AmneziaWG container development for Mikrotik routers has progressed substantially since its initial release earlier this year. The project began as a lightweight solution to bring the full AmneziaWG protocol stack to devices that already possess an efficient native Wireguard implementation.
How the Container Works
The AmneziaWG protocol consists of roughly 80 percent standard Wireguard and 20 percent additional obfuscation mechanisms that insert random junk packets and padding. By offloading the cryptographic operations to Mikrotik's hardware-accelerated Wireguard engine and implementing only the obfuscation layer in software, the container achieves high throughput while remaining extremely compact at 94.7 KB.
Current measured performance reaches nearly 300 Mbit/s on Mikrotik Hap Ax3 devices and 200 Mbit/s on Hap Ax2 models. The container also functions in server mode, enabling direct AmneziaWG connections between multiple Mikrotik routers.
Protocol Evolution and Technical Improvements
Support was added for AmneziaWG versions 1.0 through 3.1, including random packet-size padding introduced in version 2.0 and protocol-mimicry patterns added in version 3.0. The container was later rewritten from Go to C, reducing image size from 5 MB to approximately 80-90 KB and increasing throughput by roughly 50 percent.
Additional features include DNS hostname resolution with automatic failover between IPv4 and IPv6, selective routing for Russian IP ranges, automatic port randomization within configurable ranges, and dynamic MTU adjustment based on the S4 padding parameter. A privileged mode introduced in RouterOS 7.24 allows the container to increase interface buffer size to 32 MB, eliminating packet drops that previously limited sustained speeds.
Project Challenges and Community Response
Shortly after the first public article, the original GitHub repository was banned because CI tests performed external network connections. The author recreated the project under a new account, removed the problematic tests, and the repository has since accumulated more than 370 stars without further incidents.
An offline configurator generates the necessary Mikrotik commands without any external requests, and a Telegram bot was developed to produce configuration strings and QR codes for both AmneziaVPN and native AmneziaWG servers.
Independent testing and feedback from community members helped refine PPPoE compatibility, IPv6 dual-stack operation, and automatic reconnection logic for users running the container as a WARP client.
