plotin/xray-gw-mikrotik repository overview

#MikroTik: env

/container/envs add list=xvr key=SERVER_ADDRESS value="IP_SERVER_XRAY" add list=xvr key=SERVER_PORT value="443" add list=xvr key=USER_ID value="USER_ID" add list=xvr key=ENCRYPTION value="none" add list=xvr key=FINGERPRINT_FP value="chrome" add list=xvr key=SERVER_NAME_SNI value="www.cloudflare.com⁠" add list=xvr key=PUBLIC_KEY_PBK value="PUBLIC_KEY_PBK" add list=xvr key=SHORT_ID_SID value="SHORT_ID_SID"

#MikroTik: veth/container

/interface/veth/add name=veth-xray address=172.17.10.2/24 gateway=172.17.10.1

/interface/bridge/add name=br-containers /ip/address/add address=172.17.10.1/24 interface=br-containers /interface/bridge/port add bridge=br-containers interface=veth-xray

/container/add
remote-image=registry.docker.io/plotin/xray-gw-mikrotik:latest
interface=veth-xray
root-dir=/usb1/images/xray-gw
envlists=xvr
dns=172.17.10.1
hostname=xray-gw
start-on-boot=yes
logging=yes

#MikroTik: маршрут и mangle

/ip/route/add dst-address=IP_ADDRESS_XRAY/32 gateway=IP_ADDRESS_GW_INTERNET comment="xray server via WAN"

#таблица для non-RU

/routing/table/add fib name=sweden

/ip/route/add dst-address=0.0.0.0/0 gateway=172.17.10.2 routing-table=sweden distance=1 check-gateway=ping

/ip/firewall/mangle add chain=prerouting src-address=192.168.88.0/24 dst-address-type=!local dst-address-list=!ru in-interface=bridge action=mark-routing new-routing-mark=sweden passthrough=no comment="non-RU via xray-gw"

add chain=forward out-interface=br-containers protocol=tcp tcp-flags=syn action=change-mss new-mss=clamp-to-pmtu comment="MSS to xray-gw" add chain=forward in-interface=br-containers protocol=tcp tcp-flags=syn action=change-mss new-mss=clamp-to-pmtu comment="MSS from xray-gw"

/ip/firewall/filter add chain=forward in-interface=br-containers action=accept comment="xray-gw forward" add chain=forward out-interface=br-containers action=accept comment="xray-gw return"

/ip/firewall/nat add chain=srcnat src-address=192.168.88.0/24 out-interface=br-containers action=masquerade comment="LAN -> xray-gw" add chain=srcnat src-address=172.17.10.0/24 action=masquerade comment="xray-gw -> WAN"

#Test

/log/print where topics~"container" /ip/firewall/connection/remove [find] /ip/firewall/connection/print where dst-address="IP_SERVER_XRAY"