Router setup
Running ForestVPN as a first-class device on a MikroTik router — what it is, and how it fits into your account.
ForestVPN can run directly on a MikroTik router as a container — not a hand-written .conf file
handed to a generic tunnel image, but a real device that holds its own key, registers with the
account system, and asks for an exit the same way a phone does. It's suquant/fvpn,
not suquant/fvpnq — the latter is raw tunnelling from a config file and is
what an exit node runs, not a client.
Verified on real hardware: a MikroTik cAP ax (arm64, RouterOS 7.24.1). It registered, printed a pairing code, verified the signed server list, and connected — confirmed from the container's own view of its public IP address.
Install it
The commands — giving the container its own network path, pulling the pinned image, mounting its state so a restart doesn't drop it off your account — are on Get the app → Router, kept in one place so they don't drift out of sync with what's actually shipped. This page covers what that page doesn't: the parts that touch your account rather than the router.
One requirement worth knowing before you start: the box running the container needs to be your
network's default gateway for a phone on the LAN to reach its status page. If this router sits
downstream of another one, install.rsc detects that and asks for one extra setting rather than
silently failing later.
Link it to your account
The container prints a pairing code to /log on first start, before it has any network
reachability at all. From there it's the same flow as
pairing any device with no keyboard: open the
app on a phone or tablet that already has your account number entered, and type the code in. The
link this makes is permanent, like every device link — see
devices and linking for what that means if the router is ever
replaced, sold, or resets its mount.
Changing where it connects
The container serves a small status page at a fixed address on its side of the network — the same address on every ForestVPN router, so "open it from a phone on the LAN" is a true instruction regardless of how your own network is numbered. Tap a location there; no app, no RouterOS knowledge and no login is needed for that one step, because the device's identity was already settled when you paired it.
If the container starts but the tunnel doesn't come up, see troubleshooting.