Onboarding a MikroTik router

Adding a router by hand means typing a RADIUS client, a shared secret, a tunnel and several firewall lines without a mistake. The panel generates all of it as one script instead.

Before you start

• A MikroTik running RouterOS 6 or 7, with outbound internet access.
• Terminal access to it, over Winbox or SSH.
• A few minutes of tolerance for the tunnel to come up.

The tunnel transport is chosen per device to match the hardware: WireGuard on RouterOS 7, OpenVPN on RouterOS 6, and ZeroTier where neither is available on the board — notably RouterOS 7 on ARM.

Generate the script

Under Network, add a device, give it a name, pick the RouterOS version and the transport, and the panel produces a script.

The script is specific to that device: it contains the credentials for its tunnel and the shared secret for its RADIUS client. Treat it like a password, and do not reuse one script on a second router.

Paste it into the terminal

Paste the whole thing into the router's terminal at once. It creates the tunnel interface, adds the instance as a RADIUS server for authentication and accounting, enables the accounting interim updates the billing engine needs, and adds the firewall rules the tunnel requires.

Verify

Three things should become true within a minute or two:

1. The device shows as online under Network, with its tunnel address visible.
2. A remote console for the device opens from the panel, through the same tunnel — no port forwarding on your side.
3. An authentication attempt from a subscriber behind that router appears in the live RADIUS log.

If it did not work

• The tunnel does not come up. Check the router's clock. A wrong date breaks the tunnel handshake before anything else can fail, and it is the most common cause on a device that has been in a box.
• The tunnel comes up and then drops. On some RouterOS 7.2x builds the connection-tracking state has to be allowed explicitly for the tunnel's own traffic; the generated script does this, so a hand-edited copy is the usual suspect.
• The router cannot resolve the instance's address. Set a DNS server on the router, or use the address form the script generated rather than editing it.
• Authentication reaches the instance but is rejected as an unknown device. The router is sending from a different source address than the one registered — usually because it has a second uplink.