Skip to main content

Documentation updates - October 16, 2026

Summary of documentation changes made on October 16, 2026.

Getting Started​

  • Backup: Full overhaul, tested on RouterOS 7.26beta1 on the hAP ax² lab router. Turned into a task-oriented page: save an encrypted backup, verify it in the file list, restore it including the exact confirmation flow, what the backup does and does not contain (device-specific, includes the device's MAC addresses; The Dude and User Manager databases excluded), and a troubleshoot section. Verified on the lab that a password alone encrypts with aes-sha256, dont-encrypt=yes keeps the file unencrypted even with a password, and that an unencrypted backup stores the configuration in readable form. Replaced the 2018-era example output with fresh captures and links the lighter alternatives (safe mode, undo/redo) and the Files page.

CLI Reference​

  • /system/backup/save, /system/backup/load: Removed the "Since RouterOS v6.43" version qualifiers; parameter descriptions verified on the lab and rewritten (save: name, password, encryption with the aes-sha256 default and legacy rc4, dont-encrypt; load: name, password, force-v6-to-v7-configuration-upgrade).
  • /tool/traffic-generator: Full parameter descriptions for all 14 pages (see Traffic Generator above), including the defaults (test-id 0, latency-distribution-max 100us, stats-samples-to-keep 100) and the stats sub-menu columns.

Developer Guides​

  • API: Protocol reference overhauled and verified against the API service on the 7.26beta1 lab router (plaintext login and the legacy challenge over 8728, tags, listen/cancel with category=2 interrupted trap, getall, query words, OIDs through .proplist, traps). Rewrote the initial-login section to present the plaintext method as the login method and the MD5 challenge-response as the method of older RouterOS versions (current RouterOS rejects the legacy response), refreshed the OID example (cpu-load no longer ships an OID), corrected the trap section (category attribute is not present on every trap) and the listen examples (booleans now print true/false, deleted items report =.dead=true), removed the 2006/2010-era example transcripts, and clarified that the cert-less api-ssl mode only offers anonymous Diffie-Hellman ciphers, which current TLS clients reject.
  • Python 3 example: Rewrote the example client: plaintext-first login with automatic fallback to the legacy challenge-response, fixed an infinite loop when input closes, utf-8 encoding, and a secure-mode comment explaining the certificate requirement. The rewritten client was tested against the lab API.
  • Developer Guides: Landing page text tightened.
  • Scripting: Rewritten and verified claim-by-claim on the 7.26beta1 lab router. Corrected the scope rules (globals are not limited to the block they are declared in; in the interactive CLI a :local stays visible on the following lines; an undeclared variable can be read and returns an empty value, but assigning a value to it is a compilation error), the bitwise operators section (&, |, ^, <<, >> work on integer numbers and on IP/IPv6 addresses; only ~ is IP-only — IPv6 shifts work), the hexadecimal escape rules (hex letters must be uppercase, and \ff parses as \f + f), the :nothing and :tolf reference rows, and the !comments print parameter (it hides the comment banners, it does not filter entries). Refreshed the :timestamp example and the reserved-variable-names explanation (a name that collides with a built-in property resolves to the per-item property inside a where expression).
  • Scripting Examples: Verified the file create/append workaround and the DNS-cache site-blocking example on the lab; added a note that the ppp-secret parser needs CR/LF line endings, and an alternative approach for site blocking using the firewall tls-host (SNI, HTTPS) and content (HTTP) matchers.
  • Scripting Tips and Tricks: Corrected three tips about declaring global variables that no longer match current RouterOS — a script or a function can read a global variable, or call a function defined in another script, without re-declaring it; the declaration is only required to change its value. Noted that the /interface wireless info hw-info tip applies only to devices with the legacy wireless package.

Diagnostics, Monitoring & Troubleshooting​

  • Traffic Generator: Turned into a task-oriented page: the property tables moved into the CLI reference, which received full parameter descriptions (14 pages, including the packet-template builder with the IPv4/IPv6/UDP/TCP header fields and the stats sub-menus). Corrected the stream property num to id (the old name no longer exists), added the packet-count, cpu-core and read-only default-port stream properties, updated the header-stack/first-header enums with the ipv6 and tcp headers, and removed the quick command's duration and freeze-frame-interval parameters (no longer exist on 7.26). The device-mode info box now states that the traffic generator is disabled by default in every device mode, how to check it, and that enabling it needs a physical confirmation (button press or power cycle). The IPsec benchmark example was fixed — enc-algorithms=aes-128 is a syntax error on RouterOS 7 and is now aes-128-cbc.
  • Downgrading RouterOS: Corrected to the current RouterOS — the factory-software field was renamed minimum-version, and the architecture is reported as architecture-name; replaced the fabricated example output with a real /system/resource/print capture, called out that a downgrade needs the main routeros package and every installed extra package (such as the wireless driver), and that the router downgrades to the version of the uploaded packages during the reboot.
  • NetFlow analysis with Elasticsearch, CEF with Elasticsearch, Syslog with Elasticsearch: Verified the RouterOS-side commands on the lab (/system/logging/action with remote-log-format=syslog/cef, syslog-facility, cef-event-delimiter, syslog-time-format; /ip/traffic-flow with an interface list and a target on the default 2055/UDP, NetFlow v9), fixed the missing image alt text and the malformed ros_paths, and clarified the CEF example action name and the Elastic-side default port.

Virtual Private Networks​

  • GRE: Verified and rewritten claim-by-claim on a pair of 7.26beta1 lab routers connected through a GRE tunnel. Corrected the keepalive section — keepalive is enabled by default (10s,10, minimum interval 1 second; a 0-second setting is rejected, unsetting the property removes it but changes nothing about the observed running-flag behavior), and on the tested build a tunnel keeps its running flag even while the remote end is unreachable (the running flag only guarantees the remote end answered once); refreshed the stateless/blackhole explanation around it. Removed the claim that GRE can be used in bridged designs — the interface cannot be added as a bridge port on RouterOS 7 (EoIP covers Layer 2). Confirmed the overhead numbers on the lab (actual-mtu 1476 for GRE over IPv4 and 1456 for GRE over IPv6 on a 1500-byte interface), verified the ipsec-secret requirement to disable fast-path, added a troubleshooting section, and refreshed the two-site example (including running the exact setup on the lab).

  • EoIP: Verified and rewritten claim-by-claim on a pair of 7.26beta1 lab routers connected with a bridged EoIP tunnel. Confirmed the Layer 2 behavior end-to-end (bridging, ARP, RSTP and MAC learning across the tunnel) and the 42-byte overhead (8-byte GRE header with key, full inner Ethernet frame, outer IPv4 header) — actual-mtu 1458 for EoIP over IPv4 and 1444 over IPv6 on a 1500-byte path. Documented the real keepalive behavior: enabled by default (10s,10), the running flag is removed when the peer does not answer for interval × retries; values below 1 second are rejected, and unsetting keepalive turns the mechanism off (the flag then stays up with a dead peer). Documented that the running flag alone does not prove matching tunnel-ids (with mismatched ids both ends stay running but drop all traffic), the MAC-address handling (locally administered by default, any value accepted — keep them unique per bridge), and the IPsec option (ipsec-secret, with allow-fast-path=no required on IPv4; the IPv6 menu has no fast-path property). Reworked the two-site wireless example for the default RouterOS configuration (LAN ports are already bridged) and verified the exact setup on the lab.

Documentation updates - October 15, 2026

Summary of documentation changes made on October 15, 2026.

System​

  • SNMP: Full overhaul, tested on RouterOS 7.26beta1 on hAP ax² boards. Turned into a task-oriented guide: enable SNMP for a collector, restrict a community, SNMPv3 security (MD5/SHA1/SHA256/SHA384/SHA512, DES/AES, 8-character minimum passwords), how to find any OID with print oid, receive traps (trap version, trap-interfaces semantics, send-trap), and SNMP write (identity, run scripts, reboot), plus a check-and-troubleshoot section and technical details (engine ID vs. engine-id-suffix, reply source address, the MIB set). All examples and outputs are fresh captures; the denied-oids per-community blacklist is now documented. The image has alt text, and the old wrong claims were removed (the "script value must not be 0" rule, the address/trap-interfaces misstatements).

CLI Reference​

  • /snmp, /snmp/community, /snmp/send-trap: Menu intros and all parameter descriptions filled in (27 rows), including engine-id-suffix, denied-oids, the SHA-2 authentication protocols, and the trap-generator options.
  • /tool/snmp-get, /tool/snmp-walk: All argument descriptions filled in (previously empty), including the port, next (GETNEXT) and the SNMPv3 parameters.

Documentation updates - October 14, 2026

Summary of documentation changes made on October 14, 2026.

System​

  • Device mode: Rewritten and tested on RouterOS 7.26beta1. All examples and outputs refreshed, with verified mechanics: confirmation with the reset or mode button or a power cycle (a regular reboot does not confirm), mode replacement versus per-feature updates, print config showing only non-default settings, the update-attempt counter and its reset window (activation-timeout), and configuration for a disabled feature being created inactivated.

CLI Reference​

  • /system/device-mode, /system/device-mode/update: Menu intros and all parameter descriptions filled in, including which tools and menus each feature switch controls (speed-test under bandwidth-test, ping-speed under traffic-gen) and the attempt-counter reset window.

Documentation updates - October 9, 2026

Summary of documentation changes made on October 9, 2026.

Diagnostics & Monitoring​

  • Netwatch: Rewritten and tested on RouterOS 7.26beta1. Every probe type (simple, ICMP, TCP-conn, HTTP-GET, HTTPS-GET, DNS) has its own section with a working example and an explanation of how thresholds decide the verdict — including that thresholds have defaults even when unset, and how early-success-detection and early-failure-detection work with thr-loss-count. The Scripts section covers the probe variables, the internal *sys user and the four allowed script policies.
  • Neighbor discovery: Rewritten. New "Choose which interfaces participate" section (discover-interface-list, mode=rx-only, master and slave interface behaviour) and an LLDP-MED Network Policy example that configures a VoIP phone port with a tagged voice VLAN and untagged PC data. LLDP TLVs, aging and SNMP behaviour are documented in Technical details.
  • Profiler: Rewritten. Documents the cpu=total, cpu=all and single-core views, duration and freeze-frame-interval, what the first frames show, a "Find a busy process" walkthrough, and the full classifier table including system rows and the unclassified fallback.
  • Health: Expanded with a full readings table (names, units, numbering), voltage and temperature details, the power supply state table, legacy device notes, fan control behaviour (including the PoE-out load table and manual fan control), and monitoring options: SNMP trap and OIDs, REST API and an email alert example.
  • Traffic Flow: Rewritten. Covers enabling the service and choosing interfaces, packet sampling, export targets, the flow counter monitor, IPFIX field selection, a minimal end-to-end example, and notes on what traffic is counted (CPU-routed traffic only, mirrored frames never reach the input chain).
  • Resource: Rewritten. Live monitoring, per-core CPU breakdown, interrupt (IRQ) pinning with an example, Receive Packet Steering and when it pays off, the PCI/USB/SCSI hardware map, and USB device authorization and power reset.
  • Interface stats and monitor-traffic: Rewritten. The stats and stats-detail counters are explained (including the Fast Path counters, queue drops and link-down counts), along with live per-second rates in monitor-traffic and script triggers with /tool/traffic-monitor.

Management Tools​

  • RoMON: Rewritten. Enable, choose participating ports (wildcard default entry, physical interfaces only), protect the overlay with secrets — including a step-by-step secret rotation that can be performed over RoMON itself — discover routers, RoMON ping, SSH over RoMON and WinBox access. Notes the RB5009 switch-chip limitation and the EtherType and multicast MAC details in Technical details.

System​

  • Precision Time Protocol: Rewritten. Configuration (profile and ports, per-profile presets), PTP on VLAN ports (bridge VLAN table requirement and the tagged-trunk alternative), IGMP snooping static MDB entries, synchronization monitoring with /system/ptp/status and /system/ptp/monitor, and the supported devices list.

Hardware​

  • PoE: Reworked from a PoE-Out page into a general PoE guide covering both PoE out (PSE) and PoE in (PD). New power classes table for 802.3af/at/bt, how to read which passive PoE a device supports from its specification, PoE in configuration and powering requirements, examples for both directions, logging and warnings, and troubleshooting.

CLI Reference​

Documentation updates - October 8, 2026

Summary of documentation changes made on October 8, 2026.

Storage​

  • Btrfs RAID: New "Expanding Btrfs-RAID" guide. Adding members with add-device registers each disk at its full size but moves no data until balance-start converts the profiles (a two-disk RAID1 becomes a four-disk RAID10 with twice the usable capacity).

Management Tools​

  • CMR: Pairing clarified: each pair command takes the username and password of the other device — the server's /cmr/device/pair takes a user of the client, the client's /cmr/client/pair a user of the server. Pairing can usually be completed from one console; only confirm forces action on the server console. New example pairs devices by their individual stock passwords: run /cmr/device/pair username=admin password=<password from one box> once per box, and use labels instead of all to limit a run to part of the fleet.

Wireless​

  • Wi-Fi: The page now covers Wi-Fi HaLow (802.11ah) interfaces next to Wi-Fi 6/7. The Network section explains provisioning: labels default to all, each radio automatically gets labels such as 2ghz, 5ghz and 6ghz plus its MAC address, - negates a label, and extra-labels assigns more. New "Converting to/from network-managed Wi-Fi" section: the order RouterOS follows to pick a configuration (static entry, provisioning, network, disabled stub) and how to convert with provision and /interface/wifi/liberate. Radio capabilities now document every hw-caps value (channel-switch, hw-protection-mode, qos-classifier-dscp, sniffer, spectral), and the new "Radio settings" section covers /interface/wifi/radio/settings (default-country, external-antenna, wifi-band).
  • Wi-Fi: Corrections in the same pass: warnings moved to the parameters they belong to (encryption ciphers, 802.11r roaming), distance and vlan-id descriptions clarified (HaLow and wifi-qcom-ac do not offload VLANs), and the spectral scan/history and WPS client examples fixed.

Documentation updates - October 7, 2026

Summary of documentation changes made on October 7, 2026.

Management Tools​

  • SSH, ssh-exec: Execution details verified on the lab router: multiline remote commands are executed on RouterOS 7.25 and later (the SSH server still does not provide pseudo-tty). exit-code is the code reported by the remote command shell, while failures of RouterOS commands come back as error text in output. The ssh-exec example was corrected to read the link status with monitor ... once as-value.
  • CMR: New "run-script permissions" section: scripts sent with /cmr/device/run-script run on each client with the read, write, test and reboot policies, without a user session. Commands that need other policies fail with "not enough permissions (9)" — for example /user add needs policy and /tool sniffer needs sniff, so /export also fails. Sensitive values are masked as * but can be set. Scripts and scheduler entries created by run-script are saved with the same four policies and the *sys owner, and a wider policy is reduced back to the four.

Wireless​

  • Wi-Fi: The authentication-types list now includes wpa3-psk-gd, and the default value description was rewritten: with a passphrase configured, the default set depends on the WiFi standard, band and mode — 6-7 GHz APs default to WPA3-PSK and GD, WiFi 7 APs in 2.4/5 GHz to WPA2/WPA3-PSK and GD, WiFi 5/6 APs to WPA2-PSK and stations to WPA/WPA2-PSK.

Hardware​

  • PoE: Global settings and monitoring tables synced with the CLI reference: added poe-in-max-power, the jack-max-power and 2pin-max-power variants, the per-power-source poe-out-max-power rows and the read-only PoE controller firmware version. Monitoring gained the port-type and poe-voltage fields, a refreshed poe-out-status list (no-valid-PSU, lldp-power-off, low-voltage-pd-detected and more) and a note about the "power-limiting port" status on devices powered via PoE-In.

Documentation updates - October 6, 2026

Summary of documentation changes made on October 6, 2026.

Management Tools​

  • CMR: The Alert rules section now separates state alerts from event alerts, with a table that compares them:
    • A state alert (CPU, memory, disk, and health thresholds, connected, disconnected-more-than, upgrade-available) stays active while all its conditions match. It runs its actions once when it becomes active and counts in devices-on and the dashboard until it clears.
    • An event alert (interface-change, upgrade-done, upgrade-job-done, rebooted, unpaired-device-connected, or a log message matched by log-topics and log-regex) runs its actions for every occurrence and never stays active. A rule can combine several state conditions but has at most one event condition.
    • A new Device and system scope section: most alerts apply per device, and upgrade-job-done is a system alert that reports a whole upgrade job without device context.
    • show-devices lists the devices on which a rule's state alert is active. It lists no devices for an event alert, whose fired value counts the occurrences instead.
  • CMR, CMR-Client: Corrections to connecting and pairing clients:
    • Clients connect to the server over TCP port 54321. Allow it in the server's input chain and in any firewall between the clients and the server. The client troubleshooting for status: searching now points to the port and the firewalls.
    • The client's pairing-requirement supports none and password. confirm exists only on the server, where /cmr/device/pair approves the pairing. The client-side confirm case is gone from the troubleshooting list.
  • CMR, CMR-Client: Details of upgrades, reboots and alerts:
    • /cmr/device/upgrade without channel upgrades each device on its own upgrade channel, and with schedule-time the job waits for the next occurrence of that time. A job it starts for devices selected by number has no labels, and run-next starts a job scheduled this way itself.
    • Removing a scheduled job marks it cancelled and keeps it in the list. Removing a cancelled job deletes it.
    • The server's log messages for device upgrade results, newly available versions and reboots are listed. reboot returns right away.
    • Alert variables: [state] is empty for a paired device with nothing in progress, the usage values are unknown until the device reports them, [upgrade-error] is empty after a successful upgrade, [upgrade-state] is the final state of the device in the job, and the job times have the form 2026.10.06-14:20:36.
    • When CMR restarts on the server, state alerts that still match become active again and run their actions.
    • The REST API returns the WiFi passphrase to users with the sensitive policy.
    • The client logs each change of its status and reconnects with its existing pairing when the connection to the server drops.
  • CMR, CMR-Client: Defaults and server settings:
    • fail-policy defaults to stop, and stop with strategy=parallel no longer needs order. Only continue-order requires it.
    • upgrade-check-interval defaults to 10h. apptraffic-devices defaults to the gateway label, and all selects every device.
    • The client's pairing-requirement defaults to password.
    • Clients find the server through neighbor discovery or DNS: the client resolves _cmr._tcp.lan and _cmr._tcp. followed by the domain name from DHCP option 15. DHCP alone does not announce the server.
    • /cmr set !<setting> returns a setting to its default. Changing packages-directory, upgrade-check-interval, or pairing-requirement restarts CMR on the server, so every client reconnects and state alerts fire again.
    • Changing an enabled alert rule, even only its comment, makes its state alert fire again on the devices that match.
    • In the links value of a layout link, a * before a port name marks a direct, physical link. It does not mark the PoE supplier.
  • CMR: Node coordinates are relative to the layout center: x increases to the right and y downward, so a smaller y places a node higher on the map.
  • SSH: The page is reorganized around the SSH server, the interactive client, and scripted use. A new "Verify remote host keys" section explains the known-hosts-validation setting (enabled on new installations, kept as-is on upgrades), the interactive trust and key-update prompts of /system/ssh, and the ways to make ssh-exec and SFTP fetch work with validation on: pinning keys in /ip/ssh/known-hosts, known-hosts-ignore, or known-hosts-trusted-subnets. The "Server host key" section documents the fingerprint, regeneration, and the export file names. Importing a client-side private key now lists the accepted PEM formats and notes that OpenSSH private keys are rejected. The ssh-exec example no longer contains a plain-text password and states its prerequisites.

CLI Reference​

  • /cmr/alert, show-devices: Descriptions follow the state and event split. connected is a state condition, rebooted and the log conditions are event conditions, devices-on counts only active state alerts, and reset-on-disconnect applies to state alerts. show-devices lists the devices on which the rule's state alert is active.
  • /cmr: pairing-requirement=password takes the username and password of a RouterOS user on the device, as in the CMR guide. CMR has no separate pairing password.
  • /cmr/device/upgrade, reboot, /cmr/upgrade/job, run-next: Descriptions of the channel and schedule-time of a device upgrade, the empty labels and channel of its job, run-next for a job scheduled this way, and the log message after a reboot.
  • /cmr, /cmr/client, /cmr/upgrade, /cmr/device/upgrade, /cmr/layout/link: Defaults for upgrade-check-interval, apptraffic-devices, fail-policy and the client's pairing-requirement, DNS discovery in controller-addresses, order required only for continue-order, and the * in links.
  • /cmr/client, /tool/apptraffic, /system/routerboard/usb: The MIPS-LE architecture (mipsel), which has no RouterOS 7 release, is no longer listed in the conditions of these pages or in the application traffic note of the CMR guide. The /system/routerboard/settings/keep-frequency page is removed: the command exists only on MIPS-LE devices.
  • /ip/ssh, known-hosts, /system/ssh, /system/ssh-exec: All parameter descriptions are filled in, including the host-key validation settings and the previously undocumented host, key, port and vrf parameters. ssh-exec now documents what its exit-code and output carry on remote command failure.
  • /interface/wifi/radio: References to the unreleased "meshpoint" mode are removed.
  • /ip/dns/adlist, DNS: Disabling an adlist does not free its cache memory.

Mobile Networking​

  • LTE/5G: New "Multi APN" section: check max-apn-count with show-capabilities, create a slave LTE interface with master= for each additional APN connection, and the interface's apn-profiles parameter is renamed to apn-profile (the old name is still accepted for single-APN configuration).

Firewall & QoS​

Hardware​

  • CRS310-8G+2S+IN: The reset button section lists its three functions. A configuration reset now waits for the PWR LED to flash instead of the USR LED, and Netinstall describes both the Regular Booter (press Reset 1–2 seconds after power-on) and the Backup Booter (hold Reset while powering on until the LED blinks, turns steady, and goes off).

Documentation updates - October 5, 2026

Summary of documentation changes made on October 5, 2026.

Site​

  • Documentation versioning: The documentation for RouterOS 7.25 was frozen as version 7.25 and is selectable from the version dropdown. The current documentation now describes RouterOS 7.26.

Management Tools​

  • CMR: New guide for CMR, the server in the cmr package that monitors and manages a fleet of RouterOS devices, available from RouterOS 7.26beta1. It covers:
    • What CMR does and does not do, how the server and its clients connect, and where a new user starts.
    • Enabling the server and its settings, and pairing devices, with the typical scenarios and the password and confirmation requirements on both sides.
    • Managing devices: device properties, labels and the label selection syntax (+ for AND, - for AND NOT), and running commands on many devices at once.
    • The live dashboard (/cmr/device/dashboard), with a screenshot and a description of its eight sections.
    • Fleet upgrades: upgrade rules, starting an upgrade early with trigger, run-next or device/upgrade, the upgrade sources and the local packages-directory, job states and results (a device with no upgrade available counts as a failed upgrade), and the strategy and fail-policy settings.
    • Alert rules: conditions, the log, script and webhook actions, the placeholders for action text in device, event and alert groups, and how a rule fires.
    • Network topology: layouts, nodes and links, add-devices and rebuild-links, with a verified example and a screenshot.
    • Application traffic, central WiFi configuration (networks, radios, how the settings are applied, bridge and VLAN behaviour), and VLAN provisioning with a verified example and the risk of locking out the controller.
  • CMR-Client: New page for the device side, which is part of the main RouterOS package: enabling the client with controller-addresses, pairing from the client and its own pairing-requirement (none, password, or confirm), disconnecting, and troubleshooting.

CLI Reference​

  • /cmr, /cmr/client: New reference for the CMR server and client, with every parameter described: alert rules (alert, show-devices, test), devices (apptraffic, dashboard, pair, reboot, run-script, upgrade, wifi-logs), topology (layout, node, link, add-devices, rebuild-links), upgrades (upgrade, job, run-next, show-devices, trigger, version-check), and the vlan and wifi provisioning menus.
  • /interface/ethernet/pon, /interface/wifi/dashboard, /system/dashboard, /tool/apptraffic: Regenerated the reference for RouterOS 7.26beta1. New commands: PON settings with the ONU identity (onu-model, onu-registration-id, onu-serial-number, onu-vendor-id, also on /interface/ethernet), the WiFi and system dashboards, application traffic statistics, /interface/wireless/snooper/snoop, and reset-counters-all for switch rules. New parameters: dhcp-snooping-vlan-ids on bridges, current-forwarding-override in port isolation, and apn-profile on LTE interfaces. On /interface/vlan, force-mac-address is now forced-mac-address, and bandwidth is gone from Ethernet and power-line interfaces.
  • /interface/wifi/configuration, /interface/wifi/network, /caps-man/configuration: Settings from the sub-menus are now listed with their prefix, as they are set on the command line, for example security.authentication-types. WiFi uses aaa., channel., datapath., interworking., security., and steering.; legacy CAPsMAN uses channel., configuration., datapath., rates., and security..
  • CLI Reference: The address argument flags explain i (a bare interface name in place of an address, for example a point-to-point interface as a route gateway) and the new % flag (an interface suffix on an address, such as fe80::1%ether1). Every parameter that accepts IPv6 addresses also accepts a link-local address with its %interface suffix.

Getting Started​

  • Packages: Added the cmr package, supported on the arm, arm64, and x86 architectures, with a link to the CMR guide.

Wireless​

  • WiFi: The ft-preserve-vlanid parameter is not supported by the wifi-qcom-ac drivers.
  • Wi-Fi 5 (802.11ac): New warning: the wifi-qcom-ac driver is meant for indoor devices. It installs on the outdoor models (LDF 5 ac, LHG XL 5 ac, LHG XL 52 ac, NetMetal ac², mANTBox 52 15s, SXTsq 5 ac), but it does not support the distance setting that links longer than 2 km need, so use the wireless drivers on outdoor boards.

Documentation updates - October 2, 2026

Summary of documentation changes made on October 2, 2026.

Diagnostics & Monitoring​

  • Log: Rewritten and tested on RouterOS 7.25 against syslog, TLS and SMTP servers. Both property tables moved to the CLI Reference. Corrected: entries always show the full date, disk-lines-per-file defaults to 1000, TCP and TLS work with every format, and critical entries print once at the next login, not at every login. New sections:
    • Read the log: filter by topic, message and time, follow-only, extra fields with with-extra-info, saving to a file, and finding out who changed the configuration.
    • Log debug messages for one feature into its own memory buffer, with a warning that SSH debug messages contain session keys and session content.
    • Keep the log across reboots with the disk action: file rotation, folders on other disks, and reading older files.
    • Send the log to a syslog server: the default, syslog (RFC 3164) and cef formats, UDP, TCP and TLS, the TCP buffer, why to use CEF over TCP and TLS, and TLS with a trusted CA (check-certificate does not check the certificate name).
    • Email log messages, and run a script on a log message (an example collects the source addresses of failed logins in an address list).
    • How rules match entries (all listed topics must match, !, regex, prefix), the topic list, troubleshooting, and the wire format of each remote format.
  • CEF with Elasticsearch, Syslog with Elasticsearch: Fixed links to the reworked Log page and wrapped the RouterOS commands. The CEF guide no longer adds the same rules twice. Kibana and JSON blocks are no longer marked as RouterOS code.
  • Bandwidth test: Rewritten and tested between a hAP ax², a CCR2116 and a 64-core server. Property tables moved to the CLI Reference. New sections:
    • Prerequisites: the server, device mode on both routers, a test user with the test and winbox policies, firewall ports, and why UDP receive tests fail behind NAT.
    • Test a link at a fixed rate, measure the maximum throughput, check a link for packet loss with UDP at a fixed rate, and test wireless directions one at a time.
    • Read the results: UDP counts whole IP packets and TCP only the data; lost-packets counts the last second, not a total; the CPU load fields.
    • Test a router's forwarding capacity through a chain of three routers, with packet sizes and when to use the traffic generator.
    • Secure the server with allowed-addresses4 and allowed-addresses6 instead of turning authentication off; max-sessions counts tests.
    • Troubleshooting by status, and the ports and connections in Technical details.

CLI Reference​

Storage​

  • Storage package: The section index now calls the package by its current name, Storage package (rose-storage in /system/package/print), instead of ROSE.
  • Btrfs, Btrfs RAID, Btrfs maintenance, Btrfs snapshots: Reworked. An overview of the three Btrfs menus, the default <disk>-fs file system label, and what add-device and the balance do when converting to RAID1. The RAID commands now find the file system by devs instead of present-devs. Version notes removed.
  • SSHFS: New page. Mount a folder from an SSH server as a disk with /disk/add type=sshfs, with the mount states and how to change or remove the mount.
  • SMB: The server, share and user property tables moved to the CLI Reference. The page explains that the server starts by itself when the first share is added.
  • RAID, Hot spare, Moving an array: The RAID property table moved to the CLI Reference, the examples became top-level sections, and the hot spare page explains how the spare is configured.
  • Encrypted storage, Self-encrypting drives: Rewritten intros and examples, with the property tables removed. Encrypted storage on a RAID1 array. Self-encrypting drives need an Opal-compliant drive attached directly (not through a USB bridge), with the o and O flags explained.
  • iSCSI, NFS, NVMe over TCP, Rsync: Property tables removed, with improved intros and examples: the default ports (iSCSI TCP 3260, NFS TCP 2049, NVMe over TCP 4420), the default iSCSI IQN, and the NFS state when the port is blocked.

Hardware​

  • PoE-Out: Added the no_valid_psu, lldp-power-off, low-voltage-pd-detected and power-limiting values of poe-out-status.

Documentation updates - October 1, 2026

Summary of documentation changes made on October 1, 2026.

Getting Started​

  • Supout.rif: Rewritten. Corrected: the file is text with encoded sections, not a binary file. New: what the file holds and when to create it, writing it into a folder, creating it at a set time with the scheduler, downloading it with Files or scp, the automatic autosupout.rif after a crash, and the file format. The screenshots are now in the right WinBox and WebFig sections, with alt text. Try before RMA now links here instead of the Resource page.

Storage​

  • Tmpfs: Rewritten and tested on RouterOS 7.26. Corrected: tmpfs is part of the base RouterOS package and needs no Storage package (not on SMIPS devices). New sections:

    • Create a RAM folder, and what the sizes mean: decimal units, a maximum rather than reserved RAM, about half of the RAM when tmpfs-max-size is not set, and the total size check.
    • Check what the folder shares: on routers whose default configuration turns on automatic disk sharing (for example the hAP ax²), a new folder is shared through SMB to the guest user, who needs no password, and through DLNA. How to check it, and how to create the folder unshared or stop the sharing.
    • Keep packet captures in RAM and download them, check how full the folder is (a full folder makes writes fail), resize it and delete it.
    • Technical details: after a reboot the folder is mounted again empty, and a tmpfs cannot be formatted (use a Ramdisk for a block device).
    • The "RAM-backed folder" section of Disks now links here.

  • DLNA Media Server: Rewritten with tests from a computer and a second router as players:

    • Share a USB disk with the TVs on the LAN, and limit a server to one device with allowed-ip or allowed-hostname (the DHCP host name, exact and case-sensitive; only one of the two can be set). A note says that these limits are not access control.
    • The dynamic servers that automatic disk sharing creates (the hAP ax² default configuration turns it on). They cannot be edited, so turn off the disk's media sharing before adding limited servers.
    • Which files are listed: media files with lower-case extensions only, and an .srt file next to a video becomes its subtitles. A server without path shares the router's whole file list.
    • Troubleshooting, and technical details: SSDP discovery, HTTP on TCP port 2828, thumbnails, and why a server answers only on its own interface.

Firewall & QoS​

  • Address lists: Rewritten from a single v6-era example into tasks, each imported as written and tested on RouterOS 7.26:
    • Block traffic from a list of addresses with a raw rule, for IPv4 and IPv6.
    • Allow SSH and WinBox from a dynamic address by its DNS name, with the rule placed before the default drop rule and a warning on what it opens.
    • Block hosts that probe a closed port for a day, with a trusted list the rule skips, because a single packet with a forged source address is enough to list it.
    • View, remove, export and import entries. file= must come before where, or the export prints to the terminal and writes no file.
    • How entries behave: static and dynamic entries and what a reboot keeps, timeouts (up to 35w3d13h13m56s, reset by each new match), how prefixes and ranges are stored, and how DNS names resolve.
    • Corrected: a range written in short form such as 203.0.113.1-254 is stored as a DNS name and matches nothing, and IPv6 lists take no ranges.

Diagnostics & Monitoring​

  • Speed Test: Rewritten with tests between two routers and against the router's own bandwidth server.
    • Prerequisites: the remote router's bandwidth test server, a user whose group has the test and winbox policies, device mode, and firewall rules on both routers. Without a rule on the testing router, its firewall drops the UDP download traffic.
    • New section with tested firewall rules for a test over the internet. To limit who can run tests, use the server's allowed-addresses4 and allowed-addresses6: a user's address setting does not limit bandwidth test logins.
    • A table explaining the result lines, and the CPU warning explained.
    • Troubleshooting for authentication failed, missing throughput or UDP lines, and device mode.
    • Technical details: five parts of test-duration each (10 seconds by default, at least 5), 20 pings per second, the TCP connections and the ports used.
    • Corrected the old parameter notes. The default connection-count is 20, or the CPU core count of the router that runs the test when it has more than 20 (tested on a 64-core router).
  • Bandwidth test: Now links to Speed Test.
  • Detect Internet: Rewritten with the state rules tested on lab links. An interface becomes wan when the router's active route to 8.8.8.8 goes through it, and internet when the route to cloud.mikrotik.com does too and the cloud answers on UDP port 30000. Removed the old rule that DHCP makes an interface WAN, and the warning that it installs DHCP clients and routes, which did not happen on the lab. Verified and kept: the one-hour LAN lock and the return to lan only after a link change. New: a captured example on a default-configured router, the interface lists it fills and why they do not belong in trust rules, a note that it is not a failover health check, troubleshooting and how to turn it off.
  • Watchdog: Rewritten after deliberate ping watchdog reboots of a lab router. The router pings the address six times over ping-timeout and reboots when all six fail, and the log then shows System rebooted because of ping watchdog timeout. no-ping-delay is now ping-start-after-boot. New: a real-life example, a warning about repeated reboots, how long to wait after a boot, and the support output settings.
  • DNS update: The Dynamic DNS page is now about /tool/dns-update, and points to IP Cloud DDNS and Fetch for the common cases. Tested against a test DNS server: the update goes over TCP port 53, signed with hmac-md5, and replaces the name's A records; name is relative to the zone; the default TTL is one day. New: prerequisites, how to keep a name current, and what each error message means.

System​

  • IP Packing: Rewritten. Removed the v6-style discovery commands; prerequisites now explain that neighbor discovery must run on the interface on both routers. New: how to check it with the unpack field of the neighbor list, and the latency it adds. A warning says that TCP connections the router opens over a packed link fail.

CLI Reference​