It has linux-kernel-module fyi
And awg tun interface can be linked to vanilla wireguard:
Jc = 1 ≤ Jc ≤ 128; recommended range is from 3 to 10 inclusive
Jmin = Jmin < Jmax; recommended value is 50
Jmax = Jmin < Jmax ≤ 1280; recommended value is 1000
S1 = 0
S2 = 0
H1 = 1
H2 = 2
H3 = 3
H4 = 4
Really needed, will help with remote employees to provide continuous stable communication
+1
This feature very useful in non free country and help to bypass VPN blocking.
Hi guys, I’m trying to run the container with amnezia wg. Why do I get error: could not find image manifest in archive. What am I doing wrong?
+1
Perhaps the developers will be able to compile the awg kernel for RoS. It will be very cool, because all VPN protocols that Mikrotik supports already can be blocked by DPI. So if you want to have a VPN tunnel with which the router can work, you need a separate server with this VPN.
Last I checked, there’s plenty of vpn or equivalent sneaky ways to get a MT to bypass a state based vpn block, that doesnt require some ‘magic’ plugin for MT that “would work”, but other existing mechanisms already onboard dont…
+1
I’m also looking forward to native support.
Please enlighten us as most States have ways of detecting VPN patterns regardless of tricks. This solution seems unique in its ability to appear random.
https://hub.docker.com/r/wiktorbgu/amneziawg-mikrotik
I compiled the images and wrote instructions for launching.
Works both in client and server mode.
If Mikrotik had also implemented the driver into the kernel, it would have been much better.
+1 you just need to allow overriding the standard values of some wg fields in order for amneziawg to work. It’s not difficult! We are really waiting
You know people who join just to PLUS1 this thread are either bots, trolls, or the original poster LOL… no one is fooled by this stupidity.
EDIT: the stupidity continues see below.
Is there any firewall rule needed to send incoming port 51820 to the VETH IP of the AmneziaWG container? Nothing about that in the manual.
I created VETH 172.17.0.6 with gateway 172.17.0.1 and also added NAT rule, to send incoming packets on 51820 to 51820 on 172.17.0.6 and configured everything as in manual.
I’m trying to get this to work, but no luck for now. I can see incoming packets on 51820 if i add rule in Firewall NAT, but nothing afterwards.
Trying to help a friend who want’s to watch home television (SLO) when he works all over the world and also in Russia, but no luck for now. All other protocols are practicaly cripled and unusable there.
yet another properitary shortlived VPN solution - no thanks.
sounds like a shortsighted opinion… the concept has validity whether or not we will ever see a viable rendition is anyones guess.
I added this in awg0.conf
[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = 2ONX7xNsinRtVLG5STJwGkA1T57sX1SJ8Sy898rB6Us=
Jc = 4
Jmin = 50
Jmax = 1000
S1 = 146
S2 = 42
H1 = 532916466
H2 = 2096090865
H3 = 406337014
H4 = 57583056
# Add IP masquerading
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# Del IP masquerading
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
[Peer]
PublicKey = kY6T9/56TWyaWg2uKIZynED7uOdJWR5ygOyG60OEZHA=
AllowedIPs = 10.0.0.2/32
And this in awg.conf
[Interface]
PrivateKey = sFMkMpJqU+8fzsKFiUvmZs64GzpafAPDJgSlil9HslE=
Address = 10.0.0.2/24
DNS = 8.8.8.8, 1.1.1.1
MTU = 1440
Jc = 6
Jmin = 50
Jmax = 1000
S1 = 0
S2 = 0
H1 = 1
H2 = 2
H3 = 3
H4 = 4
# Add IP masquerading
PostUp = iptables -t nat -A POSTROUTING -o %i -j MASQUERADE
# Del IP masquerading
PostDown = iptables -t nat -D POSTROUTING -o %i -j MASQUERADE
# Replace 192.168.254.1 with your router IP address in the bridge where the container is located
# exclude local networks
PreUp = ip route add 10.0.0.0/8 via 192.168.254.1 dev eth0
# Here is the IP of the Endpoint
PreUp = ip route add IP via 192.168.254.1 dev eth0
[Peer]
PublicKey = z7tnHzJqSqwtkt4MiqfoQAZW4f5YM0JUR3elbOr8bh0=
AllowedIPs = 0.0.0.0/1, 128.0.0.0/1 # don't use 0.0.0.0/0
PersistentKeepalive = 25
Endpoint = IP:51820
also i added firewall rule, that sends all packets comming in on 51820 to VETH IP of AmneziaWG
add action=dst-nat chain=dstnat comment=AmneziaTEST dst-port=51820 in-interface=ether1 protocol=udp to-addresses=172.17.0.6 to-ports=51820
Test client is a HapAX Lite LTE6 on mobile network.
Trying to ping server from client… nothing
[admin@MikroTik] > /container shell 0
MikroTik:/# ping 10.0.0.1
PING 10.0.0.1 (10.0.0.1): 56 data bytes
^C
Also i tried with this on my phone with Amnezia app and found Handshake did not complete after 5 seconds somewhere in logs.
[Interface]
PrivateKey = sFMkMpJqU+8fzsKFiUvmZs64GzpafAPDJgSlil9HslE=
Address = 10.0.0.2/24
ListenPort = 51820
DNS = 10.0.0.1
MTU = 1440
Jc = 6
Jmin = 50
Jmax = 1000
S1 = 0
S2 = 0
H1 = 1
H2 = 2
H3 = 3
H4 = 4
[Peer]
PublicKey = z7tnHzJqSqwtkt4MiqfoQAZW4f5YM0JUR3elbOr8bh0=
AllowedIPs = 0.0.0.0/1, 128.0.0.0/1
Endpoint = X.sn.mynetname.net:51820
ifconfig on server:
[admin@MikroTik] > /container shell 4
MikroTik:/# ifconfig
awg0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.0.0.1 P-t-P:10.0.0.1 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1420 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:7 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:0 (0.0 B) TX bytes:588 (588.0 B)
eth0 Link encap:Ethernet HWaddr 7E:52:ED:6D:79:4F
inet addr:172.17.0.6 Bcast:0.0.0.0 Mask:255.255.255.0
inet6 addr: fe80::7c52:edff:fe6d:794f/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:160861 errors:0 dropped:0 overruns:0 frame:0
TX packets:1612 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:39345228 (37.5 MiB) TX bytes:71888 (70.2 KiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:25 errors:0 dropped:0 overruns:0 frame:0
TX packets:25 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2658 (2.5 KiB) TX bytes:2658 (2.5 KiB)
ifconfig on client:
[admin@MikroTik] > /container shell 0
MikroTik:/# ifconfig
awg Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-0
0
inet addr:10.0.0.2 P-t-P:10.0.0.2 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1440 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
eth0 Link encap:Ethernet HWaddr A6:63:14:35:17:B7
inet addr:192.168.254.4 Bcast:0.0.0.0 Mask:255.255.255.0
inet6 addr: fe80::a463:14ff:fe35:17b7/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:56128 errors:0 dropped:0 overruns:0 frame:0
TX packets:69314 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2742689 (2.6 MiB) TX bytes:34784346 (33.1 MiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
Any idea what i am doing wrong, wiktorbgu or anyone else?
I have the same problem, it’s necessary feature to add on routeros
I confirm that Amnesia WG is running on Keenetic and DPI does not detect packets. I would really like to implement it on Mikrotik.
It’s a big mystery to me why the company hasn’t added this protocol AmneziaWG to its products yet. to implement this protocol you need a minimum of effort, and the benefit will be colossal. I think marketers should be fired because they do not understand the market requirements and are poorly oriented in the needs of users. If you have the opportunity, write to the company at support@mikrotik.com and say that you need to have this protocol, they do not read this forum and it will not help us what we write here.