the path.
+
+
+
+
The IPv6 header is 40 bytes instead of 20, so a full-size packet no longer fits a 1500-byte path and the WireGuard MTU has to come down. Ticked automatically when the endpoint is an IPv6 literal. For a DNS name the box stays off (IPv4 MTU) — tick it yourself if you know the name has an AAAA record; the generated script also asks the router with :resolve type=ipv6 and lowers the MTU if it answers.
+
+
+
+
+
Sets /ip/dns address-list-extra-time. Services behind Cloudflare and other CDNs hand out very short TTLs, so an address can drop out of the list while the browser is still using it and the connection leaves the tunnel. This is a router-wide DNS setting, not a per-list one: it is only applied if the router still has the default 0s, and the uninstall script only resets it if it is still exactly the value set here.
+
+
+
+
Adds a step 0 to the output: a script that changes nothing and prints exactly which files to download and where to put them. Download them elsewhere, upload them to the router, then run the install. Nothing is fetched from GitHub — no registry pull, no release download, and the RU list stops waiting a minute for a name that will never resolve.
+
+
+
+
+
Written to the container as AWG_DNS. The container image is scratch and has no resolver of its own, so a hostname endpoint cannot be resolved without this. It has to be reachable from the container without the tunnel — the router itself or a public resolver, not the DNS from the config, which usually lives inside the tunnel.
+
+
+
+
+
The MTU of the link the outer UDP datagram has to cross: 1500 for plain Ethernet, 1492 for PPPoE, lower for PPPoE over VLAN.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Change the prefix only if you need 2+ tunnels with different routing rules
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Both sides are generated by this page, so the newest level is the safe default. Every side needs an awg-proxy image that understands it.
+
+
Adds a fallback chain down to AWG 1.0. A peer still running an older container connects on the stage it understands; costs nothing while everyone is on the same level.
+
+ Updating an existing installation
+ A container built before 3.0 does not understand header protection: adding the new variables is not enough. Pull the new image and recreate the container.
+
+
+
+
+
+
+
+ Adding a new client to server
+
+
+
+
+
+
+
+
+
Devices will be able to reach each other by IP across subnets. What becomes possible: access NAS/file shares, IP cameras, printers by address, remote desktop (RDP/VNC), manage routers via WinBox/SSH, host game servers, access home automation (Home Assistant). Does NOT work: broadcast/multicast services. Note: each client only sees the server LAN by default. To connect two clients to each other, additional routes must be added manually.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Both sides are generated by this page, so the newest level is the safe default. Every side needs an awg-proxy image that understands it.
+
+
Adds a fallback chain down to AWG 1.0. A peer still running an older container connects on the stage it understands; costs nothing while everyone is on the same level.
+
+ Updating an existing installation
+ A container built before 3.0 does not understand header protection: adding the new variables is not enough. Pull the new image and recreate the container.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Parsed parameters
+
+
+
+
+
+
MikroTik RouterOS Commands
+
+
+
+
+
+
+
+
+
Step 0: What to download
+
+
+
Run this FIRST. It only prints file names. Download the files it names, upload them to the router, and only then run step 1.
+
+
+
+
+
+
Step 2: Routing Setup
+
+
+
Paste this AFTER Step 1 completes (wait for "Installation complete!").
+
+
+
+
+
+
+
Uninstall Commands
+
+
+
+
+
+
+
+
+
+
Side A (MikroTik 1) â client
+
+
+
+
+
Uninstall Side A (client)
+
+
+
+
+
+
Side B (MikroTik 2) â server
+
+
+
+
+
Uninstall Side B (server)
+
+
+
+
+
+
+
+
⚠️ SAVE THIS LINK FOR FUTURE CONFIGURATION
+
+
+
+
+
This link will also be saved in container env AWG_CONFIG_URL. To retrieve it later: /container/envs/print where key=AWG_CONFIG_URL