drkivi/amneziawg-for-armv7

By drkivi

•Updated 9 days ago

AmneziaWG-installed Image for ARMv7 Devices | Updated Go Modules

Image

Networking

Security

2.6K

Overview Tags

drkivi/amneziawg-for-armv7 repository overview

⁠Usage Guide

⁠🐧 Raspberry Pi (ARMv7)

⁠Step 1: Pull the image

docker pull drkivi/amneziawg-for-armv7:latest

To pin a specific release, use a version tag instead of latest (for example drkivi/amneziawg-for-armv7:v0.0.20261024). Available tags are listed on the Docker Hub page⁠.

⁠Step 2: Prepare the configuration

Follow the GitHub guide at github.com/drkivi/amnezia-wg-docker⁠ to create wg0.conf, then run:

docker run -d \
  --name amneziawg \
  -v /path/to/local/wg0.conf:/etc/amnezia/amneziawg/wg0.conf \
  --cap-add=NET_ADMIN \
  --cap-add=SYS_MODULE \
  --privileged \
  drkivi/amneziawg-for-armv7:latest

⁠Step 3: Make container the default gateway

sudo ip route add ip.to.awg.server via ip.of.default.gateway dev eth0
sudo ip route add default via 172.17.0.2 dev docker0

⁠Step 4: Revert the route

sudo ip route delete ip.to.awg.server via ip.of.default.gateway dev eth0
sudo ip route delete default via 172.17.0.2 dev docker0

If 172.17.0.2 is not correct, check with:

docker exec -it amneziawg ifconfig

The startup banner Running amneziawg-go is not required because this kernel has first class support for AmneziaWG is normal on this image. It is printed even when the userspace daemon is used, and it does not indicate an error.

To check that the tunnel is up:

docker exec -it amneziawg awg show

A healthy tunnel shows the interface, the peer, and a latest handshake line.

For DNS debugging the image includes kdig (Knot DNS client), which replaces dig:

docker exec -it amneziawg kdig example.com

⁠📡 Mikrotik Setup

⁠Create veth and bridge:

/interface/veth add address=192.168.88.88/24 gateway=192.168.88.1 name=veth1
/interface/bridge/port add bridge=Bridge-Docker interface=veth1

You may want to create a separated bridge interface with a distinct subnet.

⁠Firewall settings:

/ip firewall nat
add action=masquerade chain=srcnat comment="for amnezia-wg client" out-interface=bridge
/ip firewall nat
add action=dst-nat chain=dstnat comment="for amnezia-wg server" dst-port=51820 protocol=udp to-addresses=192.168.88.88 to-ports=51820

⁠Prepare container:

Put wg0.conf in /awg
Use USB with ext4 filesystem

/container/config set registry-url=https://registry-1.docker.io tmpdir=/usb1/docker/pull
/container/mounts add dst=/etc/amnezia/amneziawg name=awg_config src=/awg

⁠Pull image from Docker Hub:

/container/add remote-image=drkivi/amneziawg-for-armv7:latest name=amneziawg interface=veth1 root-dir=/usb1/docker/amneziawg logging=yes mounts=awg_config workdir=/ hostname=amnezia

⁠Or install from local tar:

docker save amneziawg-for-armv7:latest > amneziawg-for-armv7.tar

Transfer the tar, then:

/container/add file=amneziawg-for-armv7.tar name=amneziawg interface=veth1 root-dir=/usb1/docker/amneziawg logging=yes mounts=awg_config workdir=/ hostname=amnezia

To update to a new release, replace the tar (or change the remote tag), re-add or repull the container, and then restart it. Check the version afterwards with docker exec -it amneziawg amneziawg-go --version.

⁠Configure default route:

/ip/dhcp-client/edit [dhcp interface name] default-route-distance=5
/ip/route/add dst-address=0.0.0.0/0 gateway=192.168.88.88 distance=2 comment="AmneziaWG Route"
/ip/route add dst-address=ip.of.awg.server/32 gateway=192.168.88.1 distance=1 comment="To AmneziaWG Server"

To revert:

/ip/route/remove [find where dst-address="0.0.0.0/0" && gateway="192.168.88.88"]
/ip/route/remove [find where dst-address="ip.of.awg.server/32" && gateway="192.168.88.1"]

⁠Optional toggle script (RouterOS < 7.20)

Paste into System → Scripts. This script assumes the container name is amneziawg (set by name= in /container/add):

:if ([ :len [/container find where status="running"] ] > 0) do={
    /container stop [find where status="running"]
    :delay 5
    /ip route
    remove [find where dst-address="0.0.0.0/0" && gateway="192.168.88.88"]
    remove [find where dst-address="ip.of.awg.server/32" && gateway="192.168.88.1"]
    /log info "Container amneziawg-for-armv7 stopped successfully."
} else={
    /container start [find where name="amneziawg"]
    :delay 5
    /ip route
    add dst-address=ip.of.awg.server/32 gateway=192.168.88.1 distance=1 comment="To AmneziaWG Server"
    add dst-address=0.0.0.0/0 gateway=192.168.88.88 distance=2 comment="AmneziaWG Route"
    /log info "Container amneziawg-for-armv7 started successfully."
}

⚠️ This script stops any running container before toggling.

⁠Optional toggle script A (RouterOS >= 7.20, based on `running` state)

Paste into System → Scripts and set cName to amneziawg. Use either script A or script B below, not both:

:local srvIp "ip.of.awg.server/32"
:local lanGw "192.168.88.1"
:local wgGw  "192.168.88.88"

:local id [/container find where name=$cName]
:if ([:len $id]=0) do={ /log warning ("Container '" . $cName . "' not found"); :return }

:local running [/container get $id running]

:if ($running) do={

    /container stop $id

    :local tries 0
    :set running [/container get $id running]
    :while (($running=true) and ($tries<20)) do={
        :set tries ($tries+1)
        :delay 1
        :set running [/container get $id running]
    }

    :if ($running) do={
        /log warning ("Graceful stop failed; killing " . $cName)
        /container kill $id
        :set tries 0
        :set running [/container get $id running]
        :while (($running=true) and ($tries<10)) do={
            :set tries ($tries+1)
            :delay 1
            :set running [/container get $id running]
        }
    }

    :local h1 [/ip route find where dst-address="0.0.0.0/0" and gateway=$wgGw]
    :if ([:len $h1]>0) do={ /ip route remove $h1 }

    :local h2 [/ip route find where dst-address=$srvIp and gateway=$lanGw]
    :if ([:len $h2]>0) do={ /ip route remove $h2 }

    :if (!$running) do={
        /log info ("Container " . $cName . " stopped")
    } else={
        /log warning ("Container " . $cName . " still running after kill")
    }

} else={

    /container start $id

    :local tries 0
    :set running [/container get $id running]
    :while ((!$running) and ($tries<20)) do={
        :set tries ($tries+1)
        :delay 1
        :set running [/container get $id running]
    }

    :if ([:len [/ip route find where dst-address=$srvIp and gateway=$lanGw]]=0) do={
        /ip route add dst-address=$srvIp gateway=$lanGw distance=1 comment="AmneziaWG Auto"
    }
    :if ([:len [/ip route find where dst-address="0.0.0.0/0" and gateway=$wgGw]]=0) do={
        /ip route add dst-address="0.0.0.0/0" gateway=$wgGw distance=2 comment="AmneziaWG Auto"
    }

    :if ($running) do={
        /log info ("Container " . $cName . " started")
    } else={
        /log warning ("Container " . $cName . " not running after start")
    }
}

⚠️ This script stops any running container before toggling.

⁠Optional toggle script B (RouterOS >= 7.20, based on `memory-current`)

Paste into System → Scripts and set cName to amneziawg. Use either script A or script B above, not both:

:local srvIp "ip.of.awg.server/32"
:local lanGw "192.168.88.1"
:local wgGw  "192.168.88.88"

:local id [/container find where name=$cName]
:if ([:len $id]=0) do={ /log warning ("Container '" . $cName . "' not found"); :return }

:local rawMem [/container get $id memory-current]

:if ([:len $rawMem] > 0) do={

    /container stop $id

    :local tries 0
    :set rawMem [/container get $id memory-current]
    :while (([:len $rawMem] > 0) and ($tries < 30)) do={
        :set tries ($tries + 1)
        :delay 1
        :set rawMem [/container get $id memory-current]
    }

    :if ([:len $rawMem] > 0) do={
        /log warning ("Graceful stop failed; killing " . $cName)
        /container kill $id
        :set tries 0
        :set rawMem [/container get $id memory-current]
        :while (([:len $rawMem] > 0) and ($tries < 15)) do={
            :set tries ($tries + 1)
            :delay 1
            :set rawMem [/container get $id memory-current]
        }
    }

    :local h1 [/ip route find where dst-address="0.0.0.0/0" and gateway=$wgGw]
    :if ([:len $h1] > 0) do={ /ip route remove $h1 }

    :local h2 [/ip route find where dst-address=$srvIp and gateway=$lanGw]
    :if ([:len $h2] > 0) do={ /ip route remove $h2 }

    :if ([:len $rawMem] = 0) do={
        /log info ("Container " . $cName . " stopped")
    } else={
        /log warning ("Container " . $cName . " still running after kill")
    }

} else={

    /container start $id

    :local tries 0
    :set rawMem ""
    :while (([:len $rawMem] = 0) and ($tries < 20)) do={
        :set tries ($tries + 1)
        :delay 1
        :set rawMem [/container get $id memory-current]
    }

    :if ([:len [/ip route find where dst-address=$srvIp and gateway=$lanGw]] = 0) do={
        /ip route add dst-address=$srvIp gateway=$lanGw distance=1 comment="AmneziaWG Auto"
    }
    :if ([:len [/ip route find where dst-address="0.0.0.0/0" and gateway=$wgGw]] = 0) do={
        /ip route add dst-address="0.0.0.0/0" gateway=$wgGw distance=2 comment="AmneziaWG Auto"
    }

    :if ([:len $rawMem] > 0) do={
        /log info ("Container " . $cName . " started")
    } else={
        /log warning ("Container " . $cName . " not running after start")
    }

}

Tag summary

Recent tags

Content type

Image

Digest

sha256:7fd8b5390…

Size

15.1 MB

Last updated

9 days ago

docker pull drkivi/amneziawg-for-armv7