AWG Proxy — MikroTik Offline Command Generator

Paste your AmneziaWG .conf file contents to generate ready-to-use MikroTik RouterOS commands

AmneziaWG Configuration File

All configuration and data is processed locally in your browser. Nothing is transmitted anywhere. Your private keys are safe.

Deployment mode

MikroTik + Container (Docker) MikroTik + Server (Standalone) Site-to-site (two MikroTik) Server (1:N hub)

WireGuard client on MikroTik + awg-proxy runs inside a Docker container directly on the router

.conf file contents

Routing scenario

DNS-based routing for services Tunnel only (manual routes) All non-RU traffic through tunnel

Routes traffic to selected services through the tunnel using DNS forwarding (DoH). ⓘ

FastTrack rules will be modified (out-interface-list=WAN) to keep FastTrack active for non-VPN traffic. Uninstall script restores them.

DNS-forwarder (DoH)

All services will use this DNS-over-HTTPS (DoH) provider for domain resolution.

Services to route through tunnel

Custom domains

Netwatch failover

Monitors tunnel availability by pinging 8.8.8.8 through the WG interface (via a pinned probe route). If the tunnel is down, disables its route — traffic falls back to the next tunnel (by distance) or goes direct. Re-enables the route when the tunnel recovers.

Clear DF bit on UDP (DPI workaround)

Adds AWG_NO_DF=1 to the container ENV: the proxy clears the Don’t Fragment bit on its UDP packets. Some DPI equipment passes DF=0 UDP better than DF=1. Enable only if the tunnel has connectivity issues — with DF=0 large packets may be fragmented along the path.

Container storage

Tunnel name (prefix)

Change the prefix only if you need 2+ tunnels with different routing rules

Network merging

None L3 routing (IP) Direct AmneziaWG client

Devices will be able to reach each other by IP across subnets. What becomes possible: access NAS/file shares, IP cameras, printers by address, remote desktop (RDP/VNC), manage routers via WinBox/SSH, host game servers, access home automation (Home Assistant). Does NOT work: broadcast/multicast services. Note: each client only sees the server LAN by default. To connect two clients to each other, additional routes must be added manually.

Server public IP or domain

Server AWG port (public)

Tunnel subnet (/24)

DNS server (required if endpoint is a domain, not IP)

Server LAN subnet (required)

Client LAN subnet (required)

Server storage

Client storage

Client number

Parsed parameters

MikroTik RouterOS Commands

Step 2: Routing Setup

Paste this AFTER Step 1 completes (wait for "Installation complete!").

Uninstall Commands

Side A (MikroTik 1) — client

Uninstall Side A (client)

Side B (MikroTik 2) — server

Uninstall Side B (server)