anvarsoft/mikrotik_mihomo-webui repository overview

This is an extended version of the anvarsoft/mikrotik_mihomo image.

Web UI for mihomo config management

• Config editor: Ace editor with YAML highlighting, live syntax check, search and line wrap; plain textarea mode for mobile. Upload/download config.yaml.
• Quick list: add or remove proxied domains (quick-list rule provider) without editing the config manually.
• Validate & apply: every change is checked (mihomo -t + network mode compatibility) before applying; mihomo restarts with the new config.
• Automatic rollback: if the new config fails to start, the previous working version is restored; on boot the container falls back to the last working backup.
• Backups: each apply saves the previous version; view, diff against the current config, restore or delete any backup.
• Logs: live mihomo and supervisor logs with filters and search (in-memory, nothing written to disk).
• mihomo panel: link to the dashboard (zashboard) and API secret; one-click secret generation if the API is open.

Without the WEBUI_PASS variable, the image works exactly like the base mikrotik_mihomo image.

The configuration directory on the router must be mounted as a whole (not as an individual file) to /root/.config/mihomo.

If config.yaml does not exist in the mounted directory, a configuration is created automatically. The type depends on MIHOMO_SUB_URL.

The MIHOMO_SUB_URL variable is not set or is missing, the starter configuration is created:

• All traffic goes directly (MATCH,DIRECT): client network connectivity works immediately, without a proxy;
• The inbound traffic port depends on the mode: tproxy-port: 7894 or redir-port: 7892 with TUN;
• The API for zashboard and metacubexd is available on port 9090; the secret is taken from MIHOMO_SECRET or generated randomly.

While the starter configuration is active, the web interface displays a banner with the API address and secret. Upload your own configuration using the "Upload file" button, or edit the starter configuration and click "Apply".

If config.yaml is deleted after the container has already been running, the file is restored from the last applied version.

MIHOMO_SUB_URL is set — a working configuration is created from a subscription-based template:

• The subscription is configured as a proxy-providers entry (updated daily) with an x-hwid header unique to this installation;
• Groups: 🌍 VPN (server selection or ⚡️ Fastest), ▶️ YouTube, ⚡️ Fastest (fastest server), ♻️ Direct;
• The quick-list, YouTube, Telegram, WhatsApp, ru-bundle, and Cloudflare lists are routed through the VPN; ads are blocked, and all other traffic goes directly; mihomo DNS listens on 0.0.0.0:53; domains from the lists resolve to addresses in the 198.18.0.0/16 range (fake-ip);

The zashboard dashboard is downloaded automatically and is available at http://:9090/ui/.

Mikrotik settings for point routing (for example, the mihomo container address is 172.17.0.2).

/ip dhcp-server network
set [find] dns-server=172.17.0.2

/routing table
add disabled=no fib name=to_vps

/ip route
add comment="mihomo fake-ip" disabled=no distance=1 \
    dst-address=198.18.0.0/15 gateway=172.17.0.2 \
    routing-table=main scope=30 target-scope=10

add comment="cf & tg & fb in mihomo" disabled=no distance=1 \
    dst-address=0.0.0.0/0 gateway=172.17.0.2@main \
    routing-table=to_vps scope=30 target-scope=10

/ip firewall mangle
add action=mark-connection chain=prerouting \
    comment="cloudflare to_vps" connection-state=new \
    dst-address-list=cloudflare in-interface-list=LAN \
    new-connection-mark=to_vps

add action=mark-connection chain=prerouting \
    comment="telegram to_vps" connection-state=new \
    dst-address-list=telegram in-interface-list=LAN \
    new-connection-mark=to_vps

add action=mark-connection chain=prerouting \
    comment="meta_ips to_vps" connection-state=new \
    dst-address-list=meta_ips in-interface-list=LAN \
    new-connection-mark=to_vps

add action=mark-routing chain=prerouting \
    comment="cf & tg & fb to_vps" connection-mark=to_vps \
    in-interface-list=LAN new-routing-mark=to_vps

/ip firewall filter
add action=accept chain=forward comment="mihomo fake-ip" \
    dst-address=198.18.0.0/15

ip firewall filter in the fasttrack rule add the connection-mark=no-mark parameter

It is also necessary to create lists in the ip firewall address-list with the names: cloudflare, telegram, meta_ips, including the IP addresses of the corresponding resources.
!!! Lists must be created before executing the commands above.

• https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/meta/geo/geoip/cloudflare.list⁠
• https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/meta/geo/geoip/telegram.list⁠
• https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/meta/geo/geoip/facebook.list⁠ (meta_ips)

Terminal command template, change the list name and list of IP addresses.

{
:local listName "list_name" # cloudflare, telegram, meta_ips
:local addrs {
"192.168.1.10";
"192.168.1.20";
"10.0.0.0/24"
}
:foreach a in=$addrs do={/ip firewall address-list add list=$listName address=$a}
}