Home / Playbooks / Mysterium in Docker

Deploy a Mysterium Node in Docker (Residential Exit Node)

Official myst container, port-forward check, whitelisting config and payout wallet — the highest-ceiling residential bandwidth setup.

Intermediate⏱ ~30 minutes·Free (existing hardware)·Updated 2026-08-24
Contents
  1. Prerequisites
  2. Run the official container
  3. Register the node to your account
  4. Port forwarding — do not skip
  5. Whitelist & terms acceptance
  6. Monitor & withdraw

1. Prerequisites

- Linux host with Docker (home server ideal; see Pi playbook or N100 playbook)

- Residential IP — datacenter nodes earn very little here

- Router admin access for port forwarding (the earnings lever)

- Register at mystnodes.com to manage your node and payouts

2. Run the official container

# ~/stack/docker-compose.yml
services:
  mysterium:
    image: mysteriumnetwork/myst:latest
    container_name: mysterium
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - "4449:4449"          # UI + API
      - "1194:1194/udp"      # OpenVPN
      - "51820:51820/udp"    # WireGuard
    environment:
      - MYST_PASSWORD=***     # node password
    volumes:
      - ./myst-data:/var/lib/mysterium-node
    mem_limit: 500m
docker compose up -d mysterium
docker compose logs -f mysterium
NET_ADMIN + /dev/net/tun are required — the node creates VPN tunnel interfaces. This is normal for exit-node software, not a red flag.

3. Register the node to your account

1. Open http://node-ip:4449 → the node's own dashboard

2. Copy the Node ID shown there

3. At mystnodes.com → Add Node → paste the ID, approve from the node dashboard when prompted

4. Set your payout wallet (MYST) in your MystNodes profile

4. Port forwarding — do not skip

Unreachable nodes earn a fraction of reachable ones. Forward these WAN ports to the node's LAN IP:

PortProtocolPurpose
1194UDPOpenVPN sessions
51820UDPWireGuard sessions
4449TCPAPI (optional externally)

Verify reachability from outside (phone on mobile data): try connecting a VPN client to your home IP, or use the connectivity score in the MystNodes dashboard — aim for high 'quality' rating.

No port-forward possible? The node still earns via limited session types, but expectations should drop accordingly. UPnP-enabled routers may open ports automatically — check the dashboard's NAT status.

5. Whitelist & terms acceptance

In the node dashboard, accept operator terms and review the service whitelist. Default settings enable standard browsing services; you can restrict categories if your ISP or comfort level demands it.

ISP reality check: you're serving VPN traffic. Most residential ISPs tolerate it; metered or strict ones may not. Watch your first month's usage patterns before forgetting about it.

6. Monitor & withdraw

- Weekly: MystNodes dashboard shows sessions served, bytes transferred, pending MYST

- Withdrawals settle weekly to your MYST wallet — convert to stablecoins/fiat per your tax strategy

- Container maintenance is nil beyond Watchtower auto-updates (see base playbooks)

# quick health check:
docker compose logs --tail 20 mysterium | grep -iE "error|session|earn"

Tools used in this playbook

This guide contains referral links to some of the services mentioned. They cost you nothing and fund more testing. See disclosure.