Skip to main content

Documentation updates - September 24, 2026

Summary of documentation changes made on September 24, 2026.

Network Management​

  • Cloud: Rewrote the overview around what the cloud services do, with a table of the services, their menus and which ones run by default, and one explanation of how the router reaches cloud2.mikrotik.com (UDP port 15252) and the relay servers. The danger box and six warning boxes are gone; one note on availability remains (MikroTik devices and CHR with a paid license, not x86). The DDNS and time update behaviour was checked on RouterOS 7.25 with packet captures and reboots: the DNS name is the serial number in lower case with a 60-second TTL, a router behind NAT sends an update every minute, ddns-enabled=auto deletes the name, and use-local-address points it to the local address. The time update sets the clock once at startup, not on force-update, and not while the NTP client is enabled. Removed the wrong update-time=auto note and the claim that the DNS name is stored permanently. The property tables moved to the CLI Reference.
  • Cloud backup: New page, moved out of the Cloud overview and rewritten with tested examples for uploading, replacing, deleting, downloading on another router with the secret download key, and download-and-apply. It covers the one-slot limit and its error message, the password requirement, and the refusal of unencrypted backup files.
  • Back To Home: The app instructions are now numbered steps. New sections list what Back To Home adds to the router (the back-to-home-vpn WireGuard interface, the 192.168.216.0/24 and fc00:0:0:216::/64 addresses, dynamic firewall and NAT rules, and the vpn.mynetname.net name), how to manage users in /ip/cloud/back-to-home-user with a tested client configuration, and what revoking removes: all users, with new keys on the next enable. This replaces the old advice to delete WireGuard peers by hand and the unneeded ddns-enabled=yes step.
  • File Share: Rewrote the page from tests through the relay, covering directory and file shares, ?dl downloads (download.zip for directories), uploads (refused with 403 unless allow-uploads=yes), expiry, disabling, how the Let's Encrypt certificate and the relay work, and how to stop the service and delete the certificate with remove-certificate. Fixed the WinBox menu names and removed the menu that does not exist from the page metadata.
  • Communication with MikroTik Cloud Services: Corrected the table of connections to MikroTik servers: cloud backup also connects for print, File Share stops when the last share is removed, and Back To Home and File Share also use the relay servers.
  • Cloud, Cloud backup, Back To Home, File Share, Communication with MikroTik Cloud Services: Each page now keeps its main text task-oriented and ends with a Technical details section. It covers the servers and ports used, how DDNS updates and the time update at startup work, what Back To Home adds to the router, how the File Share certificate and the relay work, and what happens when the router cannot reach the cloud server.
  • DNS: Rewrote the page around tasks, all tested on RouterOS 7.25: using the router as the network's DNS server (with the default configuration and the firewall), static entries (record types, regular expressions and their command-line escaping, FWD entries to other servers, filling firewall address lists), DNS over HTTPS, adlists, forwarders and the mDNS repeater. A Technical details section explains how a query is answered, how upstream servers are chosen, and how the cache, DoH, adlists, forwarders, VRF and the mDNS repeater work. Corrected the default of static entries (enabled) and the rule on overlapping entries, and documented that DoH has no fallback, that adlists block only A and AAAA queries and need a large enough cache before the import, that forwarders do not skip a dead server, and that the mDNS repeater handles only IPv4. The property tables moved to the CLI Reference, and the 17 admonitions became plain text.
  • DNS: Reorganised the rewritten page for new and advanced readers: the intro says that DNS works with the default configuration and that the router's features apply only to devices that use it as their DNS server, a new Check and troubleshoot section covers :resolve, the answer statuses and the dns log topic, and the tasks follow the order readers need them. Added that adlists verify the server certificate by default (ssl-verify), that new queries are dropped when max-concurrent-queries is reached, and corrected the wording on settings changes (they take effect at once) and on the firewall rule the mDNS repeater needs.
  • Proxy: The section index is now a short overview of the two web proxies, the web proxy for clients on your network and the reverse proxy for servers behind the router, with a link to SOCKS. The old web proxy content moved to its own page.
  • Web Proxy: Rewrote the page from tests on RouterOS 7.25, with a regular and a transparent proxy, a second router as parent proxy and a test web server. It now explains HTTPS: the proxy relays CONNECT tunnels for regular clients, filters them by host name, address and port only, cannot cache them, and cannot take HTTPS in transparent mode. New sections cover keeping the proxy from becoming an open proxy (it listens on all IPv4 and IPv6 addresses and opens tunnels to any port), checking and troubleshooting with monitor, connections and the web-proxy log topic, how host and path rules match (whole-string and case-insensitive host names, the query string in path, : regular expressions), the redirect action, the editable error page from reset-html, which responses the cache stores and when it answers without asking the server, X-Cache and the DSCP mark on cache hits, the parent proxy and the direct list, the headers the proxy adds, and a short table of HTTP methods. Removed the wrong claims that dst-host matches words in the URL, the obsolete redirect-to parameter, the Direct list's contradicting defaults and the copied RFC 2616 text. The property tables moved to the CLI Reference.
  • Cloud section images: Converted the screenshots to WebP, deleted nine unused duplicates, and added alt text to every image.
  • SOCKS and Socksify: Rewrote both pages from tests on RouterOS 7.25, with the proxied connection captured on the wire between two routers. The SOCKS page now leads with enabling the server and explains that the default version=4 refuses SOCKS5 clients, how the access list decides (first match wins, no match is allowed, so a restrictive list ends with a deny rule), that users are created enabled (the old default was wrong) and how to monitor connections with a current print example. The Socksify page explains what NAT action=socksify does, that the upstream must be a SOCKS5 server at an IPv4 address, that settings changes apply only after the record is disabled and re-enabled, and that the service refuses to proxy LAN (RFC 1918) destinations, logging cannot socksify LAN destination. The Tor example and the warning box now use dst-address-type=!local, because a rule without it redirects the router's own services and can cut off management access. The property tables moved to the CLI Reference.

CLI Reference​

  • /ip/dns, /ip/dns/static, /ip/dns/adlist, /ip/dns/forwarders: Described all 69 parameters, flags and commands of the DNS resolver, static entries, cache, adlists and forwarders (51 were empty), with defaults and behaviour checked on RouterOS 7.25.
  • /ip/cloud, /ip/cloud/back-to-home-user, /ip/cloud/back-to-home-file, /system/backup/cloud: Wrote descriptions for all previously empty parameters, flags and commands of DDNS, the time update, Back To Home and its users, File Share and its settings, and cloud backup, all checked on RouterOS 7.25. They include behaviour that is documented nowhere else, for example that Back To Home users can be added only while vpn-status is running, that expires cannot be changed after a user is created, that client-address is assigned automatically, and the status values and error messages of each command.
  • /ip/proxy, /ip/proxy/access, /ip/proxy/cache, /ip/proxy/direct: Described the web proxy settings, the access, cache and direct lists, connections, the cache counters, cache contents, monitor and the commands (85 of 91 rows were empty), including the redirect and url-append actions with action-data, which the old page did not mention.
  • /ip/socks, /ip/socks/access, /ip/socks/connections, /ip/socks/users, /ip/socksify: Described all parameters, flags and read-only values of the SOCKS server, its access list, active connections and users, and the socksify service, checked on RouterOS 7.25. This includes behaviour documented nowhere else, for example that version=4 accepts only SOCKS4 clients, that auth-method=password rejects everything when no users exist, that access list domain names match only name-based requests, and that vrf selects the VRF the server listens in.

Getting Started​