---
name: mikrotik-routeros
description: Configures and automates MikroTik RouterOS routers through the terminal, command line interface, .rsc imports, /system script repository, Scheduler, Netwatch, firewall, NAT, DHCP, DNS, bridge, VLAN, routing, VPN, device-mode, backup/export, and RouterOS scripting. Use this skill whenever the user mentions MikroTik, Mikrotik, RouterOS, WinBox terminal, router CLI, router scripts, .rsc files, or configuring MikroTik services from the command line.
license: MIT
metadata:
  author: github.com/bastos
  version: "1.0"
---

# MikroTik RouterOS CLI and Scripting

Use this skill to generate, review, or troubleshoot RouterOS command-line configuration and scripts. Target RouterOS v7 unless the user gives a different version.

## Reference Loading

Read the smallest relevant reference before producing commands:

- `references/official-docs.md` - source map for official MikroTik documentation and version notes.
- `references/routeros-cli.md` - terminal syntax, paths, item targeting, quoting, and SSH execution.
- `references/routeros-scripting.md` - RouterOS script structure, variables, functions, error handling, and script repository behavior.
- `references/config-change-workflows.md` - backups, exports, safe mode, imports, resets, and rollback planning.
- `references/recipes.md` - reusable command patterns for common configuration tasks.

## Operating Model

1. Determine whether the user wants live execution, a command plan, a reusable `.rsc` file, or a `/system script` entry.
2. Gather only the facts needed to avoid an unsafe or wrong config: RouterOS version, model, management IP/interface, WAN/LAN interface names, bridge/VLAN design, and existing rule order.
3. Prefer commands that are safe to paste into a RouterOS terminal. Use absolute menu paths such as `/ip/firewall/filter` instead of relying on the current menu.
4. Use stable identifiers: item names, comments, default-name values, or `[find ...]` filters. Avoid numeric item IDs in generated scripts because CLI numbers are session-local.
5. Make commands idempotent where practical. Check for existing objects with `[find ...]` before adding duplicates.
6. Separate preflight, changes, verification, and rollback. Router configuration mistakes can cut off management access.

## Safety Defaults

- For remote network, firewall, route, bridge, VLAN, or address changes, recommend an export and either safe mode or a staged rollback path before making changes.
- Never guess credentials, public IPs, interface roles, or firewall rule order. Use placeholders or ask for the missing value if it is a blocker.
- Do not include real passwords, private keys, shared secrets, or `show-sensitive` output unless the user explicitly asks and understands the exposure.
- Prefer SSH or local terminal examples. Do not recommend Telnet except for an explicitly isolated recovery scenario.
- Flag commands that reboot, reset, disable management services, remove addresses/routes, or alter input firewall policy.
- If the user asks for a destructive reset, include the exact consequence and a backup/export step first.

## Answer Shape

For configuration changes, use this structure:

```markdown
## Preflight
<read-only commands to inspect state and save config>

## Commands
<RouterOS commands, grouped by subsystem>

## Verify
<commands to prove the intended state and connectivity>

## Rollback
<minimal commands or restore path>
```

For scripts, use this structure:

```markdown
## Script
<source code or /system script add/set command>

## Install
<commands to add the script and required policy>

## Test
<manual run, logs, dry-run behavior if applicable>

## Schedule or Trigger
<scheduler/netwatch/button hook only if requested>
```

## RouterOS Command Style

- Write commands in slash-separated form: `/ip/address/print`, `/system/script/add`, `/interface/bridge/vlan/add`.
- Keep `param=value` tight; RouterOS does not allow spaces around `=`.
- Quote strings with spaces or special characters: `comment="managed by routeros-script"`.
- Use comments as durable anchors for generated rules and scheduled jobs.
- Use `print terse` or `print detail` for state capture, and `print where ...` for targeted checks.
- Use `export terse` for portable command output; use binary `/system backup` only for same-device restore scenarios.

## Idempotent Pattern

Use this pattern when adding an object that should exist at most once:

```routeros
:if ([:len [/ip/firewall/address-list/find list="mgmt-allow" address="203.0.113.10"]] = 0) do={
    /ip/firewall/address-list/add list="mgmt-allow" address="203.0.113.10" comment="managed: admin workstation"
}
```

For existing objects, use `set [find ...] ...` only when the `find` expression is expected to match exactly one item. If multiple matches are possible, print and ask the user to choose or narrow the filter.

## Validation Checklist

Before handing off commands, check:

- Interface names match the user's device, or are clearly placeholders.
- Firewall rules are placed before broad drop/reject rules.
- Management allow rules are added before any restrictive input policy.
- Scripts declare variables before use and use local scope unless persistence is intentional.
- Import files use RouterOS syntax, not Bash.
- Version-sensitive features are labelled and linked to official docs when needed.


---
Source attribution: jcasnellie69
Original project: https://github.com/jcasnellie69/homelab-config/blob/main/.agents/skills/mikrotik-routeros/SKILL.md
License: MIT
License information: https://opensource.org/license/mit
Original upstream instructions; downloaded from Mega AI Hub.

## Upstream license notice

MIT License

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.



# Mega AI Hub resource metadata

Creator / publisher: jcasnellie69
Original project: https://github.com/jcasnellie69/homelab-config/blob/main/.agents/skills/mikrotik-routeros/SKILL.md
Attribution basis: Source repository record

Fields of work: Development & Engineering, Operations
Roles: DevOps / SRE, IT Operations
Specialties: Backend
Tools: Mikrotik Routeros
Country applicability: Country not specified
Classification basis: Source catalog labels
Instruction SHA-256: 9b674191b95717ea937b29d102cab64c685da0741a589cde550873e5ff33b675