ForestVPN
Sign inGet ForestVPN
Recipe

ForestVPN on a MikroTik with a flash folder

Install the ForestVPN container on a hAP ac² or another 16 MB MikroTik board so its key survives a reboot and the image is pulled again at boot.

Updated October 8, 2026

Not yet verified on hardware. The reboot behaviour below was proven on a lab router with a RAM disk standing in for the board's RAM root; the boot script firing on a real boot has not been exercised.

What you get

A ForestVPN container that keeps its identity across reboots on a MikroTik that has a flash folder. Only flash survives a reboot on these boards; everything else is a RAM disk.

Before you start

  • Device: a MikroTik with a flash folder in /file. That is the 16 MB boards, such as the hAP ac².
  • Firmware: RouterOS 7.21 or later, with the container package installed and container mode enabled (MikroTik requires physical access to the router for that).
  • Time: about ten minutes.
  • What can break: the image does not fit in flash, so it is pulled from Docker Hub again at every boot (about 3.6 MiB). The router needs its internet connection up at boot, and has no tunnel until the pull finishes.
  • An older install: if you installed before version 0.3.14, do not paste the install command over it. Follow the undo and reinstall notes in "If something is wrong" first.

Steps

  1. Confirm the board has a flash folder. Nothing printed means this recipe is not for your board; use the standard setup.

    Checks for a flash folder

    /file/print where name="flash"

  2. Paste the install command from Get the app, Router. It detects the folder on its own: it puts the state on flash, sends the log to the container's own memory, turns off start-on-boot and adds a boot script that pulls the image and starts the container once the internet is up. There is nothing to edit.

  3. Read back what it did. The mount source must be on flash.

    Shows where the key is kept

    /container/mounts/print

  4. Confirm the boot script exists.

    Shows the boot scheduler

    /system/scheduler/print where name="forestvpn-repull"

Check it worked

Restart the router, wait three minutes, then look at the container and its log.

Reboots the router

/system/reboot

Shows the container is running and does not ask you to pair again

/container/print
/log print where message~"ForestVPN"

You should see the container running, and no new pairing code in the log. A new pairing code means the key was lost and this is a new device.

Undo it

This removes the container and the boot script. It leaves the state folder on flash, so reinstalling later keeps the same device.

Removes the boot script and the container

/system/scheduler/remove [find name="forestvpn-repull"]
/system/script/remove [find name="forestvpn-repull"]
/container/remove [find name="fvpn"]

If something is wrong

SymptomCauseFix
The log says execvp /mikrotik.sh: No such file or directoryThe container's root or the key was on the RAM disk, as in installs before 0.3.14Copy the key to flash before the next reboot, then remove the container and run the install command again. The steps are in the MIGRATION notes at the end of the install script.
The container stays stopped after a rebootThe boot script is missing, or the internet was not up yetCheck step 4. The script retries the pull up to 60 times.
The pull fails with resolving errorThe router's internet connection was not ready at bootWait; the script tries again every minute.
A new pairing code appearsThe key was not on flashThe router is now a new device. Do not link it, remove it, and install again.

Limits

  • No tunnel until the image has been pulled at boot, so a router that boots without internet has none.
  • Flash on these boards is small. A full flash stops RouterOS saving its own configuration, which is why the log stays in memory.
  • The state folder is about 5 KB. It holds the device's identity: deleting it makes this a new device that is not on your account.

Back to Help

English
Ask us anything