MikroTik CLI commands are the text commands you type into the RouterOS terminal to set up a router: name it, address its ports, hand out DHCP leases, turn on NAT, filter traffic, route, bridge and tunnel. This free PDF is a MikroTik command line cheat sheet and terminal commands list: the working commands from a PNETLab practice lab, one topic per page, with the result of each ping test beside the config.
MikroTik CLI commands: the ten you’ll type first
Every MikroTik terminal session starts with the same short list. Run them in this order on a new router and you’ve named it, checked it and given it a path out.
/system identity set name="MyRouter"
/system resource print
/system license print
/interface print
/interface set ether1 name="WAN"
/ip address add address=192.168.1.2/24 interface=ether1
/ip dns set servers=8.8.8.8,8.8.4.4
/ip route add gateway=192.168.1.1
/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade
/ip route print| Command | What it does |
|---|---|
/system identity set name= | Sets the router’s hostname so you can tell devices apart |
/system resource print | Shows CPU, memory and RouterOS version |
/system license print | Shows the licence level |
/interface print | Lists every interface and its state |
/interface set ether1 name= | Renames a port, for example WAN |
/ip address add | Assigns an address and prefix to an interface |
/ip dns set servers= | Sets the DNS servers the router uses |
/ip route add gateway= | Adds a default route through the gateway |
/ip firewall nat add ... masquerade | Lets LAN devices share the WAN address |
/ip route print | Shows the routing table, so you can confirm the route is active |
Replace the example addresses with your own. They’re lab values.
How to add or set an IP address in MikroTik with a command
One command assigns an address. The address and prefix travel together, and you name the interface:
/ip address add address=192.168.10.1/24 interface=ether2That’s the MikroTik add and set IP address command in one, because a new address needs no separate set step. If you typed the wrong one, remove the entry by its number (read it from print) and add it again.
How to check the IP address in MikroTik: the print command
print is MikroTik’s show command. Add it to any menu to read what’s configured:
/ip address print
/interface print
/ip route print
/ip dhcp-server print
/ip firewall nat print/ip address print lists each address with its network and interface. Run a print after every add, as the PDF does, so you know the change landed before you test it.
MikroTik reboot and reset configuration commands
Three commands control the router’s power and state:
/system reboot
/system shutdown
/system reset-configuration/system reboot restarts the router and keeps its configuration. /system shutdown powers it off. /system reset-configuration wipes the router back to a blank state and reboots, so only run it on a lab box. Another useful one: /user add creates a second login, so give it a strong password, never 123.
MikroTik command line: how to connect and move around
The MikroTik command line is the RouterOS console. According to MikroTik’s Console documentation, you reach it over Telnet, SSH, a serial cable, WinBox’s terminal or a local keyboard and monitor.
Most MikroTik commands follow one pattern, and a few habits make the CLI fast:
- Press Tab to complete a command or a parameter.
- Use
printto read,addto create,setto change,removeto delete,enableanddisableto switch things on and off, andexportto dump the config as text. - Use
comment=on rules so the next engineer knows why they exist. - On RouterOS v7, MikroTik’s Command Line Interface page says to press F1 for built-in help instead of
?.
You can write a command with its full path (/ip address add ...) or move into a menu first (/ip address, then add ...). The PDF uses the short form, so add the leading slash when you paste a command from a prompt that isn’t at the root.
MikroTik DHCP server: terminal commands for WAN and LAN
The PDF’s lab has one router with two jobs. Its WAN port (ether1) is a DHCP client toward the ISP, and its LAN port (ether2) runs a DHCP server for the office.
WAN as a DHCP client. This is the default on most MikroTik boxes, and it’s one command:
/ip dhcp-client add interface=ether1
/ip route print
ping 8.8.8.8Check ip route print for the default route the client installs, then ping 8.8.8.8 to prove the path.
WAN with a static address. Remove the client, then set the address and gateway by hand:
/ip dhcp-client remove numbers=0
/ip address add address=10.0.137.2/24 interface=ether1
/ip route add gateway=10.0.137.1LAN with a DHCP server. Give the LAN port its gateway address, then run the wizard:
/ip address add address=192.168.10.1/24 interface=ether2
/ip dhcp-server setupThe wizard asks for the interface, the network, the gateway (192.168.10.1), the address pool (192.168.10.2-192.168.10.254), the DNS server and the lease time. Verify with /ip address print and /ip dhcp-server print. Two lab PCs then ask for an address and receive one from the pool, and a ping between them confirms the LAN works.
MikroTik’s DHCP documentation lists the server properties (address pool, lease time, authoritative) and static lease options if you need to pin a device to an address.
MikroTik firewall rules, NAT and address lists
MikroTik’s firewall filter has three chains, and the PDF explains each with a plain example:
| Chain | Handles | Example from the lab |
|---|---|---|
input | Packets addressed to the router itself | Drop ICMP from one PC to the router |
forward | Packets passing through the router | Block a LAN host from reaching an outside address |
output | Packets the router sends | Rules for traffic the router originates |
Block ping from one host to the router with an input rule:
/ip firewall filter add chain=input src-address=192.168.10.254 protocol=icmp action=drop comment="Block ICMP from PC1 to Router"
/ip firewall filter printA forward rule has the same shape, with chain=forward and a dst-address for what you want to stop. RouterOS reads rules from the top down and acts on the first match, so order matters.
MikroTik address list
An address list groups IPs under one name, so one rule covers many hosts. The PDF builds a blocked list and an approved list, drops the blocked one, accepts the approved one and drops its ICMP to the router. The pattern looks like this:
/ip firewall address-list add list=blocked address=192.168.10.15
/ip firewall filter add chain=input src-address-list=blocked action=dropIn the PDF’s lab, the blocked host can’t ping the router or the internet, while the approved PC can do both.
MikroTik NAT
The PDF compares four NAT types:
| Type | Command | Use it for |
|---|---|---|
| Masquerade | /ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade | LAN devices sharing a dynamic public address |
| src-nat | /ip firewall nat add chain=srcnat src-address=192.168.10.0/24 action=src-nat to-addresses=10.10.10.1 | LAN devices leaving from a chosen fixed public address |
| dst-nat | /ip firewall nat add chain=dstnat dst-address=203.0.113.1 protocol=tcp dst-port=80 action=dst-nat to-addresses=192.168.10.10 | Publishing an internal web server |
| redirect | /ip firewall nat add chain=dstnat protocol=tcp dst-port=80 action=redirect to-ports=8080 | Sending a port to another port on the router |
According to MikroTik’s NAT documentation, masquerade is built for links whose public address can change, such as DHCP or PPPoE. The same page notes that when a masqueraded link drops, its connection-tracking entries are purged, while plain src-nat keeps them. If your public address is fixed, src-nat is the cleaner choice.
A dst-nat rule only translates the packet. If your forward chain drops by default, add a matching accept rule too.
MikroTik static routing and OSPF commands
Static routing means you tell each router where every remote network lives.
MikroTik add route command line
Two forms cover most jobs:
/ip route add gateway=192.168.1.1
/ip route add dst-address=192.168.2.0/24 gateway=10.10.10.2The first is a default route for everything else. The second sends one remote network through a next hop. Confirm either with /ip route print.
The PDF builds this pattern with two, three and four routers, always the same two commands per remote subnet: a route out on one side and a route back on the other.
# Router 1
/ip route add dst-address=192.168.2.0/24 gateway=10.10.10.2
# Router 2
/ip route add dst-address=192.168.1.0/24 gateway=10.10.10.1
/ip route add gateway=10.10.10.1The last line is a default route that sends everything else to Router 1, so Router 2’s PCs reach the internet through Router 1’s NAT. Check each router with /ip route print.
The PDF then compares static routing with OSPF in one table. Static is simple and light on resources but needs manual edits after any change. OSPF adapts to failures on its own, at the cost of more complexity. Its example starts the OSPF process like this:
/routing ospf instance add name=default router-id=1.1.1.1On RouterOS v7, OSPF also needs a backbone area and an interface template that lists your networks:
/routing ospf area add name=backbone area-id=0.0.0.0 instance=default
/routing ospf interface-template add area=backbone networks=10.10.10.0/24The PDF also shows how to push a default route into OSPF with distribute-default, so the other three routers learn the way out. Syntax moved between RouterOS v6 and v7, so type ? or press F1 to check the options on your build.
OSPF itself is a bigger topic than one cheat sheet. For the protocol, read our free OSPF and MPLS LDP PDF.
MikroTik bridge: CLI commands for LAN ports
A MikroTik bridge is a virtual switch inside the router. Ports in the same bridge share one subnet and talk at Layer 2, with no routing between them. The PDF builds it like this:
/interface bridge add name=bridge-lan
/interface bridge port add interface=ether2 bridge=bridge-lan
/interface bridge port add interface=ether3 bridge=bridge-lan
/ip address add address=192.168.1.1/24 interface=bridge-lanPut the IP address on the bridge, not on the member ports. Then run the DHCP server on bridge-lan and keep the masquerade rule on ether1 so the bridged PCs reach the internet. A second topology adds ether4 to the same bridge and chains a second router with its own bridge-2.
According to MikroTik’s Bridging and Switching documentation, enabling use-ip-firewall lets firewall and queue rules see bridged traffic, but it turns off bridge fast path. Leave it off until you need it.
Bridging and DHCP are the first labs most people get wrong, so rehearse them somewhere safe. The workbook’s MikroTik practice labs walk through both with verification steps.
MikroTik VPN and tunnel commands
The PDF configures four tunnel types on two routers, plus PPPoE for a subscriber link.
| Tunnel | What it carries | Key commands |
|---|---|---|
| EoIP | Ethernet frames over IP, so two sites share one LAN | /interface eoip add name=eoip-tunnel-to-surabaya remote-address=10.0.137.186, then add it to a bridge |
| PPTP | A routed PPP tunnel | /ppp secret add, /interface pptp-client add |
| L2TP with IPsec | A routed tunnel with IPsec encryption | /ppp secret add, /interface l2tp-client add with IPsec enabled |
| PPPoE | PPP over Ethernet with per-user login | /interface pppoe-server server add, /ppp secret add |
In the EoIP lab, both ends create a tunnel pointing at each other, bridge it with a LAN port and share one subnet. Both ends must use the same tunnel ID.
For PPTP and L2TP, the pattern is a server on one router, a PPP secret with a username, a password, a local address (10.10.10.1) and a remote address, a client on the other router and a static route for each side’s LAN. For PPPoE, a profile limits each user:
/ppp profile set 0 rate-limit=2M/2MThat caps upload and download at 2 Mbps.
Two warnings. First, MikroTik’s PPTP documentation says PPTP has many known security issues and isn’t recommended. Use L2TP with IPsec instead, or SSTP. Second, the PDF’s sample credentials are throwaway lab values. Use long, random passwords on any real router.
Want to build these tunnels on a router you can safely break? The RouterOS v7 lab workbook has tunnel labs with ready-made CHR images, so you can rebuild a PPPoE server and a PPP tunnel in your own lab.
MikroTik load balancing and failover with two ISPs
Failover keeps one link active and switches to a backup when it fails. Load balancing uses both links at once. The PDF builds both on a router with two ISP uplinks.
Failover with distance and check-gateway. Give each default route a distance. The lowest distance wins, and check-gateway=ping pulls a route out when its gateway stops answering:
/ip route add gateway=192.168.111.1 distance=1 check-gateway=ping
/ip route add gateway=10.0.137.1 distance=2 check-gateway=pingMikroTik’s Failover (WAN Backup) documentation covers the options, including recursive routes.
To see which ISP carries a connection, the PDF runs a trace from a lab PC to 8.8.8.8 and reads the path. On the router itself, /tool traceroute 8.8.8.8 gives the same view.
ECMP load balancing. List both gateways in one route and traffic splits across them. The PDF lists a gateway twice to get a 2:1 ratio for a 10 Mbps and a 5 Mbps link:
/ip route add gateway=192.168.111.1,192.168.111.1,10.0.137.1Per-host and per-range routing. To send PC1 out ISP1 and PC2 out ISP2, mark packets in the mangle table and route each mark to its own gateway. The PDF does this by source address, then by two address lists (hosts 2 to 100 through ISP1, 101 to 200 through ISP2). On RouterOS v7, a routing mark needs a routing table first, and routes reference it with routing-table=. The v6-style routing-mark= on a route no longer works the same way, so test on your version.
MikroTik hotspot setup
A MikroTik hotspot is a captive portal. Users join the Wi-Fi, get redirected to a login page and reach the internet only after they authenticate. It suits cafés, hotels and guest networks.
The PDF’s lab uses a wireless interface with its own subnet (10.5.50.0/24), a DHCP pool (10.5.50.2 to 10.5.50.254) and a hotspot that adds NAT rules automatically. Unauthenticated users are redirected to the login page, and authenticated users are masqueraded to the internet.
Run the setup wizard from the terminal:
/ip hotspot setupAccording to MikroTik’s HotSpot documentation, the wizard asks for the interface, the gateway address, whether to masquerade, the address pool, DNS and a first user, and adds the settings the hotspot needs. Use WPA2 with a strong passphrase on the SSID. A simple password like 12345678 is fine for a lab and wrong for production.
What do you need to know before you use these MikroTik terminal commands?
Three things.
- Version. The PDF’s lab pulls a RouterOS 7.5 image into PNETLab with ishare2. Some commands differ on RouterOS v6, and some changed inside v7. When a command errors, check the parameters with Tab,
?or F1. - Scope. OSPF and Hotspot aren’t part of MikroTik’s MTCNA course outline, which covers DHCP, bridging, routing, wireless, firewall, QoS, tunnels and miscellaneous tools. This PDF covers more than the exam, and that’s useful for real jobs. For what the exam does test, read our MTCNA exam guide.
- Safety. Don’t paste MikroTik CLI commands that change firewall or NAT rules into a live router over a remote session without a way back. A bad
inputrule can lock you out. Use safe mode or a console, and keep a backup.
For basics that sit under all of this, our Subnet Mask Cheat Sheet covers the prefix maths, and the Network Troubleshooting Commands PDF covers ping, traceroute and the checks you run when a config doesn’t work. If you also run Cisco or Huawei gear, compare syntax with our Cisco Commands Cheat Sheet and Huawei Router Commands PDFs.
Where does this free MikroTik PDF stop?
This PDF shows what each of the MikroTik CLI commands looks like in a config and how to prove it with a ping. It doesn’t give you a lab to rebuild, break and fix, or the explanation of why each command works the way it does.
The MikroTik MTCNA Workbook fills that gap. It covers RouterOS v7 labs across introduction, DHCP, bridging, routing, wireless, firewall, QoS, tunnels and miscellaneous tools, with WinBox screenshots, CLI equivalents and verification steps. It includes ready-to-use CHR images, and there’s a free 25-page sample before you decide.
