blackxdog/openvpn-client-ros

•Updated 28 days ago

OpenVPN client for MikroTik RouterOS: ARMv5, ARMv7, ARM64 and AMD64/CHR with REST route sync.

Image

601

blackxdog/openvpn-client-ros repository overview

⁠openvpn-client-ros

Multi-architecture OpenVPN client for MikroTik RouterOS containers. It reconnects automatically and synchronizes VPN routes and firewall address lists through the RouterOS REST API.

⁠✨ Features

📦 One latest tag for linux/arm/v5, linux/arm/v7, linux/arm64, and linux/amd64.
✅ Supports ARM models, RB4011, RB5009, x86, and CHR.
🔄 Automatic OpenVPN reconnect with lifecycle messages in RouterOS logs.
🛣 Synchronizes server-pushed IPv4 networks with /ip/route.
🧾 Synchronizes the same networks with /ip/firewall/address-list.
🏷 Uses the container name or a custom ownership tag/comment.
♻️ Keeps valid records unchanged and removes stale owned records.
🔐 RouterOS REST over HTTPS with file-based secrets.
🪵 Logging levels: error, warn, info, debug.

⁠🧱 Supported platforms

MikroTik family	RouterOS arch	Docker platform
RB4011 and other ARM32 devices	`arm`	`linux/arm/v5`
Generic ARMv7	`arm`	`linux/arm/v7`
RB5009 and ARM64 devices	`arm64`	`linux/arm64`
CHR and x86-64	`x86_64`	`linux/amd64`

RouterOS expects ARM32/ARMv5 container images for its arm architecture.

⁠⚡ Get the image

docker pull blackxdog/openvpn-client-ros:latest

RouterOS automatically selects the correct architecture from the multi-platform manifest.

⁠🚀 RouterOS installation

Use the idempotent deployment script from GitHub:

Enable the RouterOS container package and device-mode container=yes.
Upload client.ovpn to usb1/openvpn-client-ros/config/ or openvpn-client-ros/config/ on system storage.
Download deploy-routeros.rsc⁠.
Upload it to RouterOS and run it from an interactive terminal; select usb1 or system.
Enter the VPN login and password when prompted; the REST API password is generated automatically.

/import file-name=deploy-routeros.rsc verbose=yes

Full instructions: README⁠ · README на русском⁠

⁠🌐 Traffic flow

LAN client
    ↓
RouterOS route → container veth IP
    ↓
container eth0 → forwarding + masquerade → tun0 → VPN

The route gateway is the container veth address, not the remote tunnel gateway.

⁠📁 Persistent mount

Only one mount is required:

usb1/openvpn-client-ros/config  →  /config

It stores client.ovpn, referenced certificates/keys, optional CA files, and secret files.

⁠⚙️ Main environment variables

ENV	Default	Purpose
`OVPN_CONFIG`	`/config/client.ovpn`	OpenVPN profile
`OVPN_USERNAME`	—	VPN username
`OVPN_PASSWORD_FILE`	—	Preferred VPN password file
`OVPN_RESTART_DELAY`	`10`	Restart delay after OpenVPN exits
`OVPN_LOG_LEVEL`	`info`	Container logging level
`OVPN_API_URL`	—	RouterOS REST URL
`OVPN_API_USER`	—	RouterOS REST user
`OVPN_API_PASSWORD_FILE`	—	Preferred REST password file
`OVPN_API_VERIFY_TLS`	`true`	Verify HTTPS certificate
`OVPN_CONTAINER_NAME`	`ovpn-client-ros`	Identity and default tag
`OVPN_ROUTE_TAG`	empty	Custom ownership comment
`OVPN_SYNC_ROUTES`	`true`	Synchronize RouterOS routes
`OVPN_SYNC_ADDRESS_LIST`	`true`	Synchronize address list
`OVPN_ADDRESS_LIST_NAME`	empty	Empty uses container name
`OVPN_ROUTE_TABLE`	`main`	Target routing table
`OVPN_ALLOW_DEFAULT_ROUTE`	`false`	Allow pushed default route
`OVPN_EXTRA_ROUTES`	empty	Extra space-separated CIDRs

Legacy ROS_* route-synchronization names remain accepted as compatibility aliases.

⁠🛠 Diagnostics

/container/print
/log/print where topics~"container"
/ip/route/print where comment="ovpn-client-ros"
/ip/firewall/address-list/print where comment="ovpn-client-ros"

⁠🛡 Security

Use dedicated VPN and RouterOS REST accounts.
Restrict REST access to the isolated container address.
Prefer www-ssl; plain HTTP should only be an isolated fallback.
Store passwords with OVPN_PASSWORD_FILE and OVPN_API_PASSWORD_FILE.
Never bake private profiles, keys, or password files into the image.

⁠💖 Support

If this image saves you time, you can support development on Boosty⁠.

Source code and documentation: github.com/blackxd0g/openvpn-client-ros⁠

Tag summary

Recent tags

Content type

Image

Digest

sha256:a50e567d7…

Size

19.3 MB

Last updated

28 days ago

docker pull blackxdog/openvpn-client-ros