A complete, practical RouterOS course in 13 writeups — from your first terminal session and the backup that saves your weekend, through VLANs, firewalling, WireGuard, and OSPF, to a full hotel network with guest captive portal and centrally-managed Wi-Fi. Real commands, the gotchas that actually bite, and the same lab-first discipline as our 27-part Cisco series — many posts cross-map between the two platforms.
MikroTik gives you enterprise-grade networking at hobbyist prices — and a learning curve shaped like a cliff. This series is the rope: each post takes one capability from "what does this menu do" to "deployed on a paying client's network", in order, with the failure modes we've actually hit across dozens of properties in Crete.
Read it start to finish as a course, or jump to what you need — every post stands alone and links its prerequisites. The series pairs with our Cisco IOS Fundamentals: the concepts are identical, only the syntax changes, and several posts (OSPF, the labs) deliberately bridge both platforms. For the design decisions above the config — topology, segmentation, resilience — see the Network Architecture guides. Planning subnets for any of these builds? Use our subnet & VLAN planner — it exports ready-to-paste RouterOS and Cisco config.
Chapter 1
Get comfortable on the box, and make it impossible to lose your work — or your access.
01Terminal TipsThe RouterOS CLI from zero — navigation, print/where queries, Safe Mode, and the habits that prevent lockouts.16 min→ 02Backup & RecoveryExport vs binary backup — when to use which, automating both, and the full Netinstall recovery procedure.13 min→Chapter 2
Split the network into VLANs, publish services safely, and keep the bandwidth fair.
03VLAN SegmentationBridge VLAN filtering done right — trunks, access ports, hardware offload, and isolation you actually test.26 min→ 04Port Forwardingdst-nat from first principles — publishing services, hairpin NAT, and the checklist for every exposed port.19 min→ 05QoS for HospitalityQueues that keep guest Wi-Fi fair in high season — PCQ, priorities, and limits that don't punish everyone.18 min→Chapter 3
Make the router do the boring parts itself.
06RouterOS ScriptingVariables, conditions, the scheduler — and the handful of scripts every production router should run.13 min→ 07Wake-on-LANWake machines through the router — on demand, remotely, and on a schedule.18 min→Chapter 4
Lock the box and the network down, then connect in from anywhere — properly.
08The RouterOS FirewallConnection tracking, default-deny both chains, FastTrack vs QoS, and self-updating brute-force traps.21 min→ 09WireGuard VPNRoad-warrior and site-to-site — the allowed-address logic demystified, and keepalive for peers behind NAT.20 min→Chapter 5
Dynamic routing on the new engine, then everything assembled into one real build.
10OSPF on RouterOS 7 — and Talking to CiscoInstance, area, interface-template — proven on a mixed topology where one neighbor is a Cisco 2911.21 min→ 11Lab: The Hotel Network, Start to FinishRB5009 + CRS326 + tagged SSIDs — guest isolation with evidence, PCQ fairness, and failure drills before handover.24 min→Chapter 6
The guest-facing front door, then scale the Wi-Fi from two APs to a managed fleet.
12Hotspot & Captive Portal for HotelsA branded guest login — terms acceptance, vouchers with User Manager, RADIUS, walled garden, per-guest bandwidth, and the HTTPS reality.22 min→ 13Centralised Wi-Fi with CAPsMANRouterOS 7 WifiWave2 — one config for every AP, VLAN-tagged SSIDs, seamless roaming, and the CAP discovery gotchas.21 min→Beyond the Series
Standalone posts extending the core series — each mirrors a Cisco IOS topic so a mixed estate reads the same on both platforms.
＋First ContactYour first ten minutes with a new box — WinBox and MAC-connect, reading the default config, and a safe way back.6 min→ ＋Securing RouterOSManagement-plane lockdown — prune services, the input-chain firewall, and never exposing Winbox to the internet.6 min→ ＋DHCP Server & NATPool, server, network; masquerade vs src-nat; and the connection-tracking model behind RouterOS NAT.5 min→ ＋Bridge & Switch Port SecurityHorizon isolation, DHCP snooping with trusted ports, ARP discipline — and the hardware-offload caveat.4 min→ ＋STP & BondingRSTP root-bridge and cost, edge ports, and 802.3ad LACP bonding to use both links without a loop.5 min→ ＋VRRP First-Hop RedundancyTwo routers, one virtual gateway — priorities, preemption, and failover on a dead WAN, not just a dead router.5 min→ ＋Logging, SNMP & Traffic-FlowRemote syslog, SNMPv3, NTP, and NetFlow/IPFIX export — see what's on the wire and keep logs off-box.5 min→ ＋Upgrading RouterOS SafelyChannels, the two-part package-plus-firmware upgrade everyone forgets, backups, and a clean rollback.4 min→ ＋802.1X Port AuthenticationRouterOS 7 dot1x server against RADIUS, supplicant basics, and MAC-auth fallback for devices that can't.4 min→ ＋Packet Sniffer & Port MirrorSwitch-chip SPAN, the /tool sniffer with quick-filters, and streaming straight into Wireshark over TZSP.4 min→ ＋IPv6 FundamentalsEnabling IPv6, DHCPv6-PD from the ISP, SLAAC, and the firewall you must build — there's no NAT to save you.4 min→ ＋Managing a FleetThe RouterOS 7 REST API, the Ansible community.routeros collection, and an idempotent config-push pattern.5 min→Beyond the Series
The attacker's view of RouterOS, real-world multi-WAN, and the bridge to the Cisco world.
＋Attacking MikroTik Gear — A Pentester's Field GuideWinbox discovery and CVE-2018-14847, default creds and API exposure, btest abuse, and post-exploitation — with the fix for each.9 min→ ＋Starlink + MikroTik FailoverMulti-WAN on RouterOS 7 — recursive routing, connection marking, NAT, and netwatch health checks for a remote site.8 min→ ＋MikroTik ↔ Cisco — One IPsec Tunnel, Two VendorsA cross-vendor IKEv2 site-to-site tunnel — proposal matching, the policy-vs-route-based trap, and NAT exemption both ends.9 min→ ＋Cisco ↔ MikroTik: The Translation GuideThe same network on both platforms — a task-by-task command map between RouterOS and IOS, linking every twin post.8 min→Beyond the Series
The edge protocol, policy routing, and the RouterOS 7 features that turn the router into more than a router.
＋BGP & Dual-ISP MultihomingThe v7 BGP rewrite — /routing bgp connection and filter chains, two upstreams, local-pref and prepend path control, anti-transit filters, and automatic failover.11 min→ ＋Policy Routing with Rules & MangleRouterOS's two policy-routing tools — routing rules vs connection-aware mangle marks — and the connection-mark pattern that pins a flow to one WAN.9 min→ ＋RouterOS 7 ContainersRun OCI/Docker images on the router itself — the device-mode gate, veth networking, a Pi-hole container, persistence, and the architecture/storage constraints.10 min→ ＋Metrics with Prometheus & GrafanaTime-series metrics and dashboards — a read-only API user, the mktxp exporter (optionally containerised), a Prometheus scrape, and Grafana alerts.9 min→Beyond the Series
Multi-protocol glue and scaling access — RouterOS 7's filter-chain redistribution, a WireGuard branch fabric, and road-warrior VPN.
＋Route Redistribution & BFDv7 redistribution through the filter-chain model — per-protocol toggle + output chain, tag-and-reject loop prevention, and version-dependent BFD.5 min→ ＋Scaling Site-to-Site (Hub-and-Spoke)RouterOS has no DMVPN — build a WireGuard hub-and-spoke, OSPF over the overlay, the allowed-address trap, and the spoke-to-spoke trade-off.6 min→ ＋Remote-Access VPN (IKEv2 & SSTP)SSTP over 443 for hostile firewalls, IKEv2 with mode-config for native clients, generate-policy and server-cert gotchas, plus the firewall/NAT people miss.6 min→Beyond the Series
Full RouterOS 7 topologies built and broken — the twins of the Cisco labs.
＋Lab: Multi-Area OSPFFive routers, three areas — ABRs via interface-templates, a stub area, the LSA types proven by inspection, and the backbone/MTU traps.5 min→ ＋Lab: HQ + Branches — GRE over IPsec WANAn encrypted, OSPF-routed branch WAN — GRE carrying OSPF, IPsec via the ipsec-secret one-liner, and the protocol-47/MTU gotchas.5 min→ ＋Lab: The Broken NetworkSeven realistic faults as support tickets — bridge VLAN, scoped masquerade, OSPF MTU, DHCP binding, FastTrack, split flows, lost offload — each with the command that finds it.6 min→Beyond the Series
A single AP done right, before you reach for CAPsMAN.
＋Standalone Wi-Fi (wifiwave2)WPA3 transitional security, multiple SSIDs each tagged to its own VLAN, guest client-isolation, and the standalone-vs-CAPsMAN decision point.5 min→This series is the RouterOS half of the same standard I hold Cisco networks to — segmentation with evidence it works, guest Wi-Fi that stays fair under load, and failover I've actually tested, not just configured.
Book a Discovery Call →