RouterOS 7 supports containers compatible with Docker Hub and Quay images, allowing for the deployment of VPN services directly on MikroTik hardware. This approach eliminates the need for a dedicated Linux machine when specific protocols like SoftEther or OpenConnect are required.
The setup process involves enabling the container package, authorizing device-mode, and configuring a bridge with veth interfaces. Each container requires a specific network configuration, with traffic managed through dst-nat and masquerade rules within the router's firewall.
SoftEther VPN can be deployed using the official image. Administrators must manage storage mounts carefully to ensure configuration persistence across updates. The service supports both SecureNAT for internal DHCP and cascade connections for L2 network integration.
Deploying ocserv requires additional configuration for routing and NAT. Since the container manages its own TUN and iptables, users must adjust environment variables and routing rules to ensure proper traffic flow and prevent address conflicts with the router's internal network.
While containers provide flexibility for specific VPN protocols, they are best used when built-in options like WireGuard or OpenVPN are insufficient. The implementation does not require privileged mode, maintaining security for the router's core system.
