AmneziaWG Container for MikroTik Routers Delivers Top Performance Six Months After Launch
AmneziaWG container for MikroTik routers has evolved significantly since its initial release in February 2026. The project now provides the smallest and fastest implementation of the AmneziaWG protocol on these devices, weighing only 94.7 KB while achieving nearly 300 Mbit/s on Hap Ax3 and 200 Mbit/s on Hap Ax2.
How the Container Works
AmneziaWG consists of 80 percent standard WireGuard and 20 percent custom obfuscation. The container uses MikroTik's hardware-accelerated WireGuard for encryption and implements the remaining AmneziaWG features in software. This approach supports protocol versions 1.0 through 3.1 and allows full routing control directly on the router.
Performance Gains and Code Rewrite
Originally written in Go, the container was later rewritten in C using Claude Code. The change reduced size from 5 MB to 80-90 KB and increased throughput by 50 percent. A separate repository preserves the original Go version. RouterOS 7.24 introduced the privileged=yes parameter, enabling larger network buffers up to 32 MB on multi-core devices and 16 MB on dual-core models. This removed previous throughput limits caused by the 416 KB interface buffer.
Key Features Added
- Server mode for linking multiple MikroTik routers via AmneziaWG.
- Random port ranges and periodic port hopping to reduce server detection risk.
- Full IPv6 support in both client and server modes, including dual-stack DNS resolution.
- Dynamic DNS hostname support with automatic reconnection on IP change.
- Selective routing for RU address ranges.
- MTU auto-adjustment based on S4 padding values.
- Offline configuration generator that never sends data externally.
- Auto-recovery options for WARP client use cases.
Protocol Updates and MTU Considerations
Support for AmneziaWG 2.0 added random padding sizes. Version 3.0 introduced traffic pattern imitation for protocols such as QUIC. Recommended S4 values of 12-16 preserve usable MTU; higher values significantly reduce payload capacity. The container now correctly clears the DF flag on PPPoE links to avoid fragmentation issues.
Project History and Availability
An early GitHub ban occurred after test scripts attempted external connections during CI builds. The issue was resolved by removing those tests, and the current repository has remained stable. A Telegram bot was also created to generate Amnezia configs without direct SSH access to servers. The project currently holds more than 370 stars and continues to receive updates focused on stability and performance.
Related articles
Rostelecom Refactors InfoSec Careers: Matching Employee Skills to Evolving Business Priorities
Rostelecom's information security block developed a systematic approach to reassess employee expertise and redirect talent to new roles when business structures change rapidly. In one case, an architect hired for a specific team was reassigned after the unit was disbanded, initially moving to a similar position that did not fully align with his broader competencies. HR-business partner Olga Lapshina examined the specialist's full background, including prior work in audits, methodology development, regulatory documentation, university teaching, and scientific research, plus strong mentoring abilities with younger staff. These skills matched the needs of the methodology department, leading to a transfer supported by an individual development plan and a mentor via the internal Tochka Rosta platform. Within two months the employee contributed improvements that accelerated preliminary InfoSec audits by 30 percent and risk assessments by 20 percent while expanding threat scenario coverage by 10 percent. The initiative demonstrates Rostelecom's emphasis on horizontal career movement and retention of experienced professionals through structured career tracks.
How to Avoid Becoming the Hero of 'My Program Deleted 800 GB': Safe Recursive Deletion in Bash and Python
A recent Habr article examines dangerous patterns in recursive file deletion scripts that have caused massive data loss incidents, including an 800 GB wipe triggered by Telegram Desktop on Windows. The piece analyzes classic mistakes such as empty variables in rm commands and extra spaces that turned single paths into multiple destructive arguments, referencing the 2015 Steam Linux bug and the 2011 Bumblebee installer error. It provides hardened Bash templates using set -euo pipefail, ${VAR:?} checks, realpath validation, and --one-file-system flags to prevent deletion of forbidden directories or symlinked targets. The Python section introduces a safe_rmtree wrapper that enforces root boundaries, rejects symlinks, uses resolve(strict=True), and checks shutil.rmtree.avoids_symlink_attacks before proceeding. Additional recommendations include dry-run modes, marker files, temporary directory usage, and logging to make deletion operations auditable and reversible where possible.
Hackers tamper with refrigeration units in European supermarkets, setting temperatures to +50 °C
Attackers gained unauthorized access to refrigeration and freezer control systems in supermarkets across several European countries, including Sweden, Belgium, Luxembourg, and Estonia. In multiple locations they altered temperature settings to +50 °C, risking widespread spoilage of perishable goods. The incidents primarily affected older, unpatched Danfoss controllers that had been connected to networks for remote maintenance. Estonian manufacturer Kitman Coldtech reported that one attack on a legacy Danfoss system was detected and stopped within approximately ten minutes, preventing any damage. Similar intrusions were confirmed by Swedish chains ICA and Coop, following earlier incidents in French supermarkets in October that resulted in product losses. Experts note that legacy industrial controllers remain attractive targets because they are often left exposed once placed online for convenience.
Building Resilient DoH Failover on MikroTik RouterOS to Handle Unreachable Cloudflare Responses
A network administrator encountered a persistent issue in a branch office where pages like Tailwind CSS CDN failed to load despite valid DNS responses from Cloudflare DoH. The problem stemmed from unreachable IP addresses such as 8.6.112.0 and 8.47.69.0 returned by the resolver, which RouterOS treated as healthy because it only checked for valid IP types rather than route reachability. RouterOS supports only a single active DoH upstream via the use-doh-server parameter, requiring custom scripting for failover between multiple endpoints like Cloudflare and dns.google. The solution involved static DNS entries for bootstrap addresses, certificate trust anchors including SSL.com TLS ECC Root CA 2022, and a health monitor script that probes using DNS-JSON API calls instead of switching the resolver directly. Multiple iterations addressed issues like cache-based false positives, plain DNS fallback risks from provider spoofing, and clock validation to prevent certificate failures. The final implementation uses thresholds for failure and recovery to avoid flapping and ensures post-switch verification before committing to a backup endpoint.