Running OpenVPN on RouterOS is one thing; turning a supported router into a usable, secure OpenVPN service — and then managing users, certificates, profiles, policies, and lifecycle safely — is where the work grows.
MikroTik OpenVPN GUI is a portable, self-hosted, WinBox-inspired dashboard for RouterOS 7. It runs as a RouterOS /container, connects to RouterOS REST, and applies reviewed changes through the router itself. RouterOS remains the source of truth for identities, certificates, sessions, and traffic policy.
A major convenience is the guided OpenVPN foundations workflow: it automates the preparation of the CA, server certificate, address pool, PPP profile, and OpenVPN server configuration, so there is no need to manually assemble the VPN setup. The resulting RouterOS commands remain reviewable before applying, and production deployments can be tested on an isolated canary device first.
Highlights
- Guided OpenVPN foundations setup for supported routers — prepare the VPN service without manually assembling every RouterOS component.
- RouterOS-backed administrator authentication — no second dashboard-password database.
- Add, edit, suspend, duplicate, and remove VPN users.
- Issue separate client certificates and password-protected profile archives per device.
- Onboard phones and tablets with QR hand-offs or ZIP downloads.
- Inspect active sessions, traffic counters, source addresses, and connection history.
- Apply reusable presets for device limits, expiry, schedules, speed, DNS, and quota.
- Review-first, checkpointed applies, including safe bulk suspend, revoke, or tag operations.
- Read-only service-health and device-posture checks, role-based capabilities, and sanitized audit history.
- Dashboard metadata and sanitized audit events stay in local SQLite; VPN passwords and private keys are not stored.
Screenshots
The screenshots below use representative mock data only; they contain no production accounts, addresses, or credentials.
RouterOS mapping and security model
This is deliberately not a parallel source of truth:
- RouterOS groups map to dashboard roles such as Owner, Security operator, Administrator, Auditor, and Read-only.
- The same capability matrix is enforced by the API routes, not only by visible buttons.
- User, profile, policy, and access changes are sent to RouterOS through REST and remain device-visible and auditable.
- Setup plans and generated RouterOS commands can be reviewed before they are applied; production deployments can be validated on an isolated canary device first.
- RouterOS credentials, environment values, domains, addresses, Cloudflare settings, VPN users, certificates, private keys, profiles, and CA material remain private and are supplied at runtime.
Containers: development to production
Development
python tests/run_mock_app.py --port 18080
The local mock RouterOS service lets you exercise the UI and workflows without contacting a router or a Cloudflare account.
On the device / production
- Deploy the GHCR image as a RouterOS 7
/container; arm64 is the validated target, with amd64 available for CHR/x86 evaluation. - Use persistent router-local mounts for configuration and data, and set runtime values through the RouterOS container environment list.
- Pin an immutable
sha-<commit>-<architecture>image, validate it in canary, and promote it to production only after the checks pass. - Keep the previous image and persistent mounts available for rollback; an optional router-local scheduler can manage this promotion flow.
Cloudflare Zero Trust and secure exposure
The dashboard can be served over HTTPS behind a Cloudflare-protected path such as Cloudflare Tunnel and/or Cloudflare Zero Trust Access. This provides identity-aware access and edge protection while RouterOS REST can remain private.
When every request reaches the application through a trusted Cloudflare origin proxy, enable TRUST_CLOUDFLARE=true and configure TRUSTED_PROXY_SOURCES so forwarded client headers are accepted only from trusted proxy addresses. Keep Cloudflare settings private in the RouterOS container environment.
Links
- GitHub repository
- Apache-2.0 licensed; independent project, not affiliated with or endorsed by MikroTik.
Feedback is welcome, especially from people running RouterOS containers on different board models, RouterOS versions, or behind different secure-exposure setups.
