[{"_1":2,"_180":-5,"_181":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_155":156},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_91":-5,"_92":93,"_146":-5,"_147":11,"_148":17,"_149":11,"_150":-5,"_151":11,"_152":-5,"_153":154},"canonicalUrl","https://hub.docker.com/r/ulfrasark/turnable-wg/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","ulfrasark","reponame","turnable-wg","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_46":47,"_49":50,"_51":52,"_53":11,"_54":55,"_56":57,"_58":59,"_39":31,"_28":29,"_61":62,"_63":-5,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":65,"_72":73,"_74":11,"_75":29,"_76":77,"_82":11,"_83":84,"_88":29,"_89":90},"categories",[38,43],{"_39":40,"_41":42},"name","Networking","slug","networking",{"_39":44,"_41":45},"Security","security","content_types",[48],"image","date_registered","2026-09-04T16:01:40.968974Z","description","All-in-one VK-call tunnel for MikroTik RouterOS - multi-stream DTLS proxy + WireGuard","is_private","last_updated","2026-09-04T16:01:47.492064Z","last_modified","2026-09-04T16:04:44.81452Z","media_types",[60],"application/vnd.oci.image.index.v1+json","pull_count",168,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","All-in-one VK-call tunnel for MikroTik RouterOS: multi-stream DTLS proxy + WireGuard in ONE container. Traffic rides VK Calls' TURN relay (disguised as call media), terminates on the built-in WireGuard, which NATs out to the internet. No separate WG host, no external backend, no reverse proxy.\n\nPairs with a WireGuard-TURN Android client that supports Session-ID stream aggregation: multiple DTLS streams from one client are grouped by its UUID into ONE backend connection — more throughput and stability while the call still shows a single participant.\n\n---\n\n## Image size\n| Layer | Size |\n|-------|------|\n| Compressed (Docker Hub) | ~20 MB |\n| Unpacked (on device) | ~45 MB |\n\nMulti-stage build — proxy server + userspace wireguard-go on Alpine, no Go toolchain in the final image. Multi-arch: amd64 / arm64 / armv7.\n\n---\n\n## What's inside\n\n| Component | Role |\n|-----------|------|\n| DTLS multi-stream proxy | Listens for VK-relayed DTLS, decrypts, forwards to local WireGuard. Session-ID aggregation + Round-Robin. |\n| WireGuard | The actual VPN that routes to the internet. Userspace wireguard-go (works in containers without the kernel module). |\n| NAT | Masquerades the WG subnet out the container's egress. Set up automatically. |\n\n---\n\n## Ports — set in config.json (no reverse proxy)\n\nIf 56000 is taken by another container, change the port in ONE place — `config.json` in the mount:\n\n```json\n{\n \"public_ip\": \"YOUR.VPS.IP\",\n \"listen_port\": 56001,\n \"wg_port\": 51821,\n \"wg_dns\": \"1.1.1.1\",\n \"stream_num\": 4\n}\n```\n\n- `listen_port` — where the VK relay sends DTLS. Change this to avoid clashes; it's auto-written into the client config.\n- `wg_port` — internal WireGuard port (not exposed; the client reaches WG through the tunnel).\n- Priority: config.json > env vars > defaults. Defaults 56001 / 51821 so it won't collide with a turnable-hy2 on 56000.\n\n---\n\n## MikroTik settings\n/interface/veth add name=veth-wg address=172.16.184.2/24 gateway=172.16.184.1
\n/ip/address add address=172.16.184.1/24 interface=veth-wg
\n/ip/firewall/nat/add chain=srcnat src-address=172.16.184.0/24 action=masquerade comment=\"turnable-wg out\"
\n/ip/firewall/nat/add chain=dstnat protocol=udp dst-port=56001 action=dst-nat to-addresses=172.16.184.2 to-ports=56001 comment=\"turnable-wg listen\"\n\nOnly your listen_port (default 56001) is forwarded in. The WG port stays internal — the client reaches WireGuard THROUGH the TURN tunnel, not directly.\n\n---\n\n## Mount for config + persistent keys\n/container/mounts/add name=vkwg_conf src=/usb1/turnable-wg-confs dst=/etc/vkturn\n\nHolds `config.json`, plus auto-created `.keys/` (WG server + client keypairs + PSK) and `clients/client-wg.conf` (the ready client config). Without this mount the keys regenerate on every restart and old client configs break.\n\n---\n\n## Environment variables\n/container/envs/add name=vkwg-env key=PUBLIC_IP value=your.vps.ip
\n/container/envs/add name=vkwg-env key=VKTURN_LISTEN_PORT value=56001
\n/container/envs/add name=vkwg-env key=WG_PORT value=51821\n\nConfig.json takes priority over env if both are set.\n\n---\n\n## Install container\n/container/add
\nremote-image=ulfrasark/turnable-wg:v1
\ninterface=veth-wg
\nmounts=vkwg_conf
\nenvlist=vkwg-env
\nroot-dir=/usb1/turnable-wg
\ndns=8.8.8.8
\nstart-on-boot=yes
\nrestart-policy=on-failure
\nrestart-interval=60s
\nlogging=yes\n\n> RouterOS caches images by name:tag. When updating, use a NEW tag AND a NEW root-dir.\n> WireGuard in a container needs the tun device and NET_ADMIN. If the platform blocks kernel WG, the built-in userspace wireguard-go handles it (slightly higher CPU).\n\n---\n\n## Start\n/container/start [find interface=veth-wg]\n\n---\n\n## Check logs\n/log print where topics~\"container\"\n\nOn startup the container prints the WireGuard client config. It's also saved to the mount:
\n/usb1/turnable-wg-confs/clients/client-wg.conf\n\n---\n\n## Client config\n\nThe generated `client-wg.conf` is for a WireGuard-TURN Android client (with Session-ID aggregation), NOT for Xray-based clients. Before importing, fill in:\n\n| Field | What to set |\n|-------|-------------|\n| VKLink | Your VK call link (https://vk.com/call/join/...) |\n| public_ip | Your VPS white IP (via config.json, else placeholder) |\n| PeerType | proxy_v2 (Session-ID aggregation — this server supports it) |\n| StreamNum | Parallel streams (4 is a good start) |\n| UseUDP | Client-side only: TCP (off) is safer, UDP (on) is faster where allowed. Server is unchanged either way. |\n\n---\n\n## How it works\n\nphone: WG-TURN client (multi-stream DTLS) -> VK TURN relay -> turnable-wg :56001 -> decrypt -> local WireGuard -> NAT -> internet\n\nThe client briefly joins the VK call to get TURN credentials, then rides the allocation. Session-ID aggregation packs several DTLS streams under one call presence — more speed at the antifraud profile of a single participant.\n\n---\n\n## Bandwidth and antifraud\n\nSession-ID aggregation groups N streams under ONE call presence: you get the throughput of N streams while the call still shows a single participant. This beats raw per-allocation scaling, where each extra stream is another \"participant\" and raises the antifraud signal. Tune StreamNum to taste — more streams, more speed, still one participant.\n\n---\n\n## Credits\n\nThis image packages and wires existing open-source work for RouterOS — all protocol credit goes to the upstream authors:\n\n- Server core (multi-stream DTLS + Session-ID aggregation): [kiper292/vk-turn-proxy](https://github.com/kiper292/vk-turn-proxy)\n- Android client (WireGuard-TURN with Session-ID aggregation): [kiper292/wireguard-turn-android](https://github.com/kiper292/wireguard-turn-android)\n- Original VK TURN proxy core the fork is based on: [cacggghp/vk-turn-proxy](https://github.com/cacggghp/vk-turn-proxy)\n- Userspace WireGuard: [WireGuard/wireguard-go](https://github.com/WireGuard/wireguard-go)\n\nUse the Android client above — it's the one that speaks the Session-ID protocol this server implements.\n\n---\n\n## GitHub\n\nSource and Dockerfile: coming soon","has_starred","hub_user","immutable_tags_settings",{"_78":11,"_79":80},"enabled","rules",[81],".*","is_automated","permissions",{"_85":17,"_86":11,"_87":11},"read","write","admin","user","storage_size",36502328,"orgData","recentTags",[94],{"_95":48,"_96":97,"_98":99,"_100":101,"_102":103,"_104":105,"_54":135,"_136":97,"_137":29,"_138":60,"_39":139,"_140":141,"_142":113,"_143":135,"_144":69,"_145":17},"content_type","creator",25201151,"digest","sha256:a41375bb1d14eac345946e1d4bc86dbdc971fda624126c27e64694e0dea47cbd","full_size",12339681,"id",1295802075,"images",[106,122,128],{"_107":108,"_98":109,"_110":111,"_112":113,"_114":115,"_116":117,"_118":111,"_119":-5,"_120":101,"_66":69,"_121":-5},"architecture","amd64","sha256:ef3f674030dbef56eadf17fbce4e2a0dd26c78a803a986a735de1346a16a5f02","features","","last_pulled","2026-09-23T03:23:06.022560176Z","last_pushed","2026-09-04T16:01:42.812641143Z","os","linux","os_features","os_version","size","variant",{"_107":123,"_98":124,"_110":111,"_112":125,"_114":126,"_116":117,"_118":111,"_119":-5,"_120":127,"_66":69,"_121":-5},"arm64","sha256:8a1a72d28038ce67dc925e51602229b355ae79a85711c696c389862042f9af04","2026-09-22T08:38:37.287866464Z","2026-09-04T16:01:40.683416466Z",12812607,{"_107":129,"_98":130,"_110":111,"_112":131,"_114":132,"_116":117,"_118":111,"_119":-5,"_120":133,"_66":69,"_121":134},"arm","sha256:d4af38e6735e4b473aeecf0c5b2b4e85a8e9fee3f6b0f93728dd98c7da754992","2026-09-22T08:38:37.251857628Z","2026-09-04T16:01:41.742415087Z",11333581,"v7","2026-09-04T16:01:46.826024Z","last_updater","last_updater_username","media_type","v1","repository",32368472,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":157,"_166":167,"_153":178,"_179":11},{"_36":158,"_46":161,"_49":50,"_51":52,"_53":11,"_54":55,"_56":57,"_58":162,"_39":31,"_28":29,"_61":62,"_63":-5,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":65,"_72":73,"_74":11,"_75":29,"_76":163,"_82":11,"_83":165,"_88":29,"_89":90},[159,160],{"_39":40,"_41":42},{"_39":44,"_41":45},[48],[60],{"_78":11,"_79":164},[81],{"_85":17,"_86":11,"_87":11},"tags",{"_168":67,"_169":-5,"_170":-5,"_171":172},"count","next","previous","results",[173],{"_95":48,"_96":97,"_98":99,"_100":101,"_102":103,"_104":174,"_54":135,"_136":97,"_137":29,"_138":60,"_39":139,"_140":141,"_142":113,"_143":135,"_144":69,"_145":17},[175,176,177],{"_107":108,"_98":109,"_110":111,"_112":113,"_114":115,"_116":117,"_118":111,"_119":-5,"_120":101,"_66":69,"_121":-5},{"_107":123,"_98":124,"_110":111,"_112":125,"_114":126,"_116":117,"_118":111,"_119":-5,"_120":127,"_66":69,"_121":-5},{"_107":129,"_98":130,"_110":111,"_112":131,"_114":132,"_116":117,"_118":111,"_119":-5,"_120":133,"_66":69,"_121":134},[],"canDeleteTags","actionData","errors"]

Digest	OS/ARCH	Compressed size
ef3f674030db	linux/amd64	11.77 MB
d4af38e6735e	linux/arm/v7	10.81 MB
8a1a72d28038	linux/arm64	12.22 MB

ulfrasark/turnable-wg

Tags for ulfrasark/turnable-wg