Skip to main content

Documentation updates - October 2, 2026

Summary of documentation changes made on October 2, 2026.

Diagnostics & Monitoring​

  • Log: Rewritten and tested on RouterOS 7.25 against syslog, TLS and SMTP servers. Both property tables moved to the CLI Reference. Corrected: entries always show the full date, disk-lines-per-file defaults to 1000, TCP and TLS work with every format, and critical entries print once at the next login, not at every login. New sections:
    • Read the log: filter by topic, message and time, follow-only, extra fields with with-extra-info, saving to a file, and finding out who changed the configuration.
    • Log debug messages for one feature into its own memory buffer, with a warning that SSH debug messages contain session keys and session content.
    • Keep the log across reboots with the disk action: file rotation, folders on other disks, and reading older files.
    • Send the log to a syslog server: the default, syslog (RFC 3164) and cef formats, UDP, TCP and TLS, the TCP buffer, why to use CEF over TCP and TLS, and TLS with a trusted CA (check-certificate does not check the certificate name).
    • Email log messages, and run a script on a log message (an example collects the source addresses of failed logins in an address list).
    • How rules match entries (all listed topics must match, !, regex, prefix), the topic list, troubleshooting, and the wire format of each remote format.
  • CEF with Elasticsearch, Syslog with Elasticsearch: Fixed links to the reworked Log page and wrapped the RouterOS commands. The CEF guide no longer adds the same rules twice. Kibana and JSON blocks are no longer marked as RouterOS code.
  • Bandwidth test: Rewritten and tested between a hAP ax², a CCR2116 and a 64-core server. Property tables moved to the CLI Reference. New sections:
    • Prerequisites: the server, device mode on both routers, a test user with the test and winbox policies, firewall ports, and why UDP receive tests fail behind NAT.
    • Test a link at a fixed rate, measure the maximum throughput, check a link for packet loss with UDP at a fixed rate, and test wireless directions one at a time.
    • Read the results: UDP counts whole IP packets and TCP only the data; lost-packets counts the last second, not a total; the CPU load fields.
    • Test a router's forwarding capacity through a chain of three routers, with packet sizes and when to use the traffic generator.
    • Secure the server with allowed-addresses4 and allowed-addresses6 instead of turning authentication off; max-sessions counts tests.
    • Troubleshooting by status, and the ports and connections in Technical details.

CLI Reference​

Storage​

  • Storage package: The section index now calls the package by its current name, Storage package (rose-storage in /system/package/print), instead of ROSE.
  • Btrfs, Btrfs RAID, Btrfs maintenance, Btrfs snapshots: Reworked. An overview of the three Btrfs menus, the default <disk>-fs file system label, and what add-device and the balance do when converting to RAID1. The RAID commands now find the file system by devs instead of present-devs. Version notes removed.
  • SSHFS: New page. Mount a folder from an SSH server as a disk with /disk/add type=sshfs, with the mount states and how to change or remove the mount.
  • SMB: The server, share and user property tables moved to the CLI Reference. The page explains that the server starts by itself when the first share is added.
  • RAID, Hot spare, Moving an array: The RAID property table moved to the CLI Reference, the examples became top-level sections, and the hot spare page explains how the spare is configured.
  • Encrypted storage, Self-encrypting drives: Rewritten intros and examples, with the property tables removed. Encrypted storage on a RAID1 array. Self-encrypting drives need an Opal-compliant drive attached directly (not through a USB bridge), with the o and O flags explained.
  • iSCSI, NFS, NVMe over TCP, Rsync: Property tables removed, with improved intros and examples: the default ports (iSCSI TCP 3260, NFS TCP 2049, NVMe over TCP 4420), the default iSCSI IQN, and the NFS state when the port is blocked.

Hardware​

  • PoE-Out: Added the no_valid_psu, lldp-power-off, low-voltage-pd-detected and power-limiting values of poe-out-status.

Documentation updates - October 1, 2026

Summary of documentation changes made on October 1, 2026.

Getting Started​

  • Supout.rif: Rewritten. Corrected: the file is text with encoded sections, not a binary file. New: what the file holds and when to create it, writing it into a folder, creating it at a set time with the scheduler, downloading it with Files or scp, the automatic autosupout.rif after a crash, and the file format. The screenshots are now in the right WinBox and WebFig sections, with alt text. Try before RMA now links here instead of the Resource page.

Storage​

  • Tmpfs: Rewritten and tested on RouterOS 7.26. Corrected: tmpfs is part of the base RouterOS package and needs no Storage package (not on SMIPS devices). New sections:

    • Create a RAM folder, and what the sizes mean: decimal units, a maximum rather than reserved RAM, about half of the RAM when tmpfs-max-size is not set, and the total size check.
    • Check what the folder shares: on routers whose default configuration turns on automatic disk sharing (for example the hAP ax²), a new folder is shared through SMB to the guest user, who needs no password, and through DLNA. How to check it, and how to create the folder unshared or stop the sharing.
    • Keep packet captures in RAM and download them, check how full the folder is (a full folder makes writes fail), resize it and delete it.
    • Technical details: after a reboot the folder is mounted again empty, and a tmpfs cannot be formatted (use a Ramdisk for a block device).
    • The "RAM-backed folder" section of Disks now links here.

  • DLNA Media Server: Rewritten with tests from a computer and a second router as players:

    • Share a USB disk with the TVs on the LAN, and limit a server to one device with allowed-ip or allowed-hostname (the DHCP host name, exact and case-sensitive; only one of the two can be set). A note says that these limits are not access control.
    • The dynamic servers that automatic disk sharing creates (the hAP ax² default configuration turns it on). They cannot be edited, so turn off the disk's media sharing before adding limited servers.
    • Which files are listed: media files with lower-case extensions only, and an .srt file next to a video becomes its subtitles. A server without path shares the router's whole file list.
    • Troubleshooting, and technical details: SSDP discovery, HTTP on TCP port 2828, thumbnails, and why a server answers only on its own interface.

Firewall & QoS​

  • Address lists: Rewritten from a single v6-era example into tasks, each imported as written and tested on RouterOS 7.26:
    • Block traffic from a list of addresses with a raw rule, for IPv4 and IPv6.
    • Allow SSH and WinBox from a dynamic address by its DNS name, with the rule placed before the default drop rule and a warning on what it opens.
    • Block hosts that probe a closed port for a day, with a trusted list the rule skips, because a single packet with a forged source address is enough to list it.
    • View, remove, export and import entries. file= must come before where, or the export prints to the terminal and writes no file.
    • How entries behave: static and dynamic entries and what a reboot keeps, timeouts (up to 35w3d13h13m56s, reset by each new match), how prefixes and ranges are stored, and how DNS names resolve.
    • Corrected: a range written in short form such as 203.0.113.1-254 is stored as a DNS name and matches nothing, and IPv6 lists take no ranges.

Diagnostics & Monitoring​

  • Speed Test: Rewritten with tests between two routers and against the router's own bandwidth server.
    • Prerequisites: the remote router's bandwidth test server, a user whose group has the test and winbox policies, device mode, and firewall rules on both routers. Without a rule on the testing router, its firewall drops the UDP download traffic.
    • New section with tested firewall rules for a test over the internet. To limit who can run tests, use the server's allowed-addresses4 and allowed-addresses6: a user's address setting does not limit bandwidth test logins.
    • A table explaining the result lines, and the CPU warning explained.
    • Troubleshooting for authentication failed, missing throughput or UDP lines, and device mode.
    • Technical details: five parts of test-duration each (10 seconds by default, at least 5), 20 pings per second, the TCP connections and the ports used.
    • Corrected the old parameter notes. The default connection-count is 20, or the CPU core count of the router that runs the test when it has more than 20 (tested on a 64-core router).
  • Bandwidth test: Now links to Speed Test.
  • Detect Internet: Rewritten with the state rules tested on lab links. An interface becomes wan when the router's active route to 8.8.8.8 goes through it, and internet when the route to cloud.mikrotik.com does too and the cloud answers on UDP port 30000. Removed the old rule that DHCP makes an interface WAN, and the warning that it installs DHCP clients and routes, which did not happen on the lab. Verified and kept: the one-hour LAN lock and the return to lan only after a link change. New: a captured example on a default-configured router, the interface lists it fills and why they do not belong in trust rules, a note that it is not a failover health check, troubleshooting and how to turn it off.
  • Watchdog: Rewritten after deliberate ping watchdog reboots of a lab router. The router pings the address six times over ping-timeout and reboots when all six fail, and the log then shows System rebooted because of ping watchdog timeout. no-ping-delay is now ping-start-after-boot. New: a real-life example, a warning about repeated reboots, how long to wait after a boot, and the support output settings.
  • DNS update: The Dynamic DNS page is now about /tool/dns-update, and points to IP Cloud DDNS and Fetch for the common cases. Tested against a test DNS server: the update goes over TCP port 53, signed with hmac-md5, and replaces the name's A records; name is relative to the zone; the default TTL is one day. New: prerequisites, how to keep a name current, and what each error message means.

System​

  • IP Packing: Rewritten. Removed the v6-style discovery commands; prerequisites now explain that neighbor discovery must run on the interface on both routers. New: how to check it with the unpack field of the neighbor list, and the latency it adds. A warning says that TCP connections the router opens over a packed link fail.

CLI Reference​

Documentation updates - September 30, 2026

Summary of documentation changes made on September 30, 2026.

Diagnostics & Monitoring​

  • Ping: Rewritten around the tasks readers have, with every output captured on RouterOS 7.26 through a three-hop test network:
    • Check the internet by address and by name; a name that does not resolve fails with resolve failed.
    • A table of the status values (timeout, net unreachable, host unreachable, admin prohibited, TTL exceeded, no route to host, the two Don't Fragment statuses and echo reply) and what each one means.
    • Find the path MTU with do-not-fragment: which router answers, why larger pings then fail at once, and the fix with MSS clamping.
    • Ping from a LAN address to test an IPsec tunnel, from a VRF, and through a policy-routing table with src-address and a routing rule.
    • Reach hosts that drop ICMP with ARP ping and ND ping, discover IPv6 hosts with ff02::1, ping a MAC address, and use ping in a script.
    • Corrected: size is the whole IP packet including the header (so size=1500 matches ping -l 1472 on Windows), a reply later than interval counts as a timeout, and WinBox 4 and WebFig resolve names with the router's DNS (only WinBox 3 uses the computer's).
  • Traceroute: Rewritten from a two-hop example into a guide to reading a trace. It explains the columns and how RouterOS traces (ICMP probes, up to 30 hops, repeated rounds with per-hop statistics). New troubleshooting cases, each with a captured output: hops that stop answering, a router that rejects the traffic (network unreachable, host unreachable and packet filtered in the status column), a routing loop, loss at one hop that is not path loss, and rising round-trip times. Also new: host names with use-dns, finding the hop with the smaller MTU with do-not-fragment, and tracing from a VRF or a chosen source address.
  • Torch: Rewritten with what the output means, tested with traffic of known size and rate on RouterOS 7.26. Each row is a flow. SRC-ADDRESS is always the far side of the watched interface, so on a LAN bridge TX is what a host downloads and RX what it uploads. New tasks with captured outputs: find the host that uses the bandwidth, watch one protocol or port, check VLAN tags and DSCP marking (a flow marked in one direction only shows as two rows), see traffic that the firewall drops, and see which CPU handles a flow. Corrected: port takes one port (the old port=80,443 example fails), and IP fast path and FastTrack are off while Torch runs.
  • IP Scan: Rewritten around tasks, with outputs captured on RouterOS 7.26: find the devices on the LAN, check that an address is free, find a device with an unknown static address by listening on an interface (then reach it with a temporary address), and scan a remote network. New: what a scan sends (ARP, ping, an SNMP query for the system name, a NetBIOS query, a reverse DNS lookup, and one BOOTP request). Corrected: setting both interface and address-range scans the range, so the old warning about inconclusive results was removed.
  • Flood Ping: Rewritten around a packet loss test. New: flood ping needs the traffic-gen device-mode feature (the command fails with not allowed by device-mode otherwise) and how to enable it, and the parameter limits read from the router (up to 1000 requests per run, size 10 to 1500). Removed an unverifiable claim about the send rate and an old output.
  • Graphing: Added WinBox steps with screenshots for the interface, resource and queue rules and the graphing settings, and replaced the legacy WinBox graph screenshot with a native one.

System​

  • Services: Rewritten around what the router listens on: the dynamic entries in /ip/service and what they mean for the firewall, available-from for several services at once (a list with only IPv4 prefixes refuses IPv6 clients), and management services in a VRF. The protocols and ports list is now three tables (TCP, UDP, IP protocols), checked against the listeners each feature opens:
    • Removed ports RouterOS 7 does not use: MME and RSVP over UDP.
    • Corrected: OpenFlow connects to its controller and does not listen, and TCP port 20 is not a listening port.
    • Added: TFTP, OpenVPN, RADIUS incoming, IPsec NAT traversal, CAPsMAN for WiFi, WireGuard and ICMPv6.
    • A note explains that the IP firewall does not stop MAC Telnet, MAC WinBox and MAC ping, and that allowed-interface-list in /tool/mac-server does.
  • Wake on LAN: Rewritten with tasks, each tested: wake a computer on the LAN, from outside the network over a VPN, at a set time, and a group of office computers on working days with a script. Explained: with interface, RouterOS sends the magic packet as an Ethernet frame on that interface; without it, as a UDP broadcast through the default route, usually the internet connection, so always give the LAN interface.
  • Note: Rewritten with where the note shows, each tested: after the banner on interactive SSH, Telnet and MAC Telnet logins, and with show-at-cli-login also before the Telnet login prompt, where anyone who connects can read it (new warning). Corrected: a sys-note.txt file sets the note only at the next startup.
  • Identity: Where the name appears (prompt, neighbor discovery, SNMP system name, DHCP host name), the 64-character limit, and a corrected SNMP example: setting the name needs a community with write access, because public can only read. New warnings on what a write community allows.
  • Clock, Device mode, E-mail, Fetch, Files, Identity, IP packing, Neighbor discovery, Note, NTP, Partitions, Scheduler, Services, TFTP, Wake on LAN: Each page now has a short WinBox section with an annotated screenshot of the native WinBox window for the same task.

Management Tools​

  • MAC server: Rewritten around connecting with MAC Telnet (or WinBox by MAC address), finding routers with MAC scan, and allowing MAC access only on trusted interfaces, tested between two routers. New and verified:
    • MAC Telnet is not encrypted: commands and output cross the link in clear text, but the password does not.
    • The IP firewall does not stop MAC access; allowed-interface-list or a bridge filter rule on one port does.
    • Put the bridge in the list, not its ports; none turns access off; open sessions stay open.
    • A user's address setting does not apply to MAC logins.
    • Corrected: MAC scan lists the devices that send neighbor discovery, whatever their MAC server settings, and turning MAC ping off does not affect ARP ping.
  • Quick Set: Illustrated with annotated WinBox screenshots: the main areas of the Home AP Dual mode, the network name and Wi-Fi password, the internet connection types and the local network settings.

CLI Reference​

  • /tool/ping: Every row now has its range and default, checked with packet captures: size as the whole IP packet (28..65535 for IPv4, 48..65535 for IPv6), ttl (255 for IPv4, hop limit 64 for IPv6), interval, dscp, the source address selection, interface, and the status values.
  • /tool/traceroute: All rows described: the probe type and size, max-hops (30), timeout (1 second), port (33434 for UDP probes), use-dns, vrf, and the status values a hop can report.
  • /tool/mac-server, /tool/mac-telnet, /tool/mac-scan: All rows and menu intros described: the allowed interface lists (default all, the default configuration sets LAN), MAC ping, the sessions list, the client's interface, and what MAC scan shows.
  • /tool/torch: All 24 rows described: the filters and how they match, one port per port, cpu=any, and the direction and units of tx and rx.
  • /tool/wol, /tool/ip-scan: Described the two Wake on LAN packet forms, and every IP scan row with where its columns come from.
  • /system/note, /system/identity, /tool/flood-ping: All rows described, including the flood ping limits and its device-mode requirement.

Hardware​

  • KNOT and the other IoT product pages: Each page now has an A4 PDF version, linked under the page title.

Documentation updates - September 29, 2026

Summary of documentation changes made on September 29, 2026.

System​

  • Clock: Rewritten and verified on RouterOS 7.26. The page now covers the time sources (NTP client, MikroTik cloud with update-time, GPS, manual), named and detected time zones, and manual daylight saving. It adds a troubleshooting list for the 1970 date, a wrongly detected zone, and a clock that is an hour off after a reboot or after setting the date. Corrected: a zone set by hand while time-zone-autodetect is on is replaced after the next startup, not at once, and an omitted date or time part of dst-start/dst-end is reset rather than kept. Also corrected: set the date and the time in separate commands, and the latest accepted date is 2038-01-19 03:14:07 UTC, with later dates ignored.

  • Fetch: Rewritten with every example tested between two routers and against a server that logged each request:

    • FTP and SFTP download and upload, the URL form, and TFTP from /ip/tftp.
    • Certificate checking with check-certificate=yes (off by default), including host names, the builtin trust store and the clock.
    • New tasks: upload a backup over SFTP, download and import a script safely, and send a JSON webhook notification.
    • Corrected: redirect counting (two redirects by default), the size limits of output=user (64512 bytes) and user-with-headers (20480 bytes), and the old 4 KB file limit (files up to 60000 bytes work).
    • The script examples now handle a trailing newline and failed requests.

  • TFTP: Rewritten around tasks, with every example run against a TFTP client: serve a folder, one file for every request, two names for one file, accept uploads, and refuse requests. New: a troubleshooting list with the client error codes and the tftp log topic, how rules match (regular expressions, anchors, \$ in the console), and technical details on block sizes, pipelining and files beyond 65535 blocks. Corrected: read-only defaults to yes, ip-addresses is optional, the server starts with the first rule, and the old (aaa.bin)|(bbb.bin) example matched far more names than intended. A warning explains how to write rules that match only the names you serve.

  • Services: The API example now uses available-from instead of the deprecated address, with output captured on RouterOS 7.26.

Firewall & QoS​

  • DDoS protection: Tested with a second router as attacker and server. The detection works in the forward chain of a default configuration. For port-forwarded services, however, the raw drop rule never matched, because it sees the router's public address before destination NAT. The page now adds a forward-chain rule that drops the detected pairs after NAT, and shows its counter in the check commands.

Diagnostics & Monitoring​

  • Packet Sniffer: Rewritten around capturing to a file for Wireshark, watching packets live, reading a capture in the console and streaming to Wireshark over TZSP, with outputs captured on RouterOS 7.26. Tested and now explained: filters given to start or quick replace the saved filters for that run, different filters always combine, memory-scroll keeps the latest or the first packets, the sniffer turns off fast path and FastTrack while it runs, NAT and VLAN tags as the sniffer sees them, and filter-stream=yes also hides ICMP with the streaming server. Corrected: filter-stream defaults to no, and the old page's file size warning named the wrong parameter.
  • Graphing: Rewritten with tasks for interface and resource graphs, per-customer queue graphs and PPPoE users, tested with a PC, a second router and a PPPoE session. New: the graphs need no login, who can see which graph, how allow-target exposes queues with a subnet or interface target (including every dynamic PPP queue), how to keep WebFig hidden from customers, what In and Out mean for interfaces and queues, and what store-on-disk keeps across a reboot. Removed: the WebFig menu item for graphs, which no longer exists.

Developer Guides​

  • REST API: The router-to-router /tool/fetch example now names the error shown when the calling router has not imported the CA certificate (no trusted CA certificate found).

CLI Reference​

  • /system/clock, /system/clock/manual: All descriptions corrected: automatic detection at startup and when re-enabled, the date limits, that get gmt-offset returns seconds, and how omitted parts of dst-start and dst-end are reset.
  • /tool/fetch: All 35 rows checked against the requests fetch sends:
    • The header-field syntax, and the default content type of POST data.
    • Basic authentication, and FTP's anonymous login.
    • Compression, the default port of each mode, and the default file name.
    • check-certificate values and errors.
    • Result limits, and KiB rounding of downloaded and total.
  • /ip/tftp, /ip/tftp/settings: All rows described from lab tests, including how req-filename matches, what real-filename serves, the read-only default, rollover beyond 65535 blocks and the accepted block sizes.
  • /tool/sniffer: All nine menus described (settings, start, stop, save, quick and the packet, protocol, host and connection views). The IP and MAC protocol lists are complete again, with EtherType numbers read back from the router.
  • /tool/graphing: The settings and the interface, queue and resource rules are fully described, with defaults, access rules and the In/Out direction of each graph.

Documentation updates - September 28, 2026

Summary of documentation changes made on September 28, 2026.

Developer Guides​

  • REST API: Rewritten and verified on RouterOS 7.25, with every example run and every output captured again. New sections cover setting up HTTPS with a certificate authority of your own, a least-privilege REST user, restricting access, reading and changing records, running commands, and building a dashboard or integration, including one written by an AI assistant. The page now documents that a REST user needs both the rest-api and the api policy, and that bodies need Content-Type: application/json. It also documents that PATCH works only on records (settings menus use POST .../set), the 60-second limit and how to stay within it, and that one user's requests run one at a time. Other additions: the 10-minute login cache, that the router sends no CORS headers, and a troubleshooting table of status codes and error details. Corrected the old error example (400, not 406), how quoted numbers are parsed, and the reply shape of settings menus. The LTE-only examples were replaced with examples that work on any router: blocking an address for a day, saving the configuration to a server, and a Python traffic reader.

Firewall & QoS​

  • UPnP: Rewritten and verified against RouterOS 7.25. Corrected the allow-disable-external-interface default (it is no), renamed forced-external-ip to forced-ip, removed the outdated step of enabling new interface entries (they are created enabled), and documented that several external interfaces can serve mappings in parallel, each advertised as its own WAN connection device. Added technical details: the service ports (SSDP on UDP 1900, control on TCP 2828 of internal interface addresses), that only permanent mappings are accepted, and that any settings change removes all dynamic port mappings.
  • NAT-PMP: Rewritten following RFC 6886. Corrected the port description (the service listens on UDP 5351, clients listen for the external address announcements on UDP 5350), documented that only one external interface is accepted, and replaced the example output with text (the old port mapping comment could not have come from a NAT-PMP request, which carries no description field).
  • SSH brute-force protection: Rewritten with a rule set that works in the default firewall; the old rules were placed after the default drop rule and had no drop rule of their own. Added trusted addresses, unblocking and how many password guesses the rules still allow.
  • Port knocking: The knock rules now go before the default drop rule, and the broken passphrase (layer 7) example was rebuilt with a working client.
  • DDoS protection: Explained how the detection works and where it stops helping. Removed the SYN-ACK rule, which never matched, and the list-creation lines, which left a 0.0.0.0 entry.

Getting Started​

  • Securing your router: Corrected commands and claims: the sample password contained a non-Latin letter, $ must be escaped in passwords, the WAN firewall example now works with the default configuration, available-from replaces the deprecated address, and the strong-crypto description was wrong.

High Availability Solutions​

  • MLAG: Described the values of mlag-state.

System​

  • Services: The /ip/service and web server property tables moved to the CLI Reference. The page keeps what applies across parameters, including that available-from leaves the port visible, so the firewall is still needed against untrusted networks.

CLI Reference​

  • /ip/service, /ip/service/webserver: Filled in all parameter descriptions:
    • The TLS versions that tls-version accepts.
    • That www-ssl without a certificate offers only anonymous ciphers.
    • How available-from refuses clients.
    • The invalid flag for a port already in use.
    • That each web server part (rest-plain, webfig-secure and the others) answers 403 Forbidden when turned off, and when index-* takes effect.
  • /user/group: The policy description now says that set keeps the policies it does not list, so revoke a policy with !.
  • /ip/upnp, /ip/upnp/interfaces, /ip/nat-pmp, /ip/nat-pmp/interfaces: Filled in all parameter descriptions, including defaults, the effect of forced-ip, and the ForceTermination behavior of allow-disable-external-interface.
  • CLI Reference: Removed parameters that RouterOS no longer has from about 40 command pages, for example in /disk, /system/health and /lcd, and marked deprecated parameters.

Documentation updates - September 25, 2026

Summary of documentation changes made on September 25, 2026.

Authentication & AAA​

  • User: Reworked the page end to end: step-by-step examples now come first (creating a group and a user, password change and expiry, SSH key import, RADIUS login with User Manager), and the property tables moved to the CLI reference. Corrected several outdated facts after lab verification: the key-owner SSH key parameter became info, sessions are closed with /user/active/remove (request-logout is removed), your own password is changed with /password, and user name character rules are documented accurately. Added verified details on password rules (any characters, blank passwords), inactivity logout/lockscreen behaviour, SSH key file formats, the Mikrotik-Group RADIUS attribute, exclude-groups protection, and RADIUS accounting (Start/Stop and interim updates).

Bridging & Switching​

  • L3 Hardware Offloading: Documented that devices with Marvell 98DX7xxx switch chips also offload routing between VLAN interfaces created directly on Ethernet switch ports, without a bridge; on all other L3HW devices the VLAN interface still has to be on a hardware-offloaded bridge. Updated the inter-VLAN routing notes, the feature table and the per-port setting name (l3-hw-offloading) to match.

CLI Reference​

  • /system/ntp: Filled in all descriptions for the NTP menus — client, client servers, server, symmetric keys, monitor-peers fields and reset-freq-drift — with verified defaults and behavior, such as the poll interval ranges (powers of 2, 64 s to 1024 s by default) and the using-local-clock fallback state.
  • /file: Added menu introductions for /file and its copy, head, read and tail commands, linking back to the guide. Verified details added: the contents property is limited to just under 60 KiB (use /file/read for larger files), read requires chunk-size, head/tail default to 10 lines, copy copies directories recursively, and the S flag and url property describe Back To Home File Share entries.
  • /user: Filled in the descriptions for all /user menus and commands — users, groups and all 17 policies, settings, active sessions, AAA, expire-password, and SSH public/private keys — including verified defaults, ranges and enum values.
  • /system/scheduler: Filled in all descriptions: start-date/start-time defaults, the startup behaviour with and without interval, the days values (unset, always, never, weekdays) and how they combine with interval, run alignment to the start time, the default policy, and when next-run is empty.
  • /disk: Filled in the descriptions for the /disk menu and its commands (copy, format, check, repair, monitor-traffic, test, nvme-discover, settings, smart-info, blink), including every flag (block device, mounted, swap, RAID member, SMB/NFS/iSCSI/NVMe-over-TCP sharing, TCG-Opal self-encryption), the copy offsets and progress status, and the check output.
  • /routing/igmp-proxy/interface, /routing/pimsm/interface: Filled in the IGMP proxy and PIM-SM descriptions: global and per-interface robustness and query timers (per-interface values override the global ones), the querier and traffic counter status fields, the IGMP interface template, DR priority and hello timers, and the join-tracking, designated-router and RP-local flags. Removed an outdated print status example from the IGMP proxy interface page.

Developer Guides​

  • Scripting: Corrected the script permissions section: a scheduler entry that calls a script by name runs it with the entry's policy, like a plain /system script run; only use-script-permissions uses the script's own policy. The example log was refreshed on a current RouterOS version.

Getting Started​

  • Securing your router: Added a "User accounts and groups" step: one account per administrator, custom least-privilege groups (the built-in read group can reboot the router and see sensitive configuration), and SSH key login, which disables SSH password authentication for that user.

Hardware​

  • Disks: Reorganized the page into task sections: how disks are detected (slot names and the B/E/M flags), formatting with all file system choices including discard and wipe, mount points and mount-point-template, partitions, swap space (up to 10 times the RAM, for containers), RAM-backed folders, image mounting, log and web proxy cache on a disk, check and repair, performance tests, monitor-traffic, eject, scan and trim (not supported on USB drives), and S.M.A.R.T. The property, flag and settings tables moved to the CLI reference, and most examples now show output from a current RouterOS version.
  • S.M.A.R.T. info: Rewrote the page around reading /disk/smart-info: which values matter for drive health, that the output is the same as smartctl reports on Linux, and that some USB enclosures cannot pass S.M.A.R.T. data through.

High Availability Solutions​

Network Management​

  • Web Proxy: Added an example showing that setting cache-path to a path that does not exist creates the directories automatically, and that the cache then appears as a web-proxy store in /file.

System​

  • NTP: Rewrote the page around verified RouterOS v7 behavior: client and server examples with real output, the stopped/waiting/synchronized/using-local-clock status meanings, DHCP-supplied dynamic servers, FQDN resolution to resolved-address, symmetric key authentication (crypto NAK on key mismatch), and monitor-peers output explained. Replaced the RouterOS v6 SNTP log section with the current ntp topic messages.
  • Files: Reworked the page after lab verification. Corrected the /file/read description (it returns a string in data, not an array), documented the real contents size limit, the 10-line default of head/tail, and that directory copies are recursive. All examples refreshed with output from a current RouterOS version, and the page now links to the File Share and Rsync guides for the related /file properties and menus.
  • Scheduler: Rewrote the page around verified RouterOS v7 behavior. Corrected several statements: days is unset by default (not always, which restarts at start-time every day), entries due at the same time run in no fixed order, startup entries run before interfaces and DHCP are up, and days does not support intervals of a day or longer. Added an explanation of how runs are calculated and how permissions apply, and replaced the log-writing demos with practical examples: nightly backup and export, LEDs off at night, an email after each reboot, guest Wi-Fi during business hours, a weekly backup by email, notifications about new RouterOS versions, a weekly random guest Wi-Fi password, and guest bandwidth limits by time of day.

User Guides​

  • IGMP Proxy: Updated the /routing/igmp-proxy/interface/print output to the current RouterOS format, with the upstream, robustness and query timer columns.

Documentation updates - September 24, 2026

Summary of documentation changes made on September 24, 2026.

Network Management​

  • Cloud: Rewrote the overview around what the cloud services do, with a table of the services, their menus and which ones run by default, and one explanation of how the router reaches cloud2.mikrotik.com (UDP port 15252) and the relay servers. The danger box and six warning boxes are gone; one note on availability remains (MikroTik devices and CHR with a paid license, not x86). The DDNS and time update behaviour was checked on RouterOS 7.25 with packet captures and reboots: the DNS name is the serial number in lower case with a 60-second TTL, a router behind NAT sends an update every minute, ddns-enabled=auto deletes the name, and use-local-address points it to the local address. The time update sets the clock once at startup, not on force-update, and not while the NTP client is enabled. Removed the wrong update-time=auto note and the claim that the DNS name is stored permanently. The property tables moved to the CLI Reference.
  • Cloud backup: New page, moved out of the Cloud overview and rewritten with tested examples for uploading, replacing, deleting, downloading on another router with the secret download key, and download-and-apply. It covers the one-slot limit and its error message, the password requirement, and the refusal of unencrypted backup files.
  • Back To Home: The app instructions are now numbered steps. New sections list what Back To Home adds to the router (the back-to-home-vpn WireGuard interface, the 192.168.216.0/24 and fc00:0:0:216::/64 addresses, dynamic firewall and NAT rules, and the vpn.mynetname.net name), how to manage users in /ip/cloud/back-to-home-user with a tested client configuration, and what revoking removes: all users, with new keys on the next enable. This replaces the old advice to delete WireGuard peers by hand and the unneeded ddns-enabled=yes step.
  • File Share: Rewrote the page from tests through the relay, covering directory and file shares, ?dl downloads (download.zip for directories), uploads (refused with 403 unless allow-uploads=yes), expiry, disabling, how the Let's Encrypt certificate and the relay work, and how to stop the service and delete the certificate with remove-certificate. Fixed the WinBox menu names and removed the menu that does not exist from the page metadata.
  • Communication with MikroTik Cloud Services: Corrected the table of connections to MikroTik servers: cloud backup also connects for print, File Share stops when the last share is removed, and Back To Home and File Share also use the relay servers.
  • Cloud, Cloud backup, Back To Home, File Share, Communication with MikroTik Cloud Services: Each page now keeps its main text task-oriented and ends with a Technical details section. It covers the servers and ports used, how DDNS updates and the time update at startup work, what Back To Home adds to the router, how the File Share certificate and the relay work, and what happens when the router cannot reach the cloud server.
  • DNS: Rewrote the page around tasks, all tested on RouterOS 7.25: using the router as the network's DNS server (with the default configuration and the firewall), static entries (record types, regular expressions and their command-line escaping, FWD entries to other servers, filling firewall address lists), DNS over HTTPS, adlists, forwarders and the mDNS repeater. A Technical details section explains how a query is answered, how upstream servers are chosen, and how the cache, DoH, adlists, forwarders, VRF and the mDNS repeater work. Corrected the default of static entries (enabled) and the rule on overlapping entries, and documented that DoH has no fallback, that adlists block only A and AAAA queries and need a large enough cache before the import, that forwarders do not skip a dead server, and that the mDNS repeater handles only IPv4. The property tables moved to the CLI Reference, and the 17 admonitions became plain text.
  • DNS: Reorganised the rewritten page for new and advanced readers: the intro says that DNS works with the default configuration and that the router's features apply only to devices that use it as their DNS server, a new Check and troubleshoot section covers :resolve, the answer statuses and the dns log topic, and the tasks follow the order readers need them. Added that adlists verify the server certificate by default (ssl-verify), that new queries are dropped when max-concurrent-queries is reached, and corrected the wording on settings changes (they take effect at once) and on the firewall rule the mDNS repeater needs.
  • Proxy: The section index is now a short overview of the two web proxies, the web proxy for clients on your network and the reverse proxy for servers behind the router, with a link to SOCKS. The old web proxy content moved to its own page.
  • Web Proxy: Rewrote the page from tests on RouterOS 7.25, with a regular and a transparent proxy, a second router as parent proxy and a test web server. It now explains HTTPS: the proxy relays CONNECT tunnels for regular clients, filters them by host name, address and port only, cannot cache them, and cannot take HTTPS in transparent mode. New sections cover keeping the proxy from becoming an open proxy (it listens on all IPv4 and IPv6 addresses and opens tunnels to any port), checking and troubleshooting with monitor, connections and the web-proxy log topic, how host and path rules match (whole-string and case-insensitive host names, the query string in path, : regular expressions), the redirect action, the editable error page from reset-html, which responses the cache stores and when it answers without asking the server, X-Cache and the DSCP mark on cache hits, the parent proxy and the direct list, the headers the proxy adds, and a short table of HTTP methods. Removed the wrong claims that dst-host matches words in the URL, the obsolete redirect-to parameter, the Direct list's contradicting defaults and the copied RFC 2616 text. The property tables moved to the CLI Reference.
  • Cloud section images: Converted the screenshots to WebP, deleted nine unused duplicates, and added alt text to every image.
  • SOCKS and Socksify: Rewrote both pages from tests on RouterOS 7.25, with the proxied connection captured on the wire between two routers. The SOCKS page now leads with enabling the server and explains that the default version=4 refuses SOCKS5 clients, how the access list decides (first match wins, no match is allowed, so a restrictive list ends with a deny rule), that users are created enabled (the old default was wrong) and how to monitor connections with a current print example. The Socksify page explains what NAT action=socksify does, that the upstream must be a SOCKS5 server at an IPv4 address, that settings changes apply only after the record is disabled and re-enabled, and that the service refuses to proxy LAN (RFC 1918) destinations, logging cannot socksify LAN destination. The Tor example and the warning box now use dst-address-type=!local, because a rule without it redirects the router's own services and can cut off management access. The property tables moved to the CLI Reference.

CLI Reference​

  • /ip/dns, /ip/dns/static, /ip/dns/adlist, /ip/dns/forwarders: Described all 69 parameters, flags and commands of the DNS resolver, static entries, cache, adlists and forwarders (51 were empty), with defaults and behaviour checked on RouterOS 7.25.
  • /ip/cloud, /ip/cloud/back-to-home-user, /ip/cloud/back-to-home-file, /system/backup/cloud: Wrote descriptions for all previously empty parameters, flags and commands of DDNS, the time update, Back To Home and its users, File Share and its settings, and cloud backup, all checked on RouterOS 7.25. They include behaviour that is documented nowhere else, for example that Back To Home users can be added only while vpn-status is running, that expires cannot be changed after a user is created, that client-address is assigned automatically, and the status values and error messages of each command.
  • /ip/proxy, /ip/proxy/access, /ip/proxy/cache, /ip/proxy/direct: Described the web proxy settings, the access, cache and direct lists, connections, the cache counters, cache contents, monitor and the commands (85 of 91 rows were empty), including the redirect and url-append actions with action-data, which the old page did not mention.
  • /ip/socks, /ip/socks/access, /ip/socks/connections, /ip/socks/users, /ip/socksify: Described all parameters, flags and read-only values of the SOCKS server, its access list, active connections and users, and the socksify service, checked on RouterOS 7.25. This includes behaviour documented nowhere else, for example that version=4 accepts only SOCKS4 clients, that auth-method=password rejects everything when no users exist, that access list domain names match only name-based requests, and that vrf selects the VRF the server listens in.

Getting Started​

Documentation updates - September 23, 2026

Summary of documentation changes made on September 23, 2026.

Network Management​

  • DHCP: Split the single DHCP page into a section with separate pages for the DHCP Client, DHCP Server, DHCP Relay, DHCPv6 Client and DHCPv6 Server. The section page now explains how DHCP works: the DISCOVER/OFFER/REQUEST/ACK exchange and the broadcast flag, lease renewal (renewing at 50% and rebinding at 87.5% of the lease time), address conflict checks, client identification, common options and why option 121 makes clients ignore option 3, relays and giaddr, and how DHCPv6 differs. The behaviour on all DHCP pages was checked on RouterOS 7.25, and every page now opens with a configuration example, while the property tables moved to the CLI Reference.
  • DHCP Client: New intro describing what the client applies from a lease, and a "Routes from the lease" section covering the add-default-route modes, route distance and ECMP with another default route, and routes in VRF tables. Corrected the defaults of disabled (no) and default-route-distance (1), documented dhcp-options, and removed the RouterOS v6 properties client-id and host-name. Fixed two script examples that did not work: the off-subnet gateway script is now set as the client's own script (as a separate system script it could not see the lease variables), and the WAN1 lease script now creates its routing table.
  • DHCP Server: Rewrote the lease allocation description (addresses are checked with ARP and ICMP, an address in use is kept as a conflict lease, static addresses are not checked) and explained authoritative precisely: no ignores only broadcast requests for unknown addresses, while unicast renewals are always answered. Removed the incorrect note that DNS entries need an existing DNS zone, updated the setup walkthrough to the current prompts (including the new send dns question), turned the manual configuration into numbered steps, and fixed the force example, which named no option.
  • DHCP Relay: Rewritten from tests with two routers. Added a section on relay agent information (option 82) and how the DHCP server uses it for leases and static lease matching, noted that new IPv4 relays are created disabled, explained why the VRF example needs its dst-nat rules and cross-VRF routes, and corrected the DHCPv6 relay description: it sends Relay-Forward messages (not a Hop-by-Hop option), the default firewall must allow UDP port 547 on the client-side interface, and a new section covers store-relayed-bindings.
  • DHCPv6 Client, DHCPv6 Server: New intros covering request types, dynamic pools, DUID and IAID, and server-initiated renewal (the server sends Reconfigure messages by itself when its settings change). Documented that DNS entries are created as AAAA records for address bindings only, fixed invalid IPv6 prefixes in the examples, and updated all example outputs to the RouterOS 7 format.
  • Reverse Proxy: Rewrote the page with a configuration example (importing a certificate, adding a rule and allowing HTTPS in the firewall) and new sections on how rules are selected by the TLS server name (SNI, exact match only), which certificate the router presents, what the web server receives (plain HTTP/1.1 with X-Forwarded-For, X-Forwarded-Proto, Forwarded and related headers), the service port, the dynamic rules for container apps, and troubleshooting with the rproxy log. A new warning explains that www-ssl takes port 443 after a reboot when both services use it. Corrected the menu path (/ip/reverse-proxy) and the defaults: new rules are enabled, and sni, ip-address and port are mandatory. The property table moved to the CLI Reference.

CLI Reference​

  • /ip/dhcp-client, /ip/dhcp-server, /ip/dhcp-relay, /ipv6/dhcp-client, /ipv6/dhcp-server, /ipv6/dhcp-relay: Wrote descriptions, including defaults, for about 180 previously empty parameters, flags and commands of the DHCP and DHCPv6 clients, servers, leases, bindings, networks, options, matchers, alerts and relays, all checked on RouterOS 7.25. This covers parameters that were not documented anywhere before, such as ipv6-only-preferred (option 108), accept-prefix-without-address, rapid-commit, the relay monitor counters and the DHCPv6 relay routes menu, and corrects wrong details such as the default life-time of static DHCPv6 bindings (1w) and the meaning of server-address.
  • /ip/reverse-proxy: Described the rule flags and the sni, ip-address, port and certificate parameters, checked on RouterOS 7.25, including the fallback to the /ip/service certificate and the log messages for unmatched names and missing certificates.

System​

  • Services: The reverse-proxy service links to the Reverse Proxy page, and the certificate property notes that reverse proxy rules without their own certificate use the service certificate.

Storage​

  • Encrypted Storage: Removed the crypt-mode=encryption-and-integrity setting from the RAID1 example.

Documentation updates - September 22, 2026

Summary of documentation changes made on September 22, 2026.

Containers​

  • Apps: Added a YAML field reference for writing your own apps. It covers app-level and service fields, health checks, runtime placeholders, volumes, secrets, configs and networks, each with an example. Also fixed typos and example formatting.
  • Apps: Added a section on custom app stores: host a YAML list of app definitions on a server the router can reach, with a two-app example.

Bridging & Switching​

  • Bridging and Switching: Combined the edge port and BPDU Guard examples into one. The new example shows the log entry and the inactive port flag when a port receives a BPDU, and how to re-enable the port. Removed the section on dropping BPDUs with switch ACL rules.