This article describes set of commands used for configuration management.
Any action done in GUI or any command executed from the CLI are recorded in
/system history. You can undo or redo any action by running undo or redo commands from the CLI or by clicking on Undo, Redo buttons from the GUI.
- I have complied “Winbox” by MikroTik with Wine in order to make it usable on Mac. Download one of the versions below (I recommend the newest). You can run the app from anywhere but I recommend moving it to your Applications folder. Let me know if you have any issues.
- Download Winbox for Mac - Wine based compilation for the Winbox application that offers you the possibility to configure your MikroTik router without using a web browser.
Simple example to demonstrate addition of firewall rule and how to undo and redo the action:
Winbox Download For Pc
We have added firewall rule and in
/system history what is being done.
All WinBox interface functions are as close as possible to Console functions. Some of advanced and system critical configurations are not possible from WinBox, like MAC address change on an interface. Note: WinBox is obviously freeware, but no details about the license are available either on the application website or in the application itself. WinBox application is a configuration tool for RouterOS. You have your StandAlone Mikrotik WinBox Application to run Natively on your Mac! It's a secret, you can use the same proccess to create your own Windows Apps to run on a Mac! It is a pre-compiled standalone 'Winbox' app. Winbox is a small utility that allows the administration of MikroTik RouterOS using a fast and simple GUI. It is a native Win32 binary but can be run on Linux and macOS (OSX) using Wine. Step-by-step guide.
Lets undo everything:
As you can see firewall rule disappeared.
Now redo the last change:
System history is capable of showing exact CLI commands that will be executed during Undo or Redo actions even if we perform the action from GUI, for example detailed history output after adding TCP accept rule from WinBox:
Sometimes it happens that router's configuration is changed in a way that will make the router inaccessible (except from local console). Usually this is done by accident, but there is no way to undo last change when connection to router is already cut. Safe mode can be used to minimize such risk.
Safe mode is entered by pressing Ctrl-X. To save changes and quit safe mode, press Ctrl-X again. To exit without saving the made changes, hit Ctrl-D
Message Safe Mode taken is displayed and prompt changes to reflect that session is now in safe mode. In WinBox safe mode is enabled by toggling Safe Mode toggle button on the left side of the toolbar.
All configuration changes that are made (also from other login sessions), while router is in safe mode, are automatically undone if safe mode session terminates abnormally. You can see all such changes that will be automatically undone tagged with an F flag in system history:
Now, if telnet connection, WinBox terminal (if safe mode was enabled on WinBox terminal window) or WinBox connection is cut, then after a while (TCP timeout is 9 minutes) all changes that were made while in safe mode will be undone. Exiting session by Ctrl-D also undoes all safe mode changes, while /quit does not.
If another user tries to enter safe mode, he's given following message:
- [u] - undoes all safe mode changes, and puts the current session in safe mode.
- [r] - keeps all current safe mode changes, and puts current session in a safe mode. Previous owner of safe mode is notified about this:
- [d] - leaves everything as-is.
If too many changes are made while in safe mode, and there's no room in history to hold them all (currently history keeps up to 100 most recent actions), then session is automatically put out of the safe mode, no changes are automatically undone. Thus, it is best to change configuration in small steps, while in safe mode. Pressing Ctrl-X twice is an easy way to empty safe mode action list.
System backup is the way to completely clone routers configuration in binary format. Backup file contains not just configuration, but also statistics data, logs etc. The backup file is best used to save and restore configuration on the same device, for moving configuration to other devices, use export files instead.
Backup files contain sensitive information (passwords, keys, certificates). File can be encrypted, but even then backups should be stored only in secure location.
Restoring backup file should be done only on the same router or on the similar router, when previous router fails. Backup must not be used to clone configuration on multiple network routers.
Example to save and load backup file:
RouterOS allows to export and import parts of configuration in plain text format. This method can be used to copy bits of configuration between different devices, for example clone whole firewall from one router to another.
export command can be executed from each individual menu (resulting in configuration export only from this specific menu and all its sub-menus) or from root menu for complete config export.
Following command parameters are accepted:
|compact||Output only modified configuration, default behavior|
|file||Export configuration to specified file. When file is not specified export output will be printed to the terminal|
|hide-sensitive||Hide sensitive information, like password, keys etc.|
|verbose||With this parameter export command will output whole configuration parameters and items including defaults.|
For example export configuration from
/ip address menu and save it to file:
By default export command writes only user edited configuration, RouterOS defaults are omitted.
For example, Ipsec default policy will not be exported, and if we change one property then only our change will be exported:
Notice the * flag, it indicates that entry is system default and cannot be removed manually.
Here is the list of all menus containing default system entries
|/interface wireless security-profiles||default|
|/ppp profile||'default', 'default-encryption'|
|/ip hotspot profile||default|
|/ip hotspot user profile||default|
|/ip ipsec policy||default|
|/ip ipsec policy group||default|
|/ip ipsec proposal||default|
|/ip ipsec mode-conf||read-only|
|/ip smb shares||pub|
|/ip smb users||guest|
|/routing bfd interface||all|
|/routing bgp instance||default|
|/routing ospf instance||default|
|/routing ospf area||backbone|
|/routing ospf-v3 instance||defailt|
|/routing ospf-v3 area||backbone|
|/tool mac-server mac-winbox||all|
|/system logging||'info', 'error', 'warning', 'critical'|
|/system logging action||'memory', 'disk', 'echo', 'remote'|
|/queue type||'default', 'ethernet-default', 'wireless-default', 'synchronous-default', 'hotspot-default', 'only-hardware-queue', 'multi-queue-ethernet-default', 'default-small'|
Root menu command import allows to run configuration script from specified file. Script file (with extension '.rsc') can contain any console command including complex scripts.
For example load saved configuration file
Import command allows to specify following parameters:
|from-line||Start executing script from specified line number|
|file-name||Name of the script (.rsc) file to be executed.|
|verbose||Reads each line from the file and executes individually, allowing to debug syntax or other errors more easily.|
It is also possible to automatically execute scripts after upload to the router with FTP. Script file must be named with extension *.auto.rsc. Once the commands in the file are executed rsc file is replaced by *.auto.log file which contains import success or failure information
RouterOS allows to reset configuration with
This command clears all configuration of the router and sets it to the factory defaults including the login name and password ('admin' with empty password). For more details on default configurations see the list.
After configuration reset command is executed router will reboot and load default configuration.
Backup file of existing configuration is stored before reset. That way you can easily restore any previous configuration if reset is done by mistake.
If the router has been installed using Netinstall and had a script specified as the initial configuration, the reset command executes this script after purging the configuration. To stop it doing so, you will have to reinstall the router.
It is possible to override default reset behavior with parameters below:
|keep-users||Do not remove existing users from configuration|
|no-defaults||Do not load default configuration, just clear configuration|
|skip-backup||Skip automatic backup file generation before reset|
|run-after-reset||Run specified .rsc file after reset. That way you can load your custom configuration.|
For example hard reset configuration without loading default config and skipping backup file:
And the same using Winbox:
The information on this page may be out of date. To give the routerboard an IP address, hard reset the device using the instructions here: http://wiki.mikrotik.com/wiki/Password_reset.
Standard procedures to do a Winbox MAC connection is so easy as soon as you know how to set a static IP in your windows/linux machine. If you don't have that knowledge, you won't be able to connect and what's more, you sure don't need a RouterOS machine at all.
This small guide works for any hardware running RouterOS. It doesn't explain how to run Winbox on any OS different from Windows. You should know in advance how to use Wine or any other Win32 Loader for your non-Microsoft OS.
If you are using a Routerboard board, you must use the Ethernet port that is POE-capable; MAC Winbox won't work on the others (or at least, didn't work to me). In general, you must use Ether1 port. If you don't know which port is, try on all ports.
- Know how to set a static IP in your windows/linux/MacOS machine.
- Winbox. if you don't have it get it at: http://www.mikrotik.com/download/winbox.exe
- A straight ethernet cable
- Everything needed to power on RouterOS Machine.
0. Power On RouterOS machine. Let it load, first boot takes a bit more.
1. If you are using a laptop or a computer with a wireless connection, turn it off: disconnect from Acces Point, turn off laptop switch, or disable interface.
2. Select a ethernet interface in your computer (if you have more than one) and connect it using a ethernet cable to the routerOS machine. Disable or disconnect the interfaces you are not using.
3. Set a IP/subnet mask to the selected interface. The selected IP address doesn't matter at this moment, but should be in the same range that RouterOS Machine will be, in order to save some time after initial configuration.
5. Open winbox.
6. Make sure there's no IP/MAC written in the address field, I had problems discovering MACs when there are addresses in there. [winbox1.jpg]
7. Click the [...] button and wait for your RouterOS MAC appear. Click on it.[winbox2.jpg]8. Enter username and password in their respective fields. By default, username is: admin and there is no password, leave it blank.
9. Uncheck 'Secure Mode'. It can cause some troubles using MAC-Winbox.
10. Click [Connect] and wait for login process to finish.
11. Do a basic configuration to your RouterOS machine. Set the desired IPs and click [Exit] on Winbox window. Make sure to remember the assigned IP address.
12. Configure your computer IP address to the same range that RouterOS, if you didn't set in the same range before.
13. Enter RouterOS machine IP address in Winbox Address field
14. If you have security package enabled (by default, it is), check 'Secure Mode' box to crypt the transmission. It's not needed if you are sure nobody else can get connection to your RouterOS Machine
15. Continue configuration process.
That's all folks!