The Cisco series opened with plugging into a bare IOS box; this is the same first ten minutes for RouterOS. A new MikroTik arrives with a default config that already does more than a factory Cisco — a bridge, a DHCP server, NAT, and a firewall — so the job isn't "configure from nothing," it's "get in, read what's there, and make it yours without locking yourself out."
RouterOS is the same OS on a €50 hEX and a carrier CCR — learn it once and it scales the whole range. Unlike a factory-default Cisco switch that boots empty, a MikroTik ships with a default configuration: ether1 is the WAN (DHCP client), the remaining ports are bridged into a LAN on 192.168.88.1/24 with a DHCP server, masquerade NAT, and a starter firewall. Your first task is to reach it, read it, and rename it into your environment.
The tool that makes MikroTik forgiving is Safe Mode: changes made in it are rolled back automatically if your session drops, so a bad firewall rule can't strand you. We'll use it from the first command. This is the RouterOS counterpart to Cisco IOS: First Contact — same goals, very different menus.
ether1)01
You don't need an IP to reach a MikroTik. WinBox discovers it by MAC over Layer 2, so even a misconfigured box with no reachable address is one click away — the single best reason to keep WinBox on your toolbelt.
Open WinBox, look at the Neighbors tab, and the device appears by MAC address and identity. Click the MAC address (not the IP) to connect over MAC-telnet — this works regardless of IP configuration. Default credentials are user admin with a blank password on older RouterOS; modern v7 devices force you to set a password on first login. Set a real one immediately.
# In the terminal, Ctrl-X toggles Safe Mode. Do this before you change anything: # if your session drops mid-change, RouterOS reverts it automatically. [admin@MikroTik] > # prompt shows <SAFE> when active [admin@MikroTik] <SAFE> > /system resource print board-name: hEX platform: MikroTik version: 7.15.3 (stable)
02
Before changing anything, see what the box already does. /export is your friend and your documentation — it prints the running config as the exact commands that would recreate it.
[admin@MikroTik] > /export hide-sensitive /interface bridge add name=bridge /interface bridge port add bridge=bridge interface=ether2 ... (ether3..5 too) /ip address add address=192.168.88.1/24 interface=bridge /ip dhcp-client add interface=ether1 # WAN pulls DHCP /ip dhcp-server ... (LAN pool 192.168.88.10-254) /ip firewall nat add chain=srcnat action=masquerade out-interface-list=WAN /ip firewall filter ... (default input protection) # Read one subsystem at a time with print: [admin@MikroTik] > /ip address print [admin@MikroTik] > /interface bridge port print
/export file= Is Your First Backup
/export file=day0 writes a text config to the router's storage you can pull off with WinBox drag-and-drop. It's human-readable, diff-able, and version-controllable — unlike the binary /system backup. Take one before your first change so you always have a known-good starting point. More in Backup and Recovery.
03
Three changes turn an anonymous factory box into a managed device: a name you'll recognise in Neighbors, a real admin account, and the death of the default admin.
[admin@MikroTik] <SAFE> > /system identity set name=CORE-RTR # Create YOUR account, full group, strong password... > /user add name=noctis group=full password="use-a-real-passphrase" # ...log back in as it, THEN disable/remove the stock admin. > /user set admin disabled=yes # (or /user remove admin once you've confirmed the new login works)
04
The default gets you online via DHCP on ether1. When you need static addressing — most business installs — here's the minimum: an address, a default route, and DNS.
> /ip address add address=203.0.113.10/29 interface=ether1 > /ip route add dst-address=0.0.0.0/0 gateway=203.0.113.9 > /ip dns set servers=1.1.1.1,9.9.9.9 allow-remote-requests=no # LAN gateway already exists as bridge 192.168.88.1 — change it to # your scheme, e.g. 10.10.0.1/24, and update the DHCP server network. > /ip address set [find interface=bridge] address=10.10.0.1/24
allow-remote-requests Turns the Router Into an Open Resolver
Set allow-remote-requests=yes and forget a firewall rule, and your router answers DNS for the whole internet — a favourite reflection-DDoS amplifier and an instant abuse complaint. If the LAN needs the router as a resolver, enable it and block UDP/TCP 53 on the WAN input chain. We do exactly that in Securing RouterOS.
05
Everyone locks themselves out eventually. RouterOS gives you three escape hatches, in increasing severity — know them before you need them.
| Escape hatch | When to reach for it |
|---|---|
| Safe Mode (Ctrl-X) | A change you're about to make might cut you off — auto-reverts on session loss. |
| WinBox MAC-connect | You broke IP/routing but Layer 2 is intact. Reach it by MAC, fix the address. |
| /system reset-configuration | Config is unrecoverable. keep-users=yes no-defaults=yes for a clean slate that keeps your login. |
| Netinstall (reset button + PXE) | Nuclear: reflash RouterOS entirely from a PC. Lost password, bad upgrade, suspected compromise. |
Takeaways
/export is documentation and a text backup in one. Take one on day zero and before every change.NOCTIS deploys and documents MikroTik and Cisco networks across Crete — configured to your addressing, secured from the first boot, and handed over with a config your staff can actually keep running.
Book a Discovery Call →