ForestVPN
Sign inGet ForestVPN
Recipe

Update the ForestVPN container on MikroTik

Move a MikroTik ForestVPN container to a newer pinned image without losing its identity or its account link, and roll back the same way.

Updated October 8, 2026

Not yet verified on hardware as a recipe. It rests on a remove and add cycle that was run on a router, which kept the same device identity.

What you get

The container runs a newer image. It is still the same device on your account, because the identity lives in the mount on the router, not in the container.

Before you start

  • Device: a MikroTik running the ForestVPN container from the install command.
  • Firmware: RouterOS 7.21 or later.
  • Time: five minutes. The router has no tunnel while the container is removed.
  • How updates work: the install pins an exact image tag, and RouterOS never pulls a different one on its own. A new tag is a deliberate change you make with this recipe. The tag to move to is the one in the install command on Get the app, Router; this page does not name it, so it cannot go stale.
  • What can break: removing the wrong objects. Remove only the container. The mount list and the veth hold your identity and your network path.

Steps

  1. Note the current tag, the command line and the mount list. You need them if you roll back.

    Shows the current container

    /container/print detail where name="fvpn"

  2. Stop and remove the container. This deletes its root folder, not the mount source where the key lives.

    Stops and removes only the container

    /container/stop [find name="fvpn"]
/container/remove [find name="fvpn"]

  3. Add it again with the new tag. Replace NEW-TAG with the tag from the install command. On a board with a flash folder, take the command line and mount list from step 1 instead, and keep them unchanged.

    Adds the container with the new image

    /container/add remote-image=suquant/fvpn:NEW-TAG \
    interface=veth-fvpn root-dir=/fvpn mountlists=fvpn-state \
    entrypoint=/mikrotik.sh \
    cmd="--agent --nat-lan --iface fvpn0 --config /etc/forestvpn/fvpn0.conf --policy-route --fwmark 51820 --table 100 --http-port 80 --report /etc/forestvpn/result.txt" \
    privileged=yes logging=yes start-on-boot=yes dns=172.31.254.1 \
    name=fvpn comment="ForestVPN"

  4. Start it once the pull has finished.

    Starts the container

    /container/start [find name="fvpn"]

Check it worked

Shows the running tag and the log

/container/print detail where name="fvpn"
/log print where message~"ForestVPN"

The tag is the new one, the container is running and the log shows no new pairing code. The status page at http://172.31.254.2/ loads from a device on your LAN.

Undo it

Roll back by repeating steps 2 to 4 with the tag you noted in step 1.

If something is wrong

SymptomCauseFix
A new pairing code appearsThe mount list was missing or pointed somewhere new, so the key was not foundDo not link this device. Remove the container, restore the mount list from step 1 and add it again.
The pull failsThe router could not reach Docker HubCheck the router's internet and DNS, then start again from step 3.
bad parameter when addingAn older RouterOS, or a changed property nameCheck the firmware is 7.21 or later.

Limits

  • There is no automatic update on the router. Nothing changes the image until you do.
  • The tunnel is down for as long as the container is removed.
  • This recipe assumes the install command's addresses. If you changed them, use the values from step 1.

Back to Help

English
Ask us anything