Remove the old ForestVPN setup from a MikroTik

What you get

The earlier ForestVPN setup is gone: the qproxy container, the WireGuard interface fvpn0, the under_fvpn address list, the fvpn routing table with its "ForestVPN Kill Switch" rule, and their mangle rules. Left in place, that kill switch and those mangle rules keep steering your LAN into a tunnel that no longer exists. The new app is installed in the same paste.

Before you start

• Device: a MikroTik that still has the previous ForestVPN setup.
• Firmware: RouterOS 7.21 or later, with the container package and container device-mode enabled.
• Time: five minutes.
• What can break: the LAN has no tunnel between the removal and the new container connecting. The old setup's account does not carry over: link the router again with a code (the pairing code appears in /log).
• Without the paste below, the install refuses and changes nothing, and tells you what it found.

Steps

1. Paste this line, optionally followed by :global fvLAN "all" to send the whole LAN through the new tunnel with a kill switch, and then the install block from Get the app, Router.

   Asks the install to remove the previous setup first

   :global fvREMOVEOLD "yes"

   The install saves your configuration to forestvpn-before-removal.rsc, removes exactly the objects named above, leaves a containers bridge that other containers still use (with its address and its 172.17.0.0/24 masquerade, which MikroTik's own container guide also creates), checks that nothing is left, and carries on.

2. To clean the router without installing, paste this block instead. It is the same removal, as one paste.

   Removes the previous ForestVPN setup

   {
   # The ForestVPN router setup before this app: a qproxy container on a "containers" bridge
   # (172.17.0.0/24), a WireGuard interface fvpn0 in the WAN list, the address list under_fvpn, a
   # routing table fvpn with the "ForestVPN Kill Switch" rule, and their mangles. Left in place, its
   # kill switch and mangles keep steering the LAN into a tunnel that no longer exists.
   :local old [:toarray ""]
   :if ([:len [/container/find where name~"qproxy"]] > 0) do={ :set old ($old , "the qproxy container") }
   :if ([:len [/interface/wireguard/find where name="fvpn0"]] > 0) do={ :set old ($old , "WireGuard interface fvpn0") }
   :if ([:len [/ip/firewall/address-list/find where list="under_fvpn"]] > 0) do={ :set old ($old , "address list under_fvpn") }
   :if ([:len [/routing/table/find where name="fvpn"]] > 0) do={ :set old ($old , "routing table fvpn") }
   :if ([:len [/routing/rule/find where table="fvpn" or comment~"ForestVPN Kill Switch"]] > 0) do={ :set old ($old , "the ForestVPN Kill Switch rule") }
   :if ([:len [/ip/firewall/mangle/find where src-address-list="under_fvpn" or connection-mark="under_fvpn" or out-interface="fvpn0" or in-interface="fvpn0"]] > 0) do={ :set old ($old , "its mangle rules") }
   :if ([:len [/interface/list/member/find where interface="fvpn0"]] > 0) do={ :set old ($old , "fvpn0 in an interface list") }
   :if ([:len $old] > 0) do={
   :put ("ForestVPN: removing the previous ForestVPN setup: " . [:tostr $old] . ". Your configuration before this is saved as forestvpn-before-removal.rsc.")
   /export file=forestvpn-before-removal
   :foreach c in=[/container/find where name~"qproxy"] do={
   :do { /container/stop $c } on-error={}
   :local n 0
   :while ([/container/get $c running] && $n < 30) do={ :delay 1s; :set n ($n + 1) }
   :delay 2s
   /container/remove $c
   }
   /ip/firewall/mangle/remove [find where src-address-list="under_fvpn" or connection-mark="under_fvpn" or out-interface="fvpn0" or in-interface="fvpn0" or (chain="prerouting" and action="accept" and dst-address="192.168.88.1")]
   /ipv6/firewall/mangle/remove [find where src-address-list="under_fvpn" or connection-mark="under_fvpn"]
   /routing/rule/remove [find where table="fvpn" or comment~"ForestVPN Kill Switch"]
   /ip/route/remove [find where routing-table="fvpn"]
   /ipv6/route/remove [find where routing-table="fvpn"]
   /interface/wireguard/peers/remove [find where interface="fvpn0"]
   /interface/list/member/remove [find where interface="fvpn0"]
   /ip/address/remove [find where interface="fvpn0"]
   /ipv6/address/remove [find where interface="fvpn0" and !dynamic]
   /interface/wireguard/remove [find where name="fvpn0"]
   /routing/table/remove [find where name="fvpn"]
   /ip/firewall/address-list/remove [find where list="under_fvpn"]
   /interface/bridge/port/remove [find where interface~"veth-qproxy"]
   /interface/veth/remove [find where name~"veth-qproxy"]
   # The "containers" bridge, its address and its 172.17.0.0/24 masquerade only if nothing else is
   # still on it: MikroTik's own container guide uses the same names, so other containers may share them.
   :if ([:len [/interface/bridge/find where name="containers"]] = 1 and [:len [/interface/bridge/port/find where bridge="containers"]] = 0) do={
   /ip/firewall/nat/remove [find where src-address="172.17.0.0/24"]
   /ip/address/remove [find where interface="containers"]
   /interface/list/member/remove [find where interface="containers"]
   /interface/bridge/remove [find where name="containers"]
   }
   :if ([:len [/container/find where name~"qproxy"]] + [:len [/interface/wireguard/find where name="fvpn0"]] + [:len [/routing/table/find where name="fvpn"]] + [:len [/ip/firewall/address-list/find where list="under_fvpn"]] > 0) do={ :error "ForestVPN: the previous setup could not be removed completely. See /export and fvpn.net/help/mikrotik-remove-old/." }
   }
   }

Check it worked

None of qproxy, under_fvpn or fvpn0 should appear in the export, nor 172.17.0. unless other containers still use the containers bridge.

Shows the whole configuration

/export terse

Undo it

The saved export is a record, not a backup: secrets are not in it. To go back, re-add the objects from it by hand, or import it on a router that was reset.

Imports the saved configuration

/import file-name=forestvpn-before-removal.rsc

If something is wrong

Limits

• It looks for the names above and nothing else: an old setup that was customised by hand needs /export read by a person.
• It does not carry the old account over. Link the router again with a code.
• It removes a containers bridge, its address and its masquerade only when nothing else is on it.