OPERATOR REFERENCE · MIKROTIK / ROUTEROS

MikroTik RouterOS Field Reference
RB4011 · RB5009 · L009UiGS-RM

access → identity → interfaces/bridge → addressing → routing → firewall → VPN → backup → troubleshoot

Accuracy note: port counts, CPU/RAM, and power specs below are pulled from MikroTik's current published product pages for each model. RouterOS commands target RouterOS v7.x syntax. Firmware defaults and menu wording can shift between releases — items marked VERIFY are worth double-checking against /system routerboard print or the MikroTik wiki for your exact RouterOS version before relying on them in production.

ACCESS · WinBox / SSH

configure

ROUTEROS · CLI / config

save / export

BACKUP · .backup / .rsc

01 Device Comparison

Model	CPU	RAM / Storage	Ports	Power	Best For
RB4011iGS+RM	AL21400 quad-core Cortex-A15, 533–1900 MHz	1 GB / 512 MB NAND	10× Gigabit Ethernet + 1× SFP+ (10G)	PoE-in (passive 18–57V), PoE-out on port 10, DC jack 12–57V, ~33W max	Branch/office edge router needing a 10G uplink, fanless 1U rackmount
RB5009UG+S+IN	88F7040 ARM64 quad-core, 350–1400 MHz	1 GB DDR4 / 1 GB NAND	7× Gigabit + 1× 2.5G Ethernet + 1× SFP+ (10G)	PoE-in on port 1 (802.3af/at, 24–57V), DC jack, 2-pin terminal, ~25W max	Home-lab / small-office router — 10G uplink, 2.5G LAN trunk, USB3
L009UiGS-RM	IPQ-5018 dual-core ARM, 800 MHz	512 MB / 128 MB NAND	8× Gigabit Ethernet + 1× 2.5G SFP	PoE-in on ether1 (802.3af/at, 24–56V), PoE-out on ether8, DC jack, ~40W max	Budget access-layer / RB2011 replacement, PoE passthrough to an AP or camera

All three ship with RouterOS v7 and a Level 5 (RB4011, RB5009) or Level 5 (L009) license already included — no separate license purchase needed for typical use.

02 Port Maps

RB4011iGS+RM

~$219

10× GbE (ether1–10) · 1× SFP+ (sfp-plus1) · RJ45 console

e1
PoE-in

e10
PoE-out

sfp+1

Port 10 is the only PoE-out port (passive, up to 57V, 600mA). Ether1 accepts passive PoE-in 18–57V to power the unit itself.

Gigabit copper

SFP+ 10G

RB5009UG+S+IN

~$219

7× GbE (ether1–7) · 1× 2.5G (ether8) · 1× SFP+ (sfp-plus1) · USB3 · RJ45 console

e1
PoE-in

e8
2.5G

sfp+1

USB3

Only ether1 accepts PoE-in (802.3af/at, 24–57V) — there is no PoE-out on this model. The switch-chip links ports at 10G full-duplex to the CPU.

Gigabit copper

2.5G copper

SFP+ 10G

USB 3.0

L009UiGS-RM

~$119

8× GbE (ether1–8) · 1× 2.5G SFP · USB3 · RJ45 console

e1
PoE-in

e8
PoE-out

sfp1
2.5G

USB3

Budget successor to the RB2011 line — dual-core CPU and 512MB RAM are the ceiling here; watch resource usage under a full BGP table or heavy IPsec load.

Gigabit copper

2.5G SFP

USB 3.0

03 Access & First Setup

◎

Ways In

WinBox — connects by MAC on a flat L2 segment even with no IP set yet
WebFig — browser UI at the router's IP
SSH / Telnet — CLI, telnet disabled by default on new RouterOS7 installs
Serial console — RJ45 console port, 115200 8N1, all three models

🔑

Default Login

user: admin password: (blank)

VERIFY — RouterOS 7.x on new/reset hardware forces a password to be set on first WinBox/WebFig login; blank-password SSH access may be refused until that's done.

↺

Reset Configuration

/system reset-configuration /system reset-configuration no-defaults=yes

⚠ wipes all config — hold the reset button ~5s during power-up for a hardware-level reset

⛭

Netinstall (reflash)

Windows/Linux tool that pushes RouterOS over the network to a device in netinstall/BOOTP mode — use when the board won't boot or you need to wipe+reimage from scratch.

🛈

Identity

/system identity set name=edge-rb5009 /system clock set time-zone-name=Asia/Colombo

⏻

Safe Mode

Ctrl+X (toggles Safe Mode in CLI/terminal)

Any config change is rolled back automatically if the session drops before you exit Safe Mode cleanly — use it before firewall/route changes on a remote box.

04 System & Resources

⚙

Board & Resource Info

/system routerboard print /system resource print

Confirms exact model, serial, firmware version, CPU load, and free RAM — first command to run on an unfamiliar box.

⇪

RouterOS Upgrade

/system package update check-for-updates /system package update install

Set channel (stable/long-term/testing) first: /system package update set channel=stable

👤

Users

/user add name=netops group=full password=... /user print

⚠ don't leave the default "admin" account with a blank/weak password reachable from WAN

05 Interfaces & Bridge / VLAN

▤

Bridge Basics

/interface bridge add name=bridge1 /interface bridge port add bridge=bridge1 interface=ether2 /interface bridge print

RouterOS7's bridge can hardware-offload switching on ports that share the same switch-chip — mixing chip and non-chip ports still works, just without offload.

⑂

VLAN Filtering on Bridge

/interface bridge set bridge1 vlan-filtering=yes /interface bridge vlan add bridge=bridge1 vlan-ids=10 tagged=ether1 untagged=ether2

⚠ turning on vlan-filtering with no VLAN entries defined can immediately drop all traffic — stage the vlan table first

↳

VLAN Sub-Interface (routed)

/interface vlan add name=vlan20 interface=bridge1 vlan-id=20 /ip address add address=192.168.20.1/24 interface=vlan20

✎

Ethernet Port Settings

/interface ethernet print /interface ethernet set ether5 disabled=yes /interface ethernet monitor ether1

⇄

Bonding / LACP

/interface bonding add name=bond1 slaves=ether1,ether2 mode=802.3ad

Requires a switch on the other end configured for the matching LACP/static aggregate.

🔍

Neighbor Discovery

/ip neighbor print

Shows MikroTik (MNDP) and LLDP/CDP neighbors — useful to confirm cabling before trusting the topology diagram.

06 IP Addressing & DHCP

◈

Static Address

/ip address add address=10.0.0.1/24 interface=vlan20 /ip address print

▣

DHCP Pool & Server

/ip pool add name=pool20 ranges=10.0.0.10-10.0.0.200 /ip dhcp-server add name=dhcp20 interface=vlan20 address-pool=pool20 /ip dhcp-server network add address=10.0.0.0/24 gateway=10.0.0.1 dns-server=1.1.1.1

↺

DHCP Client (WAN)

/ip dhcp-client add interface=ether10 disabled=no

Add add-default-route=yes (default) unless you're managing the default route manually alongside a second WAN.

🗒

Leases

/ip dhcp-server lease print /ip dhcp-server lease make-static [find address=10.0.0.50]

☁

DNS

/ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=yes

⚠ allow-remote-requests exposes the router as an open resolver if the WAN-facing firewall doesn't block UDP/TCP 53 from outside

⧉

ARP Modes

/interface ethernet set ether2 arp=reply-only

reply-only means hosts must be added to the ARP table manually or via DHCP — a common lockdown for guest/DMZ segments.

07 Routing

→

Static & Default Route

/ip route add dst-address=0.0.0.0/0 gateway=203.0.113.1 /ip route add dst-address=10.10.0.0/16 gateway=10.0.0.254 distance=1 /ip route print

⇋

Route Distance (failover)

/ip route add dst-address=0.0.0.0/0 gateway=WAN1-IP distance=1 /ip route add dst-address=0.0.0.0/0 gateway=WAN2-IP distance=2

Lower distance wins; pair with check-gateway=ping so the primary route is withdrawn if WAN1 stops responding.

⊘

Blackhole Route

/ip route add dst-address=192.0.2.0/24 type=blackhole

Silently drops matching traffic without an ICMP unreachable — used to summarize/aggregate or to null-route abuse sources.

⑂

Policy Routing

/ip firewall mangle add chain=prerouting src-address=10.0.0.0/24 action=mark-routing new-routing-mark=via-wan2 /ip route add dst-address=0.0.0.0/0 gateway=WAN2-IP routing-mark=via-wan2

RouterOS7 replaced routing-mark based policy routing's older syntax with routing tables (/routing table) — mark-based routing above still works but check current wiki syntax for new deployments.

≡

OSPF (quick start)

/routing ospf instance add name=core /routing ospf area add name=backbone instance=core area-id=0.0.0.0 /routing ospf interface-template add interfaces=vlan20 area=backbone

VERIFY — RouterOS7 OSPF config path/menu differs meaningfully from RouterOS6; confirm against the current wiki before templating this.

≡

BGP (quick start)

/routing bgp connection add name=isp1 remote.address=203.0.113.1 remote.as=65001 local.role=ebgp

On the L009UiGS-RM, watch RAM (512MB) closely if the peer sends a full internet table — plan for route filtering.

08 Firewall

🛡

Filter Chains

input — traffic destined to the router itself
forward — traffic passing through the router
output — traffic originated by the router

✓

Baseline Input Policy

/ip firewall filter add chain=input connection-state=established,related action=accept /ip firewall filter add chain=input connection-state=invalid action=drop /ip firewall filter add chain=input in-interface=ether10 action=drop

Order matters — rules are evaluated top-down, first match wins. Put narrow accept rules before the catch-all drop.

⛔

Default Drop

/ip firewall filter add chain=forward connection-state=established,related action=accept /ip firewall filter add chain=forward connection-state=invalid action=drop /ip firewall filter add chain=forward action=drop

⚠ RouterOS ships with NO default-deny out of the box on some install paths — always add an explicit end-of-chain drop

⇄

Masquerade (SNAT)

/ip firewall nat add chain=srcnat out-interface=ether10 action=masquerade

Standard "share one WAN IP for the whole LAN" rule — bind to the specific WAN interface, not src-address, to survive interface renumbering.

↪

Port Forward (DNAT)

/ip firewall nat add chain=dstnat protocol=tcp dst-port=443 in-interface=ether10 action=dst-nat to-addresses=10.0.0.50 to-ports=443

🚫

Address Lists & Blocking

/ip firewall address-list add list=blocked address=198.51.100.0/24 /ip firewall filter add chain=forward src-address-list=blocked action=drop

Address lists are the reusable building block for rate-limiting, geo-blocking, or dynamic ban lists (e.g. from a fail2ban-style script).

🔓

Lock Down Management

/ip firewall filter add chain=input protocol=tcp dst-port=8291,22,443 src-address-list=trusted-admins action=accept place-before=0

8291 = WinBox. Restrict admin-plane access (WinBox/SSH/HTTPS) to a known source list before exposing any port to WAN.

📄

List & Reorder Rules

/ip firewall filter print /ip firewall filter move [find comment="drop-invalid"] destination=0

09 VPN

◑

WireGuard Interface

/interface wireguard add name=wg1 listen-port=13231 /ip address add address=10.99.0.1/24 interface=wg1

/interface wireguard peers add interface=wg1 public-key="..." allowed-address=10.99.0.2/32 endpoint-address=203.0.113.5 endpoint-port=13231

Native to RouterOS7 — no package/user-space daemon needed, and it hardware-offloads reasonably well on the ARM64 CPUs (RB5009).

🔒

IPsec Site-to-Site (quick)

/ip ipsec profile add name=p1 dh-group=modp2048 /ip ipsec peer add name=hq address=203.0.113.9 profile=p1 /ip ipsec proposal add name=prop1 enc-algorithms=aes-256-cbc /ip ipsec policy add peer=hq src-address=10.0.0.0/24 dst-address=10.1.0.0/24 proposal=prop1

VERIFY — IPsec menu structure changed materially between RouterOS6 and RouterOS7 (peer/profile split); confirm exact property names for your installed version.

🖧

L2TP/IPsec (remote access)

/interface l2tp-server server set enabled=yes use-ipsec=yes ipsec-secret=preshared-key /ppp secret add name=user1 password=... service=l2tp local-address=10.5.0.1 remote-address=10.5.0.2

⛨

Hardware Crypto Offload

RB4011's Cortex-A15 and RB5009's ARM64 CPUs both support AES hardware acceleration for IPsec — check /ip ipsec settings and monitor CPU during a throughput test rather than assuming full-line-rate offload.

10 QoS / Queues

▥

Simple Queue

/queue simple add name=lan-limit target=10.0.0.0/24 max-limit=100M/100M

Fastest way to cap a subnet or single host — max-limit is upload/download from the router's perspective (target's tx/rx).

⚖

Queue Tree (advanced)

/queue type add name=sfq-download kind=sfq /queue tree add name=download parent=global-out queue=sfq-download max-limit=500M

Needed for parent/child bandwidth shares or per-application prioritization — simple queues can't express hierarchy.

11 Backup, Upgrade & Recovery

💾

Binary Backup

/system backup save name=pre-change-2026-07-03 /system backup load name=pre-change-2026-07-03

Binary backups include users/passwords and are RouterOS-version-sensitive — best for restoring to the same box.

📜

Text Export (portable)

/export file=running-config /export compact file=running-config-compact

Human-readable .rsc script — the right format for version control, review, or moving config to a different device model.

↺

Rollback a Bad Change

Ctrl+X in terminal before disconnecting (Safe Mode auto-revert) /system backup load name=pre-change-2026-07-03

✓ always take a fresh backup/export immediately before any firewall, routing, or interface change on a remote box

⇪

Firmware / RouterBOOT

/system routerboard upgrade /system reboot

RouterBOOT (bootloader) upgrades separately from the RouterOS package — required after some major version jumps.

🗓

Scheduled Backups

/system scheduler add name=nightly-backup on-event="/system backup save name=auto" interval=1d

🛟

Netinstall Recovery

If a device won't boot after a bad upgrade: hold the reset button while powering on to enter Netinstall/BOOTP mode, then reflash from a PC on the same L2 segment.

12 Monitoring & Troubleshooting

📶

Basic Reachability

/ping 8.8.8.8 count=5 /tool traceroute 8.8.8.8

📈

Live Traffic

/interface monitor-traffic ether10 /tool torch interface=ether2

Torch shows live per-flow/per-protocol breakdown — the fastest way to spot what's saturating a link right now.

📊

Bandwidth Test

/tool bandwidth-test address=10.0.0.2 direction=both

Needs the Bandwidth Test Server running on the far-end MikroTik (or a compatible client).

📄

Logging

/log print /system logging add topics=firewall action=memory /ip firewall filter add chain=forward action=log log-prefix="FWD-DENY"

🔗

Connection Tracking

/ip firewall connection print /ip firewall connection tracking print

Check this before assuming a firewall rule is the problem — an existing tracked connection can bypass a newly added drop rule until it times out.

🌡

Health / Resource

/system health print /system resource cpu print

All three boards are passively cooled — check temperature under sustained high throughput, especially the RB4011 and RB5009 in an enclosed rack.

13 Common Errors & Fixes

Symptom	Likely Cause / Fix
Locked out after firewall change	reconnect via serial console or WinBox MAC-mode; reload last backup/export
VLAN traffic not passing after enabling vlan-filtering	missing bridge vlan table entry for that VLAN — traffic drops silently
DHCP clients get no address	check /ip pool has free addresses and dhcp-server network gateway/DNS match the subnet
WAN failover route not triggering	missing check-gateway=ping on the primary /ip route entry
Port forward not working despite correct NAT rule	forward chain firewall rule still dropping the translated destination — NAT happens before filter evaluation
Router unreachable after RouterOS upgrade	RouterBOOT firmware out of sync — run /system routerboard upgrade then reboot

Command / Action	Risk
/system reset-configuration	destructive wipes all configuration immediately
enabling vlan-filtering with an empty vlan table	destructive can drop all bridge traffic instantly
/ip firewall filter — reordering rules live	caution can open or close access mid-session; use Safe Mode
Netinstall / reflash	destructive erases RouterOS and config unless a backup was exported first
/export then /import on a different model	caution interface names (ether count, sfp naming) may not match — review before importing
/system backup load	safe non-destructive to reach, but overwrites current running config on load

14 CLI Quick Tips

⇥

Navigation

Tab — autocomplete command/property names
? — list available commands/options at current level
.. — go up one menu level, / — return to root

🔎

Filtering Output

/ip firewall filter print where chain=forward /interface print stats

Remove / Disable

/ip firewall filter remove [find comment="old-rule"] /interface ethernet disable ether5