If container not supported:
Due to the complexity and variations in configurations, we will outline the general approach:
Unlike Socks or HTTP proxy, TPROXY preserves the original destination IP. This means CDNs, banking apps, and gaming traffic work flawlessly.
/ip route add gateway=192.168.88.10 routing-mark=v2ray-mark
The container has its own IP (e.g., 172.17.0.2).
To route traffic from LAN clients through V2Ray, you need to set up policy routing:
MikroTik does not support V2Ray natively.
The cleanest integration is transparent proxying to a dedicated V2Ray client box.
For native support, consider other routing platforms (OpenWrt, pfSense, OPNsense) or use WireGuard as a simpler alternative.
Would you like a detailed configuration example for transparent proxy with MikroTik + Xray?
Configuring V2Ray on MikroTik RouterOS: A Comprehensive Guide
In the current landscape of network security, bypassing restrictions and ensuring privacy have become paramount. While V2Ray is a powerful platform for building custom proxy servers, MikroTik RouterOS is arguably the most versatile networking operating system for managing traffic. Combining the two allows you to create a secure, high-performance edge router that handles obfuscation, bypassing restrictions, and routing at the network level, rather than on individual devices.
This guide explains why you should use V2Ray on MikroTik, the prerequisites, and a step-by-step approach to setting it up using modern Docker container features. Why Use V2Ray on MikroTik?
Running V2Ray directly on a MikroTik router (via Container) offers several advantages over running it on computers or phones:
Network-Wide Coverage: Once configured, every device connected to your network (smart TVs, IoT devices, guests) automatically uses the V2Ray proxy. v2ray mikrotik
Performance: MikroTik devices, especially those with modern CPUs (ARM/ARM64), can handle complex encryption, reducing the strain on endpoints.
Advanced Routing: You can use MikroTik's robust firewall mangle rules to decide exactly which traffic goes through V2Ray and which goes through your ISP, based on IP address, domain, or port.
Bypassing Restrictions: V2Ray is highly effective at obfuscating traffic to bypass firewall restrictions. Prerequisites
MikroTik Router with ARM/ARM64 CPU: V2Ray runs in a Docker container, requiring hardware that supports the container package (e.g., hAP ax2/ax3, RB4011, RB5009).
RouterOS Version 7.4+: Ensure your router is updated to support containerization.
V2Ray Server Details: You need the IP, Port, UUID, AlterId, and Transport settings (VMess/VLESS) from your V2Ray service provider.
USB Drive or Internal Storage: For storing the container image. Step-by-Step Implementation
Because RouterOS is a networking OS, the setup involves creating a container for V2Ray and then routing traffic through it using traditional NAT and firewall rules. 1. Enable Container Functionality
First, ensure the container package is installed and enabled, and that you have enabled container support in settings.
/system/package/print # Ensure container is enabled. If not, install and reboot. /system/device-mode/update container=yes Use code with caution.
Note: A physical reboot is required to enable container mode. 2. Configure Virtual Ethernet (veth) If container not supported:
Create a bridge for the containers and a virtual ethernet interface to act as the "bridge" between MikroTik and the V2Ray container.
/interface/bridge/add name=docker-bridge /interface/veth/add name=veth1 address=172.17.0.2/24 gateway=172.17.0.1 /interface/bridge/port add bridge=docker-bridge interface=veth1 /ip/address/add address=172.17.0.1/24 interface=docker-bridge Use code with caution. 3. Setup NAT and Firewall (Routing)
To allow the container to access the internet to connect to your V2Ray server, you must set up Source NAT.
/ip/firewall/nat/add chain=srcnat action=masquerade src-address=172.17.0.0/24 Use code with caution. 4. Create and Configure the V2Ray Container
You will need a lightweight V2Ray image (like v2fly/v2fly-core). You must create a configuration file (config.json) and mount it to the container.
/container/mounts/add name=v2ray_conf src=/path/to/your/config.json dst=/etc/v2ray/config.json /container/add remote-image=v2fly/v2fly-core:latest interface=veth1 root-dir=disk1/v2ray mounts=v2ray_conf Use code with caution.
Crucial Step: You must prepare a valid config.json file for your V2Ray server and ensure it is placed on the router's storage. 5. Routing Client Traffic (Mangle & Routing Table)
To make your local network traffic go through the container, you need to use mangle to mark traffic and a specific routing table to direct it.
# 1. Add Routing Table /routing/table/add name=to-v2ray fib # 2. Mark Routing (e.g., from a specific IP) /ip/firewall/mangle/add chain=prerouting src-address=192.168.88.50 action=mark-routing new-routing-mark=to-v2ray # 3. Add Rule to route marked traffic to the container /ip/route/add dst-address=0.0.0.0/0 gateway=172.17.0.2 routing-table=to-v2ray Use code with caution. Important Considerations
DNS Leaks: Ensure that your local clients are not leaking DNS queries to your ISP. Configure your V2Ray config file to handle DNS, or use RouterOS to force DNS queries through the proxy.
Resource Usage: V2Ray can be resource-intensive. Monitor your CPU usage using /tool/profile. Choose transport based on threat model and ISP filtering
Auto-Start: By default, containers will start when the router boots up.
By setting up V2Ray on MikroTik, you achieve a high level of security and flexibility that cannot be matched by simple endpoint applications. If you're setting this up, let me know: Which MikroTik model are you using (e.g., hAP ax3, RB5009)? Are you using VMess or VLESS?
I can provide the specific config.json template for your setup. V2ray Client on Mikrotik - GitHub Gist
Running V2Ray (or its modern superset, Xray-core) on MikroTik devices is primarily achieved through Docker containers
, as RouterOS does not currently support these protocols natively. This setup is highly popular for bypassing aggressive internet censorship in regions like Iran, China, and Russia due to V2Ray's ability to disguise traffic as standard HTTPS. MikroTik community forum Core Implementation: The Container Method
The most effective way to deploy V2Ray on MikroTik is by leveraging the feature introduced in RouterOS v7. Requirements
: You need an ARM or x86-based MikroTik router (e.g., hAP ax series, RB5009, or CHR). Small MIPSBE devices generally cannot run containers.
: It is highly recommended to use an external USB drive for the container's root directory to save internal flash memory. Configuration Pull Image : Use images like teddysun/v2ray xtls/xray-core Network Setup : Create a
interface and a bridge to allow the container to communicate with the router's internal network. Policy Based Routing (PBR) Mangle rules
in MikroTik to redirect specific traffic (e.g., filtered websites) toward the container's IP. MikroTik community forum Performance and Comparison V2Ray/Xray (Container) Native VPN (WireGuard/L2TP) Extremely hard to detect (DPI-resistant) Easily detected by deep packet inspection Performance Can see 20–40% speed impact due to container overhead High performance with hardware acceleration Complexity High (requires CLI and container knowledge) Low (native GUI menus) Depends on container resource limits Highly stable Security and Risks
Deep packet inspection to classify V2Ray traffic #569 - GitHub
ARM devices with limited RAM (256MB) may OOM-kill the container. Add swap on USB:
/system/swap/add file=/disk1/swap size=512MB