Admin: Text replacement - "Category:Wiki" to "Category:Wiki '''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]''''' "

2026-01-17T07:07:11Z

Text replacement - "Category:Wiki" to "Category:Wiki '''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]''''' "

← Older revision		Revision as of 07:07, 17 January 2026
Line 1:		Line 1:
	[[Category:Wiki]]		[[Category:Wiki]]

			'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''


	== Identity, Time and System Management ==		== Identity, Time and System Management ==

Admin at 17:10, 20 December 2025

2025-12-20T17:10:42Z

← Older revision		Revision as of 17:10, 20 December 2025
Line 26:		Line 26:
	Security note: keep RouterOS updated to mitigate known vulnerabilities.		Security note: keep RouterOS updated to mitigate known vulnerabilities.

	~~---~~

	== Interface Management ==		== Interface Management ==
Line 45:		Line 45:
	/interface ethernet print stats</nowiki>		/interface ethernet print stats</nowiki>

	~~---~~

	== IP Addressing and Neighbor Discovery ==		== IP Addressing and Neighbor Discovery ==
Line 63:		Line 63:
	/interface ethernet set LAN arp=reply-only</nowiki>		/interface ethernet set LAN arp=reply-only</nowiki>

	~~---~~

	== Routing ==		== Routing ==
Line 80:		Line 80:
	/ip route print detail</nowiki>		/ip route print detail</nowiki>

	~~---~~

	== Firewall and NAT ==		== Firewall and NAT ==
Line 102:		Line 102:
	Security note: expose only necessary services and restrict by source IP when possible.		Security note: expose only necessary services and restrict by source IP when possible.

	~~---~~

	== Services and Management Access ==		== Services and Management Access ==
Line 124:		Line 124:
	/ip service set winbox address=192.168.1.0/24</nowiki>		/ip service set winbox address=192.168.1.0/24</nowiki>

	~~---~~

	== User Management and Permissions ==		== User Management and Permissions ==
Line 143:		Line 143:
	Principle of least privilege should always be applied.		Principle of least privilege should always be applied.

	~~---~~

	== Logging and Monitoring ==		== Logging and Monitoring ==
Line 157:		Line 157:
	/system logging add topics=info action=remote</nowiki>		/system logging add topics=info action=remote</nowiki>

	~~---~~

	== Backup, Restore and Export ==		== Backup, Restore and Export ==
Line 176:		Line 176:
	Security note: exports may contain sensitive data; store securely.		Security note: exports may contain sensitive data; store securely.

	~~---~~

	== Scripting and Automation ==		== Scripting and Automation ==
Line 189:		Line 189:
	on-event=rebootNight</nowiki>		on-event=rebootNight</nowiki>

	~~---~~

	== Security Concepts ==		== Security Concepts ==
Line 201:		Line 201:
	* Backup configurations regularly		* Backup configurations regularly

	~~---~~

	== Troubleshooting ==		== Troubleshooting ==
Line 235:		Line 235:
	/system resource print</nowiki>		/system resource print</nowiki>

	~~---~~

	== Useful Links ==		== Useful Links ==

Admin: Created page with "Category:Wiki == Identity, Time and System Management == === System Identity === Set a unique router name for management and logging clarity. /system identity set name=CORE-RTR-01 === System Clock and Timezone === Correct time is essential for logs, certificates, and security auditing. /system clock set time-zone-name=Europe/Paris Enable NTP client: /system ntp client set enabled=yes servers=pool.ntp.org =..."

2025-12-20T17:10:12Z

Created page with "Category:Wiki == Identity, Time and System Management == === System Identity === Set a unique router name for management and logging clarity. <nowiki> /system identity set name=CORE-RTR-01</nowiki> === System Clock and Timezone === Correct time is essential for logs, certificates, and security auditing. <nowiki> /system clock set time-zone-name=Europe/Paris</nowiki> Enable NTP client: <nowiki> /system ntp client set enabled=yes servers=pool.ntp.org</nowiki> =..."

New page

[[Category:Wiki]]

== Identity, Time and System Management ==

=== System Identity ===
Set a unique router name for management and logging clarity.
<nowiki>
/system identity set name=CORE-RTR-01</nowiki>

=== System Clock and Timezone ===
Correct time is essential for logs, certificates, and security auditing.
<nowiki>
/system clock set time-zone-name=Europe/Paris</nowiki>

Enable NTP client:
<nowiki>
/system ntp client set enabled=yes servers=pool.ntp.org</nowiki>

=== RouterOS Packages ===
List and manage installed packages.
<nowiki>
/system package print
/system package update check-for-updates
/system package update download</nowiki>

Security note: keep RouterOS updated to mitigate known vulnerabilities.

---

== Interface Management ==

=== Physical Interfaces ===
List all interfaces:
<nowiki>
/interface print</nowiki>

Rename interfaces for clarity:
<nowiki>
/interface ethernet set ether1 name=WAN
/interface ethernet set ether2 name=LAN</nowiki>

=== Interface Status and Statistics ===
<nowiki>
/interface monitor-traffic WAN
/interface ethernet print stats</nowiki>

---

== IP Addressing and Neighbor Discovery ==

=== IP Address Assignment ===
Assign static IP addresses:
<nowiki>
/ip address add address=192.168.1.1/24 interface=LAN</nowiki>

Remove an IP:
<nowiki>
/ip address remove [find address~"192.168.1.1"]</nowiki>

=== ARP Behavior ===
Restrict ARP for security-sensitive networks:
<nowiki>
/interface ethernet set LAN arp=reply-only</nowiki>

---

== Routing ==

=== Default Route ===
Add a default gateway:
<nowiki>
/ip route add dst-address=0.0.0.0/0 gateway=192.0.2.1</nowiki>

=== Static Routes ===
<nowiki>
/ip route add dst-address=10.10.0.0/16 gateway=192.168.1.254</nowiki>

=== Route Monitoring ===
<nowiki>
/ip route print detail</nowiki>

---

== Firewall and NAT ==

=== Firewall Filter Rules ===
Basic stateful firewall example:
<nowiki>
/ip firewall filter add chain=input connection-state=established,related action=accept
/ip firewall filter add chain=input connection-state=invalid action=drop
/ip firewall filter add chain=input in-interface=WAN action=drop</nowiki>

=== NAT (Masquerade) ===
<nowiki>
/ip firewall nat add chain=srcnat out-interface=WAN action=masquerade</nowiki>

=== Port Forwarding ===
<nowiki>
/ip firewall nat add chain=dstnat protocol=tcp dst-port=443 \
action=dst-nat to-addresses=192.168.1.10 to-ports=443</nowiki>

Security note: expose only necessary services and restrict by source IP when possible.

---

== Services and Management Access ==

=== RouterOS Services ===
List enabled services:
<nowiki>
/ip service print</nowiki>

Disable insecure services:
<nowiki>
/ip service disable telnet,ftp,www</nowiki>

Change management ports:
<nowiki>
/ip service set ssh port=2222</nowiki>

=== Winbox Access Control ===
Restrict access by IP:
<nowiki>
/ip service set winbox address=192.168.1.0/24</nowiki>

---

== User Management and Permissions ==

=== User Accounts ===
Create a limited administrative user:
<nowiki>
/user add name=netadmin group=full password=StrongPassword</nowiki>

Remove default admin user:
<nowiki>
/user remove admin</nowiki>

=== User Groups ===
<nowiki>
/user group print</nowiki>

Principle of least privilege should always be applied.

---

== Logging and Monitoring ==

=== System Logging ===
Enable firewall logging:
<nowiki>
/system logging add topics=firewall action=memory</nowiki>

Send logs to a remote server:
<nowiki>
/system logging action add name=remote target=remote remote=192.168.1.50
/system logging add topics=info action=remote</nowiki>

---

== Backup, Restore and Export ==

=== Binary Backup ===
<nowiki>
/system backup save name=router-backup</nowiki>

Restore:
<nowiki>
/system backup load name=router-backup</nowiki>

=== Configuration Export ===
Human-readable export:
<nowiki>
/export file=router-config</nowiki>

Security note: exports may contain sensitive data; store securely.

---

== Scripting and Automation ==

=== Simple Script Example ===
<nowiki>
/system script add name=rebootNight source="/system reboot"</nowiki>

=== Scheduler ===
<nowiki>
/system scheduler add name=nightly-reboot start-time=03:00 interval=1d \
on-event=rebootNight</nowiki>

---

== Security Concepts ==

* Use **strong passwords** and disable unused accounts
* Limit management access by IP and interface
* Keep RouterOS updated
* Use firewall default-deny policies
* Separate management, user, and WAN traffic
* Monitor logs for anomalies
* Backup configurations regularly

---

== Troubleshooting ==

=== Connectivity Issues ===
Check interface status:
<nowiki>
/interface print</nowiki>

Verify IP configuration:
<nowiki>
/ip address print</nowiki>

Test connectivity:
<nowiki>
/ping 8.8.8.8</nowiki>

=== Routing Problems ===
<nowiki>
/ip route print</nowiki>

Check gateway reachability:
<nowiki>
/ping 192.0.2.1</nowiki>

=== Firewall Debugging ===
Temporarily log dropped packets:
<nowiki>
/ip firewall filter add chain=input action=log log-prefix="DROP-INPUT"</nowiki>

=== CPU and Memory ===
<nowiki>
/system resource print</nowiki>

---

== Useful Links ==

* [https://help.mikrotik.com/docs/ MikroTik Official Documentation]
* [https://wiki.mikrotik.com MikroTik Wiki (Legacy)]
* [https://forum.mikrotik.com MikroTik Community Forum]
* [https://help.mikrotik.com/docs/display/ROS/RouterOS RouterOS Manual]
* [https://www.youtube.com/@MikroTikOfficial MikroTik Official YouTube Channel]

MIKROTIK - Base Commands - Revision history

Admin: Text replacement - "Category:Wiki" to "Category:Wiki '''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]''''' "

Admin at 17:10, 20 December 2025