Berik Ashimov // senior.it.engineer
Download CV
Series

MikroTik RouterOS 7 Guide

35 parts · read in order

  1. 1 RouterOS 7 First Boot Done Right: From Default Config to Hardened Baseline What to do in the first hour with a MikroTik router: RouterOS 7 default config anatomy, admin access, service lockdown, packages, NTP, and a hardening checklist. 11 min read
  2. 2 A RouterOS 7 Firewall That Actually Protects: Chains, States, and Fasttrack Build a drop-by-default MikroTik RouterOS 7 firewall: input and forward chains, connection tracking states, fasttrack trade-offs, address lists, and logging. 10 min read
  3. 3 RouterOS 7 NAT Beyond Masquerade: srcnat, Hairpin, and Netmap MikroTik RouterOS 7 NAT in depth: why static src-nat beats masquerade on stable IPs, dstnat port forwarding, hairpin NAT done right, netmap 1:1, and fasttrack pitfalls. 10 min read
  4. 4 Bridge VLAN Filtering in RouterOS 7: One Bridge, Zero Lockouts VLANs the RouterOS 7 way: a single bridge with vlan-filtering, tagged and untagged ports, hardware offload on switch chips, and a lockout-proof migration plan. 9 min read
  5. 5 DHCP and DNS on RouterOS 7: The Services Everyone Misconfigures DHCP server and DNS on MikroTik RouterOS 7: pools, static leases as inventory, DHCP options, DoH upstream, and why your router must never be an open resolver. 7 min read
  6. 6 WireGuard on RouterOS 7: Road Warriors, Site-to-Site, and Allowed-Address Discipline WireGuard on MikroTik RouterOS 7: interface and peer setup, road-warrior and site-to-site configs, allowed-address rules, firewall, MTU, and keepalives. 7 min read
  7. 7 IKEv2 on RouterOS 7: Certificates, Mode-Config, and the Profile/Proposal/Policy Maze IKEv2 road-warrior VPN on MikroTik RouterOS 7 with a local CA: profiles vs proposals vs policies explained, mode-config, split tunnel, iOS and Windows clients. 7 min read
  8. 8 IPv6 on RouterOS 7 Without Fear: Prefix Delegation, RA, and a Firewall That Holds Practical IPv6 on MikroTik RouterOS 7: DHCPv6 client with prefix delegation, router advertisements, addressing the LAN from a pool, and the IPv6 firewall. 7 min read
  9. 9 CAKE on RouterOS 7: Killing Bufferbloat Without a QoS Degree Fix bufferbloat on MikroTik RouterOS 7 with CAKE: queue types, simple queue vs queue tree, CAKE parameters, the fasttrack conflict, and verifying results. 8 min read
  10. 10 Multi-WAN on RouterOS 7: Recursive Failover, PCC Load Balancing, and When ECMP Is Enough Multi-WAN on MikroTik RouterOS 7: recursive routing failover with check-gateway, netwatch scripts, PCC load balancing with mangle, and ECMP trade-offs. 9 min read
  11. 11 Policy-Based Routing on RouterOS 7: Tables First, Marks Second Policy-based routing in MikroTik RouterOS 7: routing tables with fib, routing rules vs mangle marks, per-source VPN egress, and how to verify it all. 8 min read
  12. 12 OSPF on RouterOS 7: Templates, Not Network Statements OSPF on MikroTik RouterOS 7: the instance/area/interface-template model, ptp vs broadcast, SHA authentication, redistribution, and fixing ExStart neighbors. 7 min read
  13. 13 BGP on RouterOS 7: The Peer Is Dead, Long Live the Connection BGP on MikroTik RouterOS 7: templates and connections, address-families, output.network, iBGP vs eBGP, multihop, prefix limits, and why the new stack scales. 8 min read
  14. 14 Routing Filters in RouterOS 7: A Real Language, With One Nasty Trap RouterOS 7 routing filters explained: the if/then rule syntax, dst-len prefix matching, BGP communities, chains, bogon filtering, and the empty-chain trap. 9 min read
  15. 15 VRFs on RouterOS 7: Real Separation, Not Firewall Hope Virtual Routing and Forwarding on MikroTik RouterOS 7: /ip vrf setup, route leaking between VRFs, management VRF caveats, and VRF-aware troubleshooting tools. 6 min read
  16. 16 MPLS and LDP on RouterOS 7: Labels on a Budget MPLS and LDP on MikroTik RouterOS 7: OSPF underlay, LDP sessions, label bindings, the MPLS MTU trap that causes most outages, and LSP verification. 9 min read
  17. 17 VPLS on RouterOS 7: Layer 2 Over MPLS, With the MTU Math Done Right VPLS on MikroTik RouterOS 7: LDP-signaled pseudowires, bridge integration with split horizon, pw-l2mtu math, and when VPLS still beats EoIP or VXLAN. 6 min read
  18. 18 VXLAN on RouterOS 7: Layer 2 Over Any IP Network VXLAN on MikroTik RouterOS 7: interface and VTEP setup, unicast vs multicast BUM handling, the 50-byte MTU overhead, and hardware offload since 7.18. 6 min read
  19. 19 GRE, IPIP and EoIP on RouterOS 7: Picking the Right Dumb Tunnel Plain tunnels on MikroTik RouterOS 7: GRE vs IPIP vs EoIP, GRE over IPsec, keepalives, MTU discipline, and routing over tunnels without recursion accidents. 7 min read
  20. 20 Bonding and Spanning Tree on RouterOS 7: Redundancy That Actually Fails Over LACP bonding and RSTP/MSTP on MikroTik RouterOS 7: transmit hash policies, bond monitoring, edge ports, and why disabling STP keeps ending in tears. 7 min read
  21. 21 WiFi on RouterOS 7: The wifi Driver, CAPsMAN v2, and Roaming That Works MikroTik RouterOS 7 WiFi explained: wifi-qcom vs wifi-qcom-ac packages, the /interface/wifi model, CAPsMAN v2 provisioning, VLANs per SSID, WPA3, and 802.11r/k/v roaming. 8 min read
  22. 22 Containers on RouterOS 7: Useful, Dangerous, and Frequently Misused Running containers on MikroTik RouterOS 7: device-mode, veth and NAT wiring, mounts and registries, real use cases like Pi-hole and exporters — and the honest caveats. 8 min read
  23. 23 RouterOS Scripting That Does Not Bite: Scope, Arrays, and Error Handling A practical guide to MikroTik RouterOS 7 scripting: local vs global scope, arrays, foreach, find/get/set patterns, on-error handling, and the footguns that break production. 8 min read
  24. 24 Scheduler and Event-Driven Automation on RouterOS 7: Scripts That Run Themselves RouterOS 7 automation with /system scheduler, netwatch hooks, DHCP lease scripts, and Telegram alerts via fetch — plus guarding scheduled scripts against overlap. 7 min read
  25. 25 Automating RouterOS 7 with the REST API and Ansible: Desired State, Finally MikroTik RouterOS 7 automation: the built-in REST API, the binary API, and the community.routeros Ansible collection with idempotent api_modify playbooks. 7 min read
  26. 26 Monitoring RouterOS 7: SNMPv3, Prometheus, and the Metrics That Actually Matter Monitoring MikroTik RouterOS 7 properly: SNMPv3 setup, mktxp Prometheus exporter with Grafana, REST API polling, and which router metrics deserve alerts. 8 min read
  27. 27 RouterOS 7 Logging and Audit: Syslog, Firewall Logs, and NetFlow Without the Noise Logging on MikroTik RouterOS 7 done right: /system logging topics and actions, remote syslog, firewall logging without drowning, flash wear, and NetFlow. 8 min read
  28. 28 Backup, Export and Upgrades on RouterOS 7: Recoverable by Design RouterOS 7 backup strategy: binary backup vs export, scheduled off-box copies, upgrade channels, the correct RouterOS-then-firmware order, and netinstall. 7 min read
  29. 29 Centralized AAA on RouterOS 7: RADIUS for Logins, VPN and User Manager RADIUS AAA on MikroTik RouterOS 7: router login via RADIUS with local fallback, the v7 User Manager as RADIUS server, PPP/VPN auth, and accounting. 6 min read
  30. 30 Locking Down the RouterOS Management Plane: The Attack Surface You Forgot Hardening MikroTik RouterOS 7 management: /ip service restrictions, MAC-server and discovery on WAN, management VLAN with VRF, SSH keys, and WinBox exposure. 6 min read
  31. 31 DDoS on RouterOS 7: What a CPU-Routed Box Can Actually Absorb DDoS mitigation on MikroTik RouterOS 7: SYN cookies, raw table drops, notrack for known-good flows, dynamic address-list blocking, and honest limits. 8 min read
  32. 32 The RouterOS Troubleshooting Toolkit: Torch, Sniffer, Profile, and a Method Troubleshooting MikroTik RouterOS 7: torch live flows, packet sniffer streaming to Wireshark over TZSP, tool profile, conntrack inspection, and a real methodology. 9 min read
  33. 33 RoMON and Out-of-Band Access: Reaching Routers You Just Broke RoMON on MikroTik RouterOS 7: L2 management overlay setup with secrets, WinBox through an agent, discovery, plus serial console and reset-button recovery. 8 min read
  34. 34 L3 Hardware Offloading on RouterOS 7: Wire-Speed Routing, With an Asterisk L3HW offloading on MikroTik CRS3xx/CRS5xx and CCR2116/2216: enabling switch-chip routing, what offloads and what falls to CPU, and monitoring hw vs cpu routes. 6 min read
  35. 35 CHR: RouterOS as a VM, and Why Every MikroTik Shop Needs One MikroTik Cloud Hosted Router on Proxmox and public cloud: license tiers from free to p-unlimited, virtio specifics, lab twins, route reflectors, and VPN concentrators. 6 min read
← All series