Running gateway on MikroTik routers
Last updated
Was this helpful?
Last updated
Was this helpful?
By leveraging the ability of some MikroTik routers to run Docker containers it is possible to deploy the gateway directly on your router.
Proceed with extra caution when working with your core infrastructure. All official still apply.
RouterOS device with ARM or ARM64 architecture (popular homelab choices include RB4011 or RB5009)
Container package installed and enabled
running defguard core instance with a WireGuard location configured
(optional) self-signed certificate generated by following
This guide assumes you do not have other Docker containers deployed on your router yet. If this is not the case adjust accordingly.
The same applies if you have some more specific network configuration requirements.
first create a bridge interface for Docker containers and assign it an IP address in a dedicated Docker subnet (172.17.0.0/24 in our example):
each container must have a dedicated VETH interface; create a veth1 interface and assign it an IP address in the chosen Docker subnet:
add the virtual interface to the Docker bridge:
set up NAT for outgoing traffic from containers:
add port forwarding rule to send UDP traffic from the public WireGuard port to the gateway container:
Container port being forwarded to must match your public WireGuard port.
add routing for your chosen WireGuard subnet configured in defguard UI location settings:
configure environment variables for the gateway container:
(optional) to use SSL for communication between the gateway and your defguard instance copy the root certificate to your router's filesystem and add a following mount and environment variable:
Put the root certificate in a directory and mount the whole directory. Trying to mount a specific file can cause unexpected issues.
add GitHub container registry to config:
finally create the actual container:
At this point you should see that the gateway is connected in your defguard instance's web UI.