CHR 60-day trial

/system license renew 
level: p1


Server: only delegate IPv6 prefixes, not addresses:

# Client
/ipv6 dhcp-client
add add-default-route=yes interface=ether5 pool-name=pub-pool-1 request=prefix
/ipv6 address
add address=... eui-64=yes from-pool=pub-pool-1 interface=ether5


Hardware offloading(Chip) > Fast Forward(CPU) > Fast Path > Slow Path

/interface bridge settings print


  /ip cloud set ddns-enabled=yes
Export memory log
  /log print file=log.txt
Port scan
  /system telnet 80
Check link speed
 /interface ethernet monitor
  /user ssh-keys import public-key-file= user=
  /ip ssh print
  /ip ssh set forwarding-enabled=local


  • CPE: Client device
  • BasicAP: Wireless
  • HomeAP: Wireless/Guest; WAN; LAN; VPN; System update/reset/password
  • Wireless ISP (WISP) AP: 802.11/nstreme/nv2 Wireless Bridge/Router; VPN; System update/reset/password
  • Home Mesh: Enables the CAPsMAN server in the router, and places the local WiFi interfaces under CAPsMAN control. Just boot other MikroTik WiFi APs with the reset button pressed.
  • not adding self => Wireless -> CAP: CAPsMAN addr add “”
  • “No supported channel” => reset with default config and run quickset first
  • PTP Bridge AP: transparently interconnect two remote locations together in the same network, set one device to this mode, and the other => PTP Bridge CPE


802.11 - station: if L2 bridging on station is not necessary - as in case of routed or MPLS switched network - station-pseudobridge : single MAC address translation - station-pseudobridge-clone : either address configured or first forwarded frame

    /interface wireless
    set [ find default-name=wlan1 ] disabled=no mode=station-pseudobridge ssid=Soyo_22MAR8287
    /interface wireless security-profiles
    set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk group-ciphers=tkip,aes-ccm mode=dynamic-keys supplicant-identity=MikroTik unicast-ciphers=tkip,aes-ccm wpa-pre-shared-key=88888888 wpa2-pre-shared-key=88888888


RouterOS AP accepts clients in station-bridge mode when enabled using bridge-mode parameter.

default-forwarding (on AP) – gives ability to disable the communication between the wireless clients
default-authentication – enables AP to register a client even if it is not in access list. In turn for client it allows to associate with AP not listed in client’s connect list


Hold this button before applying power, release after three seconds since powering, to load backup Boot loader.
If you keep holding this button for 2 more seconds until LED light starts flashing, release the button to reset RouterOS configuration to default (total 5 seconds)



/ip hotspot walled-garden
ip add dst-address= action=accept
add dst-host=:^ path=":/*\$"
    >>> regular expression start with a colon (':')
    >>> $ requires the escape character '\' to stop it from be processed as an actual $)


Packet Flow


Model Alias Arch Dude Chip CPU MHz RAM Storage Ports PoE In Out Mbit/s dBi
RB750Gr3 hEX MMIPS v6/7 MT7621A 2C4T 880 256 16/TF/USB 5/1G 8-30 V N/A N/A
RB941-2nD hAP lite SMIPS - QCA9533 1C 650 32 16 4/100 MicroUSB N/A 300 1.5
RB951G-2HnD MIPSBE - AR9344 1C 600 128 128 5/1G 8-30 V N/A 300 2.5
RBD52G-* hAP ac² ARM32 v6/7 IPQ-4018 4 716 128 16/USB 5/1G 18-28 V N/A 300/867 2.5/2.5

Switch Chip

Model RB3011 RB951G RB750G RB951Ui-2HnD RB951-2n RB750Gr3
Feature QCA8337 Atheros8327 Atheros8316 Atheros8227 Atheros7240 MT7621
Port Switching yes yes yes yes yes yes
Port Mirroring yes yes yes yes yes yes
TX limit yes yes yes yes yes no
RX limit yes yes no no no no
Vlan table 4096 entries 4096 entries 4096 entries 4096 entries 16 entries no
Rule table 92 rules 92 rules 32 rules no no no

Switch VLAN

  • vlan-mode # QCA8337(RB3011) and Atheros8327(RB951G-2HnD): when vlan-mode=secure is used, it ignores switch port vlan-header options.
  • fallback
    • check ingress
    • If ingress traffic is tagged and egress port is not found in the VLAN table for the appropriate VLAN ID, then traffic is dropped.
    • forwards all untagged traffic. If a VLAN ID is not found in the VLAN Table, then traffic is forwarded. Used to allow known VLANs only in specific ports.
  • check
    • check ingress, drops all untagged traffic.
    • If ingress traffic is tagged and egress port is not found in the VLAN table for the appropriate VLAN ID, then traffic is dropped.
  • secure

    • check ingress, drops all untagged traffic. Both ingress and egress port must be found in the VLAN Table for the appropriate VLAN ID, otherwise traffic is dropped.
  • vlan-header

  • =leave-as-is default
  • =always-strip for access ports
  • =add-if-missing for trunk port

Bridge VLAN

FastPath + Conntrack = FastTrack

Sniffer and Wireshark

/tool sniffer print # running: yes/no
# wireshark capture filter: udp port 37008
/tool sniffer => click Start!

/interface ethernet switch set switch1 mirror-source=



tun, RouterOS defines this as ip. tap, which is needed for bridge mode gateways. RouterOS defines this as ethernet.


Both WAN:
1 Server:



Bandwidth-based load-balancing with failover:

Bonding: - You need to control of both ends of the link Policy routing: - Not dynamic / Scalability problems PCC: - Not bandwidth wise Bandwidth based: + scalable | MPLS TE / Mangle + scripting

Bandwidth based - Mangle + scripting

Steps: from page 23

PCC - diff subnet/bandwidth mark connections -> associate routing marks with packets -> Create routes - p81: action=accept chain=prerouting dst-address=172.*.0.0/24 - p91: action=mark-connection chain=prerouting connection-mark=no-mark in-interface=LAN new-connection-mark=WAN1 passthrough=yes per-connection-classifier= - p100a: action=mark-routing chain=prerouting connection-mark=WAN1 new-routing-mark=WAN1-mark passthrough=yes - p100b: action=mark-routing chain=output connection-mark=WAN1 new-routing-mark=WAN1-mark passthrough=yes - p104: action=mark-connection chain=prerouting connection-mark=no-mark in-interface=WAN1 new-connection-mark=WAN1 passthrough=yes

WAN + ppp

/ip firewall nat add action=masquerade chain=srcnat out-interface=l2tp-out1
/ip route add dst-address= gateway= ...


TopCommon mistakes:


Web Helper | need SignUp: |


:put [resolve server] # put=print





Grafana & Prometheus

Manage Remote

ROS v7: conf socks4 and route

/ip route add dst-address= gateway=l2tp-out1
/ip socks set enabled=yes