RouterOS is MikroTik's Linux-based network OS. Everything is one command tree you drive from a console; the GUIs are just skins over that same tree, so whatever you learn in one transfers to the others. Four ways in — all land at the same config.
| Way in | What | Port / how | When |
|---|---|---|---|
| WinBox | Native GUI (Windows/Wine) | TCP 8291, or by MAC | Best for learning — visual, live |
| WebFig | Browser UI | http://192.168.88.1 | Same config, no install |
| SSH / CLI | The real command tree | TCP 22 | Scripting, export, automation |
| mac-telnet / mac-winbox | Layer-2, no IP needed | the router's MAC | When there's no working IP path (fresh box, wrong subnet) |
192.168.88.1, user admin, no password (newer versions prompt you to set one on first login). If you can't get an IP path, WinBox's Neighbors tab finds it on Layer 2 by MAC — that's how you rescue a box you've locked yourself out of.
Everything hangs off /. You navigate menus (/ip firewall filter) and run verbs inside them (print, add, set, remove). ? lists what's available at any point, Tab completes, and [find ...] selects items by property instead of by index. Nothing is saved-then-applied — every command takes effect immediately, which is exactly why Safe Mode exists.
CLI basics# menus are paths; run a verb inside one, or give the full path inline /ip firewall filter print # list rules in this menu /ip address print detail # full properties, not the summary /interface print where type=ether # filter the listing # add / change / delete /ip dns set servers=1.1.1.1,8.8.8.8 /ip firewall filter add chain=input action=accept protocol=icmp /ip firewall filter remove [find chain=input action=drop] # select by property # the whole config as text /export hide-sensitive # redacts keys/passwords /export file=backup-cfg # writes backup-cfg.rsc on the router
Ctrl-X to enter Safe Mode (the prompt shows [Safe]). Every change is provisional; if your session drops — you just firewalled yourself out — the router auto-reverts everything since you entered. Ctrl-X again to commit, Ctrl-D to abort. Always Safe-Mode remote firewall/interface edits.
| Path | What lives there |
|---|---|
| /interface | ethernet, bridge, wireless, VLAN — every port and virtual iface |
| /ip | address, dhcp-server, dhcp-client, dns, firewall, route, pool |
| /interface ethernet switch | the hardware switch chip — VLANs, port mirroring |
| /system | identity, clock, backup, package/upgrade, reboot, resource |
| /tool | torch, sniffer, netwatch, ping, bandwidth-test — the diagnostics |
Physical ports are ether1..N, plus sfp1, wlanN. A bridge is a software switch: add ports to it and they become one flat L2 segment. A typical build puts every LAN port + wifi into one bridge and leaves the WAN port (ether1) OUT — that port is the uplink.
bridge + ports# make the bridge, then enroll ports into it /interface bridge add name=bridgeLAN /interface bridge port add bridge=bridgeLAN interface=ether2 /interface bridge port add bridge=bridgeLAN interface=wlan1 # what's plugged in and up? /interface print brief /interface ethernet monitor ether2 once # link speed / status of one port
ether1 = WAN uplink (not in the bridge) and everything else in the LAN bridge. It makes the firewall rules below read cleanly: "in-interface = the bridge" means "from my LAN", "out-interface = ether1" means "toward the internet".
The router holds an address on the bridge (the LAN gateway) and typically runs a DHCP server for the LAN plus a DHCP client on the WAN. It can also be the LAN's DNS resolver — which is a handy lever (see the note).
addressing + dhcp + dns# the gateway address on the LAN bridge /ip address add address=192.168.88.1/24 interface=bridgeLAN # hand out .10-.254; point clients at the router for DNS /ip pool add name=lan ranges=192.168.88.10-192.168.88.254 /ip dhcp-server add interface=bridgeLAN address-pool=lan /ip dhcp-server network add address=192.168.88.0/24 gateway=192.168.88.1 dns-server=192.168.88.1 # pin an IP to a device by MAC (a static reservation) /ip dhcp-server lease add address=192.168.88.50 mac-address=AA:BB:CC:00:11:22 # WAN side: be a DHCP client upstream /ip dhcp-client add interface=ether1 # resolver /ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=yes
/ip dns static add name=api.example.com address=192.168.88.50. Useful for pinning a device to a lab endpoint you control.
Two pieces make an isolated segment: a filter that drops anything the outside tries to start inward, and masquerade NAT so inside hosts can still reach the internet. Chains: input = traffic to the router, forward = traffic through it, output = from it. Rules run top-to-bottom, first match wins.
a one-way isolation ruleset# INPUT — protect the router itself /ip firewall filter add chain=input connection-state=established,related action=accept /ip firewall filter add chain=input connection-state=invalid action=drop /ip firewall filter add chain=input in-interface=bridgeLAN action=accept /ip firewall filter add chain=input protocol=icmp action=accept /ip firewall filter add chain=input action=drop # everything else (i.e. from WAN) # FORWARD — one-way membrane: LAN reaches out, WAN can't start in /ip firewall filter add chain=forward connection-state=established,related action=accept /ip firewall filter add chain=forward in-interface=bridgeLAN out-interface=ether1 action=accept /ip firewall filter add chain=forward connection-state=new in-interface=ether1 action=drop # NAT — masquerade the LAN out the WAN /ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade
log=yes log-prefix=WAN-DROP to the final input/forward drops and /log print follow shows every uninvited packet — great for spotting a device phoning somewhere odd, or a scan from outside.
To allow WinBox from one trusted IP only — and do it in Safe Mode so a mistake self-reverts:
# Ctrl-X first. accept 8291 from one host, on the WAN in-interface, before the input drop /ip firewall filter add chain=input protocol=tcp dst-port=8291 src-address=203.0.113.10 action=accept place-before=[find chain=input action=drop]
RouterOS splits wifi into a security-profile (the auth/encryption) and the interface config (band, channel, SSID, mode). An ap-bridge radio bridged into the LAN puts wireless clients in the same L2 segment as the wired ports.
an AP# auth first /interface wireless security-profiles add name=home \ authentication-types=wpa2-psk mode=dynamic-keys wpa2-pre-shared-key=******** # then the radio: 2.4GHz AP on ch6, on the LAN bridge /interface wireless set wlan1 mode=ap-bridge band=2ghz-b/g/n \ frequency=2437 ssid=my-ssid security-profile=home disabled=no # who's connected / what's on the air /interface wireless registration-table print /interface wireless scan wlan1
Underneath the software bridge is real switch silicon. The killer feature for device analysis lives here: port mirroring — tell the chip to photocopy every frame on one port to another. The device talks to its cloud completely normally; your capture box gets a full copy. No ARP poisoning, no insertion into the path, invisible.
a switch chip's ports ┌────────────────────────────────┐ │ ether1 ether2 ether3 ether4 │ └────────────────────────────────┘ ether1 = WAN ether3 = the DEVICE under test ether4 = your CAPTURE box mirror source + target MUST be on the SAME chip — check /interface ethernet switch port print
port mirror# many boards have >1 switch chip; source and target must share one /interface ethernet switch port print # which port is on which chip # copy everything on ether3 (device) to ether4 (capture box) /interface ethernet switch set switch1 mirror-source=ether3 mirror-target=ether4 # ALWAYS tear down when done /interface ethernet switch set switch1 mirror-source=none mirror-target=none
sudo ip link set eth0 promisc on; sudo tcpdump -i eth0 -w dev.pcap. HTTPS payloads stay encrypted, but you get DNS, TLS SNI, endpoints, and any cleartext — usually the interesting part for watching a device reach its cloud.
You don't always need to mirror to another box — RouterOS can watch traffic itself. Torch is a live per-flow bandwidth view; the sniffer captures pcap you can stream straight into Wireshark; netwatch pings hosts and runs scripts on up/down.
diagnostics# live top-talkers on a port (a good first look at a new device) /tool torch ether3 src-address=0.0.0.0/0 port=any # capture to a file on the router, or stream to Wireshark on your box /tool sniffer set filter-interface=ether3 file-name=dev.pcap /tool sniffer start ; ... ; /tool sniffer stop # TZSP stream -> a Wireshark listening on your workstation: /tool sniffer set streaming-enabled=yes streaming-server=192.168.88.50 # reachability + health /ping 192.168.88.50 count=4 /tool netwatch add host=192.168.88.50 interval=30s /system resource print # cpu, memory, uptime, version
Two kinds of save: /export writes a human-readable .rsc script of your config (diff-able, partial), while /system backup writes an opaque binary that restores the whole box byte-for-byte. Keep both.
| Command | Produces | Use |
|---|---|---|
| /export hide-sensitive | readable .rsc text | Review, version-control, cherry-pick |
| /export file=cfg | cfg.rsc on the router | Portable, re-runnable config |
| /system backup save name=full | full.backup (binary) | Exact full-box restore |
| /system routerboard print | model, firmware rev | Check before upgrading |