How to run a whole-home VPN on a MikroTik router with AmneziaWG

Why put the VPN on the router

A router VPN protects every device on your network at once. You set it up one time, and phones, TVs, consoles and guests' laptops use it without their own app.

This matters most for devices that cannot run a VPN app at all, such as smart TVs and set-top boxes. It also helps where app stores are blocked and installing a client on each phone is a chore. DXVPN supports this on MikroTik routers through an AmneziaWG container. For a single phone or laptop, an app from the download page is simpler.

What you need

You need a MikroTik router on RouterOS 7.x with container support, and a DXVPN Family plan. A little networking confidence helps too.

• RouterOS 7.x. Containers are a RouterOS 7 feature. Update the router first if it is on an older version.
• Container support. Not every MikroTik model can run containers. It depends on the CPU architecture and on free memory and storage. MikroTik's container documentation lists what is supported.
• Storage for the image. Small routers have little built-in flash. An external USB drive or disk is often the practical place for container files, where the model allows it.
• The Family plan. The MikroTik setup requires Family: 449 ₽ a month, 1 199 ₽ a quarter or 3 599 ₽ a year. It includes 5 devices, all 7 protocols, AdGuard DNS filtering, the MTProto proxy for Telegram and priority support. See pricing.

How it works

The router runs AmneziaWG inside a small Linux container and routes your home traffic into it. The container keeps the tunnel to a DXVPN node; the router decides what goes through it.

The pieces fit together like this:

1. The container holds the AmneziaWG client and your DXVPN config, with its obfuscation settings already filled in.
2. A virtual Ethernet (veth) interface connects the container to the router, so they can pass traffic to each other.
3. Routing rules on the router send selected traffic to the container instead of straight to your internet provider.
4. The tunnel carries that traffic, encrypted and disguised, to a DXVPN node (the live status page lists the current ones).

Because the tunnel is AmneziaWG, the traffic does not carry the standard WireGuard signature that DPI looks for. For the details, read AmneziaWG vs WireGuard.

The setup flow, step by step

The setup follows MikroTik's standard container workflow. We describe the general flow here; use MikroTik's documentation for the exact commands for your RouterOS version.

1. Get your config. On the Family plan, get your AmneziaWG config from the dashboard or from @dxvpnbot.
2. Install the container package. Download the extra packages for your router's architecture and RouterOS version, and add the container package.
3. Enable container mode. RouterOS requires you to turn on container mode in device-mode settings, then confirm it physically on the router (for example with the reset button or a power cycle, as the prompt instructs).
4. Create the network. Add a veth interface for the container and connect it to the router with an address and, usually, a dedicated bridge.
5. Add the container. Point RouterOS at the AmneziaWG image, set where its files live (ideally external storage) and mount your config into it.
6. Start and test. Start the container, check that the tunnel comes up, then add the routing rules that send traffic into it.

If the tunnel does not come up, the same fixes apply as on a phone: refresh the config, try the other node, or get a fresh config from @dxvpnbot. See the blocked VPN checklist.

Split routing: what goes through the tunnel

With split routing, some traffic uses the VPN and the rest goes direct. The common setup in Russia is to send Russian sites direct and international traffic through the tunnel.

This has practical benefits. Local banking, delivery and government sites see your normal home connection, which they often expect. Local streaming stays as fast as your provider allows. The router's CPU only encrypts the traffic that needs it. On MikroTik, split routing is usually done with address lists and routing marks: traffic to addresses on the "direct" list uses the normal route, and everything else is marked for the container. You can also choose the opposite approach and route only specific devices through the VPN.

Limits to expect

A router is a small computer, and a VPN container asks a lot of it. Set expectations before you start.

• Speed depends on the router. Encryption uses CPU. Entry-level models may not reach your full line speed through the tunnel.
• Memory and storage are tight. Containers need free RAM and space for the image. Other heavy features on the same router can compete for resources.
• One protocol on the router. The container runs AmneziaWG. If AmneziaWG is blocked on your network, individual devices can still use VLESS + Reality or Trojan in an app.
• More moving parts. RouterOS updates, container settings and routing rules all need care. Keep notes on what you changed.

Next steps

If your router meets the requirements, start with the Family plan and your AmneziaWG config. If not, cover your most-used devices with apps instead.

Check that our nodes are online on the status page, and read about DXVPN's features, such as multi-hop and DNS filtering. To compare the router option with app-based protocols, see how to choose a VPN protocol.