killdns/awg-socks5-router repository overview

⁠AWG SOCKS5 Router

AWG 3.1 client container that combines an IPv4 L3 gateway and a SOCKS5 server.

Source, issue tracker, and complete documentation: github.com/killdns/awg-socks5-router⁠

⁠Features

• userspace amneziawg-go 3.1; no host AWG kernel module required;
• L3 forwarding for routed IPv4 clients;
• optional MASQUERADE on awg0;
• SOCKS5 TCP CONNECT and UDP ASSOCIATE via HevSocks5Server;
• container-local traffic through AWG without routing the AWG outer socket into itself;
• linux/amd64, linux/arm64, and linux/arm/v7 images;
• compatible with Docker and MikroTik Container on supported hardware.

⁠Docker Compose

services:
  awg-router:
    image: killdns/awg-socks5-router:latest
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    sysctls:
      net.ipv4.ip_forward: "1"
      net.ipv4.conf.all.rp_filter: "0"
    environment:
      SOCKS_ALLOW_NO_AUTH: "1"
      ENABLE_NAT: "1"
      ROUTE_LOCAL_TRAFFIC: "1"
    volumes:
      - ./awg0.conf:/etc/amnezia/amneziawg/awg0.conf:ro
    ports:
      - "1080:1080/tcp"
      - "20000-20999:20000-20999/udp"

Mount a complete client profile generated for your AWG 3.1 server. The container reads normal awg-quick fields, including Address, DNS, MTU, header protection, content padding, timing ranges, and custom signature packets.

For safety, profile hooks and profile-managed routing are ignored. The entrypoint does not execute PreUp, PostUp, PreDown, or PostDown.

⁠SOCKS security

Use credentials:

SOCKS_USER=my-user
SOCKS_PASSWORD=my-password

Or explicitly opt in to no-auth mode:

SOCKS_ALLOW_NO_AUTH=1

The container will not start with empty credentials unless SOCKS_ALLOW_NO_AUTH=1 is set. Never expose an unauthenticated SOCKS endpoint to an untrusted network.

The default TCP port is 1080. UDP ASSOCIATE uses 20000-20999/udp by default.

⁠L3 behavior

Use the container IP as the next hop for client routes. Transit traffic enters the AWG policy table and leaves through awg0. ENABLE_NAT=1 translates client source addresses so the remote side only needs a return route to the AWG client address.

Private and special-use IPv4 destinations bypass the tunnel by default. Override LOCAL_BYPASS_CIDRS, or set it to an empty value to send every non-local IPv4 destination through AWG.

ROUTE_LOCAL_TRAFFIC=1 also tunnels traffic created inside the container. The dedicated AWG process UID remains on the ordinary uplink, preventing a recursive tunnel route. SOCKS uses a separate policy table and always exits through AWG.

⁠Main environment variables

See the full environment reference⁠ on GitHub.

⁠MikroTik

The manifest contains both linux/arm/v7 and linux/arm64. Create a veth network, mount a directory containing awg0.conf at /etc/amnezia/amneziawg, and use the container's veth IP as the L3 gateway or SOCKS endpoint. With one veth, interface names and the gateway are detected automatically. With exactly two interfaces, set OUTBOUND_GATEWAY; the matching uplink and remaining inbound interface are detected without relying on eth0/eth1 ordering. Set all three interface variables only for an ambiguous layout.

RouterOS 7.23.1 on arm/v7 has been checked for the required TUN, UID policy-routing, forwarding, and legacy MASQUERADE behavior.

⁠Limitations

• IPv4 routing only.
• Client/gateway only; this is not an AWG server manager.
• A valid AWG client profile is required.

Project license: MIT. Bundled software retains its upstream licenses.