MikroTik router setup

ForestVPN can run directly on a MikroTik router as a container — not a hand-written .conf file handed to a generic tunnel image, but a real device that holds its own key, registers with the account system, and asks for an exit the same way a phone does. It's suquant/fvpn, not suquant/fvpnq — the latter is raw tunnelling from a config file and is what an exit node runs, not a client.

Install it

The commands — giving the container its own network path, pulling the pinned image, mounting its state so a restart doesn't drop it off your account — are on Get the app → Router, kept in one place so they don't drift out of sync with what's actually shipped. This page covers what that page doesn't: the parts that touch your account rather than the router.

One requirement worth knowing before you start: the box running the container needs to be your network's default gateway for a phone on the LAN to reach its status page. If this router sits downstream of another one, install.rsc detects that and asks for one extra setting rather than silently failing later.

Link it to your account

The container prints a pairing code to /log on first start, before it has any network reachability at all. From there it's the same flow as pairing any device with no keyboard: open the app on a phone or tablet that already has your account number entered, and type the code in. The link can be undone later, like any device link: remove the router from your phone, computer or the console — see devices and linking for what to do if the router is ever replaced, sold, or resets its mount.

Changing where it connects

The container serves a small status page at a fixed address on its side of the network — the same address on every ForestVPN router, so "open it from a phone on the LAN" is a true instruction regardless of how your own network is numbered. Tap a location there; no app, no RouterOS knowledge and no login is needed for that one step, because the device's identity was already settled when you paired it.

Sending LAN traffic through it — optional

Out of the box the router tunnels its own traffic and nothing else; the phones and laptops on your network carry on using your normal connection. Deciding that some of them — or some of their apps — should go out through the exit instead is ordinary RouterOS configuration, and it's entirely optional. Choosing what goes through the tunnel has three recipes: calls and messengers only, everything, and a kill switch that stops traffic leaking when the exit can't be reached.

If the container starts but the tunnel doesn't come up, see troubleshooting.