Skip to content
1337skills 1337skills

MikroTik Cheat Sheet

Overview

MikroTik RouterOS is a Linux-based network operating system used on MikroTik hardware routers, switches, and access points. It provides comprehensive networking features including advanced routing (BGP, OSPF, RIP, MPLS), stateful firewall, NAT, VPN (IPsec, L2TP, PPTP, OpenVPN, WireGuard), traffic shaping (QoS), hotspot gateway, VLAN management, bonding, bridging, wireless management, and DHCP/DNS services. RouterOS can also run as a virtual machine (CHR - Cloud Hosted Router) on hypervisors.

MikroTik devices are managed through multiple interfaces: WinBox (Windows GUI), WebFig (web interface), the CLI (via SSH/Telnet/serial), and the API (for programmatic access). The CLI uses a hierarchical menu structure where commands are organized by function area (e.g., /ip/firewall, /interface, /routing). RouterOS is known for its exceptional value—providing enterprise-grade features at a fraction of the cost of competitors like Cisco or Juniper. The Dude monitoring tool and scripting system allow extensive network automation.

Installation

Accessing the Router

# SSH access (default credentials: admin / no password)
ssh admin@192.168.88.1

# First-time setup
/system identity set name=core-router
/password
# Enter new password

# WinBox download: https://mikrotik.com/download
# Connect via MAC or IP address

Cloud Hosted Router (VM)

# Download CHR image from mikrotik.com
# Import into hypervisor (VMware, Hyper-V, KVM)
# Default: DHCP on ether1, admin with no password

# License for CHR
/system license print
# Free tier: 1Mbps upload limit
# P1 license: unlimited for one instance

Core Commands

CommandDescription
/interface printList all interfaces
/ip address printList IP addresses
/ip route printShow routing table
/ip firewall filter printList firewall rules
/system resource printShow CPU/RAM/uptime
/system routerboard printShow hardware info
/system package update check-for-updatesCheck for updates
/exportExport full configuration
/import file=backup.rscImport configuration
/system backup save name=backupBinary backup
/system rebootReboot device

Interface Management

# List interfaces
/interface print

# Set interface name and comment
/interface set ether1 name=WAN comment="ISP uplink"
/interface set ether2 name=LAN comment="Internal network"

# Enable/disable interface
/interface disable WAN
/interface enable WAN

# Create VLAN interface
/interface vlan add name=VLAN100 vlan-id=100 interface=LAN

# Create bridge
/interface bridge add name=bridge-LAN
/interface bridge port add bridge=bridge-LAN interface=ether2
/interface bridge port add bridge=bridge-LAN interface=ether3
/interface bridge port add bridge=bridge-LAN interface=ether4

IP Configuration

# Add IP address
/ip address add address=192.168.1.1/24 interface=LAN
/ip address add address=10.0.0.2/30 interface=WAN

# Set default gateway
/ip route add dst-address=0.0.0.0/0 gateway=10.0.0.1

# DNS settings
/ip dns set servers=8.8.8.8,8.8.4.4 allow-remote-requests=yes

# DHCP server
/ip pool add name=dhcp-pool ranges=192.168.1.100-192.168.1.200
/ip dhcp-server add name=dhcp-lan interface=LAN address-pool=dhcp-pool
/ip dhcp-server network add address=192.168.1.0/24 gateway=192.168.1.1 dns-server=192.168.1.1

Firewall Configuration

# Basic firewall setup (input chain)
/ip firewall filter
add chain=input connection-state=established,related action=accept comment="Allow established"
add chain=input connection-state=invalid action=drop comment="Drop invalid"
add chain=input protocol=icmp action=accept comment="Allow ICMP"
add chain=input in-interface=LAN action=accept comment="Allow LAN"
add chain=input action=drop comment="Drop all other input"

# Forward chain
add chain=forward connection-state=established,related action=accept
add chain=forward connection-state=invalid action=drop
add chain=forward in-interface=LAN out-interface=WAN action=accept comment="LAN to WAN"
add chain=forward action=drop comment="Drop all other forward"

# NAT (masquerade)
/ip firewall nat add chain=srcnat out-interface=WAN action=masquerade

# Port forwarding
/ip firewall nat add chain=dstnat in-interface=WAN protocol=tcp dst-port=8080 \
  action=dst-nat to-addresses=192.168.1.10 to-ports=80

# Address list for blocking
/ip firewall address-list add list=blocklist address=203.0.113.0/24
/ip firewall filter add chain=input src-address-list=blocklist action=drop

VPN Configuration

WireGuard

# Create WireGuard interface
/interface wireguard add name=wg0 listen-port=51820

# Show public key
/interface wireguard print

# Add peer
/interface wireguard peers add interface=wg0 \
  public-key="peer-public-key-here" \
  allowed-address=10.10.0.2/32 \
  endpoint-address=203.0.113.50 \
  endpoint-port=51820 \
  persistent-keepalive=25

# Assign IP to WireGuard interface
/ip address add address=10.10.0.1/24 interface=wg0

# Firewall rule for WireGuard
/ip firewall filter add chain=input protocol=udp dst-port=51820 action=accept

IPsec Site-to-Site

# Phase 1 (IKE)
/ip ipsec profile add name=ike2-profile enc-algorithm=aes-256 hash-algorithm=sha256 \
  dh-group=modp2048 lifetime=8h

/ip ipsec peer add address=203.0.113.2/32 profile=ike2-profile exchange-mode=ike2

/ip ipsec identity add peer=ipsec-peer auth-method=pre-shared-key \
  secret="your-preshared-key"

# Phase 2 (ESP)
/ip ipsec proposal add name=esp-proposal enc-algorithms=aes-256-gcm \
  auth-algorithms=null pfs-group=modp2048 lifetime=1h

/ip ipsec policy add src-address=192.168.1.0/24 dst-address=192.168.2.0/24 \
  proposal=esp-proposal tunnel=yes sa-src-address=203.0.113.1 sa-dst-address=203.0.113.2

Routing

OSPF

/routing ospf instance add name=default router-id=1.1.1.1
/routing ospf area add name=backbone area-id=0.0.0.0 instance=default
/routing ospf interface-template add interfaces=LAN area=backbone cost=10
/routing ospf interface-template add interfaces=ether5 area=backbone network-type=point-to-point

BGP

/routing bgp connection add name=upstream remote.address=10.0.0.1 remote.as=64501 \
  local.role=ebgp local.address=10.0.0.2 as=64500 \
  output.default-originate=always \
  routing-table=main

Advanced Usage

Scripting and Scheduling

# Create a script
/system script add name=backup-daily source={
  /system backup save name=("daily-" . [:pick [/system clock get date] 0 10])
  /export file=("daily-" . [:pick [/system clock get date] 0 10])
  /tool e-mail send to="admin@example.com" subject="Router Backup" body="Daily backup attached"
}

# Schedule daily execution
/system scheduler add name=daily-backup interval=1d on-event=backup-daily start-time=02:00:00

Queue (Traffic Shaping)

# Simple queue
/queue simple add name=client-limit target=192.168.1.100/32 \
  max-limit=50M/100M burst-limit=80M/150M burst-threshold=40M/80M burst-time=10s/10s

# Queue tree (more flexible)
/queue tree add name=download parent=LAN max-limit=100M
/queue tree add name=upload parent=WAN max-limit=50M

Monitoring

# Interface traffic
/interface monitor-traffic ether1

# Active connections
/ip firewall connection print

# System health
/system health print

# Log
/log print where topics~"firewall"

# Torch (real-time traffic analysis)
/tool torch interface=LAN

Configuration Backup

# Export text config (partial or full)
/export file=config-backup

# Binary backup (includes passwords)
/system backup save name=full-backup encryption=aes-sha256 password=secretpass

# Restore binary backup
/system backup load name=full-backup password=secretpass

Troubleshooting

IssueSolution
Locked outReset via reset button (hold during boot); or connect via MAC in WinBox
Slow performanceCheck CPU with /system resource print; disable unnecessary services
Firewall blocking trafficAdd logging to rules: action=log log-prefix="BLOCKED"; check /log print
DHCP not workingVerify pool and network config; check interface is in bridge
VPN tunnel not establishingCheck firewall allows IKE (500/4500 UDP) and ESP (protocol 50)
DNS not resolvingVerify /ip dns print; check allow-remote-requests=yes
BGP peer not establishedVerify peer address, ASN, and firewall allows TCP 179