MikroTik vs OpenWrt as a VPN router

Both routers get the same VPN client in two shapes: on a MikroTik it is a container that RouterOS runs, on OpenWrt it is an ordinary package. Everything else in this comparison hangs off that one difference.

The ForestVPN router client comes from one codebase. We read its code and router help pages on the drafting date to put the results side by side, including the notes where our own pages say a recipe is not finished. This is not a review of the two operating systems, and it is not a flashing guide.

MikroTik or OpenWrt: which should you pick for a VPN router?

Pick by the router you already own, because the recipe for each needs that router's own tools. If you own a MikroTik running RouterOS 7.21 or later with the container package, use the container recipe. If you own an OpenWrt router on 21.02 or newer, use the package. If you are buying a router for this, check the board against each side first.

For MikroTik you want RouterOS 7.21 or later with the container package, on arm, arm64 or x86. The MikroTik download page says the image is built for all three and verified on real arm64 hardware, and the install page records a cAP ax. Enabling container mode needs physical access to the router, and small-flash boards such as the hAP ac2 need their own flash folder recipe.

On the OpenWrt side you want OpenWrt 21.02 or newer on an ARM or x86-64 processor, with MIPS only for the chips the install recipe lists. Look up the board's target platform mark on the OpenWrt download page before you buy: it says whether that build was tried on real hardware, built and tried in a lab, built only, or not yet tried.

Reach for the MikroTik recipe if:

• you already write RouterOS configuration and want to say exactly which traffic leaves through the tunnel, including a list of apps or services by hostname and port;
• you are comfortable pasting rules and checking packet counters afterwards.

The OpenWrt recipe fits if:

• you want to link the router, pick devices and set a kill switch on screens in LuCI, OpenWrt's web interface;
• you may run passwall2, podkop, pbr or mwan3 (other OpenWrt routing packages) beside it, since the coexistence page lists which pairs were tried.

Neither is easier; they hand you different chores.

How do MikroTik and OpenWrt compare as a VPN router?

The MikroTik recipe asks you to run a container and to write the routing yourself, while the OpenWrt recipe asks you to install a package and then answer four screens. The matrix below was read from our repository on 2026-10-16, and the box under it says what that means.

How does each one install?

Each starts from a single install step, and the difference is who finishes the job afterwards.

MikroTik

Paste the install block from the download page. It gives the container its own network path, pulls a pinned image and mounts its state so a restart does not drop the router off your account.

The image is suquant/fvpn, which is the account-managed client. A second image, suquant/fvpnq, is raw tunnelling from a config file; it is what an exit node runs, not the account-managed client this article covers.

For a phone on the LAN to reach the container's status page, the MikroTik has to be the network's default gateway. If it sits downstream of another router, the install detects that and asks for one extra setting, according to the MikroTik setup page.

OpenWrt

The install page lists what is published and nothing else. Run cat /etc/openwrt_release to find your release and target platform.

• OpenWrt 24.10 and older use opkg and take the install file.
• OpenWrt 25.12 and newer use apk and take the one command, whose script hash is printed beside it.

This package adds ForestVPN's signed software source and does not touch your wan or lan settings. The OpenWrt install recipe refuses a router that cannot run the client before it changes anything.

First run

On MikroTik, the container prints a pairing code to /log before it has any network reachability, and you type it into the app on a phone that already has your account number.

Next, the OpenWrt package walks you through first run. If the router has no administrator password it asks for one first. Then come four screens:

1. A confirmation that names the router and changes nothing.
2. An account: code, account number or none.
3. Which devices.
4. A location with a kill switch level.

Until you press Turn on protection on the last screen, nothing on your network changes.

How do you choose which devices use the tunnel?

On OpenWrt you choose devices; on MikroTik you choose whatever you can describe in a RouterOS rule. That is the sharpest difference between the two.

MikroTik: rules you write

Out of the box, a MikroTik container tunnels the router's own traffic the moment it connects and nothing else. Sending LAN traffic through it is ordinary RouterOS work:

• mangle rules, RouterOS's packet-marking rules;
• a routing table of its own;
• a firewall rule that keeps marked connections out of fasttrack, RouterOS's shortcut for established connections, which skips those rules.

Three recipes sit on the choose-traffic page: a group of apps or services you list by hostname and port, everything from the LAN, and a kill switch.

Put the rules on the box that routes your LAN, which may not be the box running the container. The page measured this on a cAP ax whose default route was an upstream router: the container tunnelled fine and no LAN client's traffic ever reached it.

OpenWrt: a device menu

OpenWrt's package picks by hardware address in three modes, set under Services > ForestVPN > Devices:

• Every device: the whole home.
• Only the devices I choose: tick the ones that use the tunnel.
• Every device except the ones I choose: a new device is protected by default, which is the mode that does not leak when a phone rotates its private Wi-Fi address.

A device menu cannot see inside a device. The device modes page says it plainly: ForestVPN chooses by device, never by website or app on OpenWrt. For site rules you let passwall2, podkop or pbr route into fvpn0, and the coexistence page marks podkop and pbr as not tested end to end.

On both, every device behind the router shares one location and one plan. The pricing page has the plan facts:

What does the kill switch cover on MikroTik and on OpenWrt?

Both kill switches stop selected traffic instead of letting it fall back to your normal connection, and neither is absolute. The wording below follows each page.

OpenWrt

OpenWrt's kill switch has two halves that fail independently, according to the kill switch page:

• A routing half sends protected devices into a table whose only ways out are the tunnel or nowhere.
• A firewall half is ordinary OpenWrt firewall configuration, which the firewall rebuilds on every reload.

Under Standard, protected devices go direct in listed cases such as a pause, a sign-out or a firmware upgrade; only Strict never sends a protected device direct. The router's own traffic and devices set to Direct (the per-device switch that keeps a device off the tunnel) are outside it.

Protected devices' IPv6 is carried or refused and never sent around the tunnel. On 21.02 (fw3) the whole LAN's forwarded IPv6 is refused while protection is on.

MikroTik

The MikroTik side is three rules you add after your routing recipe, per the MikroTik kill switch page:

• Rule one: a route to the container that counts only while it answers a ping.
• Rule two: a blackhole route at a higher distance.
• Rule three: a forward-chain drop for the leak a live-but-disconnected container would cause, per the MikroTik kill switch page.

Rule three must sit above the fasttrack exemption or it is never reached. There is also a stricter form for devices that may only ever use the tunnel.

Two limits: it covers the traffic you selected, not the rest of your network, and it is IPv4 only, so the IPv6 check in step 5 of that page is yours to act on.

How do updates and removal compare?

MikroTik updates are manual and deliberate, and OpenWrt's are a button.

Updating

The install pins an exact image tag on MikroTik and RouterOS never pulls another one by itself, as the update recipe puts it. To move to a new tag you remove the container, add it again with the new tag and start it. The tunnel is down while the container is removed, and the identity survives because it lives in the mount on the router.

On OpenWrt, ForestVPN looks for updates twice a day and you press Update; protected devices have no internet for about a minute while it installs, per the update and uninstall page. A firmware upgrade removes added software, ForestVPN included; ForestVPN then installs itself again once the router is online. If you use Attended Sysupgrade or owut, that page has the exact error and the workaround.

Removing

Removal on OpenWrt is apk del forestvpn or opkg remove forestvpn, and it puts back the network and firewall settings the install added. The router's key stays, so a reinstall is the same device on your account; press Sign out on the Account page first to end that.

On MikroTik, per the download page, you stop and remove the container, then delete its veth and address. The device stays on your account until you remove it in the app. The choose-traffic rules each carry a comment starting fvpn:, so one remove [find comment~"^fvpn:"] per menu clears them without touching the container's own objects, plus the via-fvpn routing table, which has no comment and is removed by name.

Boards with only a small flash folder, such as the hAP ac2, have their own flash folder recipe: the image is pulled again at every boot, so a router that boots without internet has no tunnel until the pull finishes.

Which MikroTik and OpenWrt recipes are verified on hardware?

The MikroTik install is the only page whose note says it was verified on real hardware. Every other page except choose-traffic opens with a note saying it is not yet verified on hardware, and choose-traffic opens with no note at all. The table below is the state each page was in when we read it.

Every row comes from the MikroTik install, OpenWrt install and sibling help pages linked above. Nobody has yet followed the OpenWrt steps on a router of every kind the install page lists, and the MikroTik kill switch has never had its stop-and-test run on a router.

Which is faster for a VPN, MikroTik or OpenWrt?

We have one throughput figure and it belongs to MikroTik. On two physical MikroTik routers on 2026-09-01, our tunnel core moved 122 Mbit/s where RouterOS's own kernel WireGuard-protocol tunnel moved 66.8 Mbit/s, with the method and the two different traffic generators laid out in the throughput post. That is bound to that hardware and that date.

The loss: round-trip time went the other way, 1.22 ms for our core against 0.92 ms for the kernel tunnel, and each figure is a single run.

OpenWrt has never been timed here, so this article prints no OpenWrt figure and does not borrow the MikroTik one. The first-run page says router speed is not measured for most models.

Can you run OpenWrt on a MikroTik router?

Sometimes. It is a separate decision from this one. OpenWrt keeps its own table of hardware, with a MikroTik section, so check it for your exact board. If you flash OpenWrt on it, you are on the OpenWrt recipe; if you keep RouterOS, you are on the container recipe. Never both on one box. MikroTik's own RouterOS documentation has a Container page for the MikroTik side.

The tunnel itself works the same on both: an unmodified Noise_IKpsk2 handshake, the one WireGuard's protocol page specifies, run by Quantum, ForestVPN's own tunnel engine. Our OpenWrt three-routes post compares the install shapes on OpenWrt alone, and a connected tunnel that carries nothing covers the symptom you will hit if an MTU or a rule is wrong.

Our WireGuard comparison page sets the protocols side by side.