Skip to content
@deckyard/routeros

routeros

@deckyard/routeros drives a MikroTik router over the RouterOS binary API. Each guide covers one topic; the cheatsheet lists every function, constant and struct. MikroTik's RouterOS documentation describes the menus behind the paths.

This deck is part of Deckyard, community decks for Jennifer.

Conventions

Snippets assume a connection:

jennifer
import "@deckyard/routeros/" as mt;

def c as mt.Client init mt.connect("192.168.88.1", "admin", "secret");
# ... snippet ...
mt.disconnect($c);
  • Errors. Input rejected locally throws Error{kind: "routeros"} before anything is sent. Errors from the router or the connection throw Error{kind: "mikrotik"}. Both carry a readable message.
  • Ids. RouterOS gives every list item an id like "*3". add* functions return it, structs carry it in .id, and the generic verbs take it. Most helpers take a name or a comment instead, because ids change when an item is re-created.
  • Verbose mode. $c = mt.setVerbose($c, true); prints every command sent, with credentials redacted; MT_VERBOSE=1 sets it at connect. See core.md.

Every topic has a read-only example in examples/: MT_HOST=... MT_USER=... MT_PASSWORD=... jennifer run examples/<topic>.j.

Guides

GuideCovers
core.mdconnecting, the generic add/set/remove verbs, shared validation
interfaces.mdlisting, enabling, renaming physical and virtual interfaces
interfacelist.mdinterface lists: WAN/LAN groups for firewall matching
lte.mdLTE / cellular uplink: signal, APN, backup WAN
ethernet.mdport settings: speed, duplex, MTU, PoE, link state
bonding.mdlink aggregation: LACP trunks, failover bundles
bridges.mdbridges and bridge ports (virtual switches)
switch.mdswitch chip: hardware offload inventory and verification
vlans.md802.1Q tagged interfaces
firewall.mdfilter rules: the builder, comment handles, shortcuts
nat.mdmasquerade and port forwarding
upnp.mdUPnP: LAN devices open their own port forwards
trafficflow.mdNetFlow / IPFIX export to a collector
raw.mdfirewall raw: pre-conntrack drop / notrack
addresslist.mdfirewall address lists: one rule, living list
mangle.mdpacket marking: queue marks, policy routing, MSS clamp
contrack.mdconnection tracking: the live connection table
ip.mdIP addresses on interfaces
ipv6.mdIPv6: the stack switch, addresses, router advertisements
arp.mdthe ARP table: who is on the LAN, pinned bindings
neighbor.mdneighbor discovery: what is on this segment (LLDP/CDP/MNDP)
dhcp.mdDHCP server, leases, and the WAN-side DHCP client
ppp.mdPPPoE dial-in WAN (DSL/fiber)
hotspot.mdthe captive guest portal: vouchers, bypass, walled garden
vpn.mdremote-access VPN: L2TP, SSTP, OpenVPN, IKEv2, PPP users
dns.mdresolver settings and static DNS entries
routing.mdstatic routes and the default route
queues.mdbandwidth limiting with simple queues
wireless.mdWiFi: SSIDs, passwords, guest networks, clients (classic menu)
wifi.mdmodern WiFi (wifiwave2/ax, RouterOS v7)
wireguard.mdWireGuard VPN tunnels (RouterOS v7)
eoip.mdEoIP: one LAN across two sites
gre.mdGRE: routed site-to-site links, any vendor
ipsec.mdIPsec: standards-based site-to-site, multi-vendor
vrrp.mdVRRP: two routers, one gateway, automatic failover
tools.mdping, bandwidth test, fetch, e-mail alerting
sms.mdtext messages over the cellular modem
netwatch.mdcontinuous host monitoring with on-change scripts
scheduler.mdscripts on a timer
script.mdthe stored-script repository (run by name)
users.mdrouter accounts, groups, active sessions
services.mdmanagement services: hardening the ways in
certificates.mdTLS: self-signed, Let's Encrypt, the acme flow
clock.mdclock and NTP: a router that knows what time it is
files.mdfiles and configuration backups
disk.mdstorage devices: list, format, eject
cloud.mdMikroTik Cloud DDNS: a stable name for a dynamic WAN
snmp.mdSNMP: plug the router into monitoring
radius.mdRADIUS: central authentication for logins/VPN/hotspot
health.mdsystem health: temperature, voltage, fans
container.mdrun OCI containers on the router (v7)
capsman.mdCAPsMAN: central management of many access points
log.mdreading the router log, routing what gets logged
system.mdpackages, updates, firmware, reboot

Disclaimer

MikroTik and RouterOS are trademarks of SIA Mikrotikls. routeros is an independent library, not affiliated with, endorsed or supported by SIA Mikrotikls. It changes the configuration of live network equipment. Use at your own risk; no warranty of any kind. Licensed LGPL-3.0-only, see LICENSE.