Running V2Ray (or its modern superset, Xray-core) on MikroTik devices is primarily achieved through Docker containers
, as RouterOS does not currently support these protocols natively. This setup is highly popular for bypassing aggressive internet censorship in regions like Iran, China, and Russia due to V2Ray's ability to disguise traffic as standard HTTPS. MikroTik community forum Core Implementation: The Container Method
The most effective way to deploy V2Ray on MikroTik is by leveraging the feature introduced in RouterOS v7. Requirements
: You need an ARM or x86-based MikroTik router (e.g., hAP ax series, RB5009, or CHR). Small MIPSBE devices generally cannot run containers.
: It is highly recommended to use an external USB drive for the container's root directory to save internal flash memory. Configuration Pull Image : Use images like teddysun/v2ray xtls/xray-core Network Setup : Create a
interface and a bridge to allow the container to communicate with the router's internal network. Policy Based Routing (PBR) Mangle rules
in MikroTik to redirect specific traffic (e.g., filtered websites) toward the container's IP. MikroTik community forum Performance and Comparison V2Ray/Xray (Container) Native VPN (WireGuard/L2TP) Extremely hard to detect (DPI-resistant) Easily detected by deep packet inspection Performance Can see 20–40% speed impact due to container overhead High performance with hardware acceleration Complexity High (requires CLI and container knowledge) Low (native GUI menus) Depends on container resource limits Highly stable Security and Risks
Deep packet inspection to classify V2Ray traffic #569 - GitHub v2ray mikrotik
To use V2Ray on MikroTik routers, you must utilize the Container feature introduced in RouterOS v7, as there is currently no native support for the V2Ray protocol. This allows you to run a V2Ray or Xray client within a virtualized environment on the router to bypass deep packet inspection (DPI) or censorship. 1. Prerequisites
RouterOS v7.x: Ensure your firmware is updated to version 7 or later.
Hardware Support: Your router must have an ARM, ARM64, or x86 CPU. MIPSBE devices generally do not support containers.
Container Package: The container package must be installed and enabled on your device. 2. Implementation Methods
There are two primary ways to set this up, depending on your technical comfort level:
Docker Containers (Recommended): Use a pre-built image such as teddysun/v2ray. Users on the MikroTik Forum have documented success using these images to run Xray/V2Ray clients.
SOCKS5/HTTP Proxy Tunnels: You can set up the container to act as a local SOCKS5 proxy. You then use MikroTik's firewall rules to redirect specific traffic to this proxy. Detailed environment variable setups for this method can be found on this GitHub Gist for V2Ray on MikroTik. 3. Configuration Steps Running V2Ray (or its modern superset, Xray-core) on
Enable Container Mode: You must manually enable the container feature via the console (/system/device-mode/update container=yes) and follow the physical trigger (reset button) requirement for security.
Set Up VETH and Bridge: Create a virtual ethernet interface (VETH) and a bridge to allow the container to communicate with the router's internal network.
Environment Variables: Define your server's details (address, port, UUID, and protocol like VMess or VLESS) within the container's environment settings. Refer to the Project V Official documentation for specific command-line arguments and configuration structures.
Routing: Use /ip/firewall/mangle rules to "mark" traffic you want to send through the V2Ray tunnel and use a custom routing table to send that traffic to the container's IP. 4. Community Resources
Discussion & Troubleshooting: The MikroTik community forum provides active threads where users share their config.json templates and solve architecture-specific errors.
Alternative Tools: For specific protocols like VLESS, some users recommend looking into NTC (No Thought is a Crime) for "universal" VPN containers designed specifically for MikroTik environments.
VLESS Guides: If you specifically need VLESS support, this Gist for VLESS on MikroTik covers common pitfalls like link formatting and server parameter changes. MikroTik as a Transparent Proxy Gateway (Most Common)
Here are the key features of using V2Ray on MikroTik (RouterOS) :
Since RouterOS v7, MikroTik has supported containers. If you own a RB5009, CCR2004, or hAP ax系列, you can run a lightweight V2Ray container directly on the router.
MikroTik RouterOS does NOT natively support the V2Ray protocol (VMess, VLESS, Trojan, etc.). You cannot configure a standard V2Ray client directly on a RouterOS device.
However, there are three practical ways to make them work together:
This requires iptables inside the container. Most reliable on RouterOS 7.13+.
"protocol": "dokodemo-door" for inbound TPROXY).Simpler alternative for most users:
MikroTik routers are renowned for their robustness and the flexibility of RouterOS. However, as network censorship and content filtering become more sophisticated, standard VPN protocols (like PPTP, L2TP, and even standard WireGuard) are easily identified and blocked by deep packet inspection (DPI).
V2Ray (Project V) has emerged as a leading proxy platform designed to bypass these restrictions through obfuscation and multiple transport protocols. While MikroTik does not natively support V2Ray as a client or server within RouterOS, it is possible to run V2Ray on MikroTik hardware using containerization (on newer ARM devices) or by integrating MikroTik with an external V2Ray server.
This article details the architecture, methods, and configuration steps required to run V2Ray in a MikroTik environment.