In short: on MikroTik with RouterOS 7 there are two paths. The quick one is the built-in WireGuard: the client is native, and setup through WinBox or the console takes 15 minutes. The advanced one is the VLESS protocol via the Container feature: the router runs a lightweight container with xray, which works on models with ARM/ARM64/x86 architecture and external storage. The second path gives you traffic masquerading as ordinary HTTPS and stability on any network — and, unlike other router solutions, it supports XHTTP configurations too. Let’s walk through both.
New to routers? An honest heads-up
MikroTik is a network engineer’s tool: there are no setup wizards here, and the logic of RouterOS assumes you understand routing. If you are picking your first VPN router for home, look at the Keenetic guide or TP-Link first: there everything is configured with buttons in a web interface. If MikroTik is already in place and you are comfortable with it — let’s go. Get stuck and Tainet support will help you work through your own configuration.
What you’ll need
- RouterOS 7.x (WireGuard has been built in since version seven; for containers 7.6+ is preferable, ideally a recent stable branch).
- For the VLESS path: a model on ARM, ARM64 or x86 (hAP ax2/ax3, RB5009, CCR2004 and newer, x86/CHR) and storage for the container — a USB stick or NVMe; models on older architectures (MIPS) do not support containers at all, and WireGuard is what remains there.
- A configuration from a service. With Tainet both formats come with the subscription — a WireGuard file and a VLESS link — in the Telegram bot or on this site in your personal account; the first 7 days are free, enough to get the setup running.
The practical steps are below; if you'd rather skip the setup, Tainet connects in a couple of minutes - through the Telegram bot or in your account on this site.
Path 1: WireGuard natively
Every parameter comes from the WireGuard configuration file (with Tainet it lives in your personal account, in the subscription section). From the console:
# interface with the private key from [Interface] PrivateKey
/interface/wireguard/add name=wg-vpn private-key="PRIVATE_KEY"
# address from [Interface] Address
/ip/address/add address=10.0.0.2/32 interface=wg-vpn
# peer: the server public key, endpoint and port from [Peer]
/interface/wireguard/peers/add interface=wg-vpn \
public-key="SERVER_PUBLIC_KEY" endpoint-address=SERVER_ADDRESS \
endpoint-port=51820 allowed-address=0.0.0.0/0 persistent-keepalive=25s
# NAT for the local network through the tunnel
/ip/firewall/nat/add chain=srcnat out-interface=wg-vpn action=masquerade
# route all traffic into the tunnel (or only what you need — see the routing section)
/ip/route/add dst-address=0.0.0.0/0 gateway=wg-vpn distance=5
In WinBox the same thing is done under WireGuard → Interfaces/Peers, IP → Addresses, IP → Firewall → NAT, IP → Routes. To check: /interface/wireguard/peers/print should show rx/tx growing, and devices behind the router should show the server’s external IP.
An honest caveat: WireGuard is fast and simple, but its traffic is recognisable, and on some networks the connection is unstable. If that is your case — path 2.
Path 2: VLESS through a container
The idea: the router runs a container with xray that holds the VLESS connection, and RouterOS steers traffic into it. We use a ready-made image (for example the universal aznka/xray-vless-mikrotik for your architecture — it also understands the Vision, XHTTP, gRPC and WebSocket transports).
Step 1. Enable container support. Install the container package (Extra packages for your version), then:
/system/device-mode/update container=yes
RouterOS will ask you to confirm the change physically — by pressing a button on the device or with a cold reboot within the allotted time. That is MikroTik’s safeguard; without it containers will not start.
Step 2. Networking for the container.
/interface/veth/add name=veth-vless address=172.17.0.2/24 gateway=172.17.0.1
/interface/bridge/add name=containers
/interface/bridge/port/add bridge=containers interface=veth-vless
/ip/address/add address=172.17.0.1/24 interface=containers
/ip/firewall/nat/add chain=srcnat src-address=172.17.0.0/24 action=masquerade
Step 3. Pass your VLESS link to the container (copy it in full from your personal account or from the Tainet bot):
/container/envs/add list=vless-env key=VLESS_URL value="vless://YOUR_FULL_LINK"
Step 4. Create and start the container (root-dir goes on your storage):
/container/config/set registry-url=https://registry-1.docker.io tmpdir=disk1/tmp
/container/add remote-image=aznka/xray-vless-mikrotik-arm64:latest \
interface=veth-vless root-dir=disk1/containers/vless \
envlist=vless-env start-on-boot=yes logging=yes name=vless
/container/start vless
Step 5. Steer the traffic. The simplest option is all traffic through the container with a separate routing table:
/routing/table/add name=to_vpn fib
/ip/route/add dst-address=0.0.0.0/0 gateway=172.17.0.2 routing-table=to_vpn
/ip/firewall/mangle/add chain=prerouting src-address=192.168.88.0/24 \
action=mark-routing new-routing-mark=to_vpn passthrough=yes
(Substitute your own local subnet; for selective routing change the condition in mangle — by device address or by destination lists.)
To check: /container/print — status running; the container log will show the connection established; devices from the marked subnet go out with the server’s IP.
A note on configuration types: the container runs full xray, so it understands both VLESS and the XHTTP variants from a Tainet subscription — nothing needs filtering. That is what sets the MikroTik path apart from router solutions built on sing-box (like HomeProxy on OpenWRT), where XHTTP is not supported yet — the details are in the OpenWRT guide.
Tainet works with either path: a WireGuard config for the stock client, a VLESS subscription for OpenWRT — one subscription, both formats, plus the same servers on your phone and your computer. Sign up through the Telegram bot or in your account on this site, from $0.10 a day.
Try it →Troubleshooting
The container won’t start. Three classic causes: device-mode is not confirmed (repeat step 1 and press the button), there is not enough space (check the storage and root-dir), or the image does not match your architecture (/system/resource/print → architecture-name, then pick the matching image tag).
The container runs but no traffic flows. Check the NAT rule for 172.17.0.0/24, the route in the routing table and the mangle rule — the three places where a packet usually gets lost. And make sure the link in VLESS_URL was copied in full.
Speed is lower than expected. Encryption inside the container loads the CPU: on the hAP ax series expect tens up to a hundred Mbps over VLESS realistically; for gigabit workloads look at RB5009/CCR. WireGuard is several times faster on the same devices — sometimes the right scheme is WireGuard by default plus VLESS for the devices that need stability.
Everything disappeared after a RouterOS upgrade. Check that the container package is installed for the new version, and restart the container.
Still not solved — write to support: we will advise for your specific model and configuration.
Frequently asked questions
Which MikroTik models are suitable for a VLESS container?
Any on ARM/ARM64/x86 with the ability to attach storage: hAP ax2/ax3, RB5009, CCR2004 and newer, the virtual CHR. Old MIPS models (hEX, hAP lite and the like) do not support containers — on those it’s WireGuard/OpenVPN only.
WireGuard or VLESS on MikroTik?
WireGuard is faster and simpler, and it is set up in 15 minutes without containers. VLESS is more stable on temperamental networks thanks to masquerading as HTTPS. The scheme many admins settle on: start with WireGuard, add a VLESS container once connectivity gets shaky. How the masquerading works — in the VLESS protocol breakdown.
Can I route only some of my devices through the VPN?
Yes, and that is MikroTik’s strong suit: change the conditions in the mangle rule — by device address, address-list or destination. The TV through the tunnel, the work laptop directly — that’s a routine task.
One subscription for the router and the phone — is that allowed?
Yes: a Tainet subscription is multi-device — the container on the router and Happ on your phone work off the same link. An overview of every platform is in the guide to devices.
If you want a service that gets along with MikroTik out of the box: a Tainet subscription carries both — a WireGuard config for the native path and VLESS/XHTTP links for the container, a free first week to try it out, from $0.10/day. Sign up in the Telegram bot or on this site in your personal account. Questions about your own setup — support is answered by real people.
