Frequently Asked Questions
& Knowledge Answers

MikroWizard runs a built-in RADIUS server (listening on standard RADIUS ports 1812/1813). When an engineer logs into Winbox, RouterOS delegates authentication via RADIUS. The RADIUS server intercepts the MS-CHAPv2 credentials, validates the primary password, and verifies a 6-digit dynamic TOTP token (Google Authenticator, Authy) before issuing an Access-Accept packet.

When engineers use the in-browser Web Terminal, session traffic passes through a Linux daemon instrumented with ptrace system-call tracing. The daemon intercepts entered keystrokes and command buffers before they are transmitted to the Linux target. If a command matches an active blacklist (e.g. rm -rf / or iptables -F), execution is blocked instantly with an on-screen alert.

MikroWizard comes in two editions. Community Edition is open-source and free forever, supporting unlimited devices, users, and basic backups (the in-browser terminal is not included). Pro Edition unlocks enterprise Zero-Trust PAM (in-browser terminal gateway, kernel command blocking, session recordings, Winbox 2FA), visual diffing (ngx-diff), drag-and-drop sequence flowcharts, and white-label subscriber self-service.

Install the open-source Community edition on your Linux server. Once running, copy the unique hardware/instance serial number from the System Settings panel, and complete checkout on our official Device Registration Portal. Your license key activates automatically.

Yes. While deep PAM, WebFig proxy, and BTest features are purpose-built for MikroTik RouterOS v6 and v7, the fleet inventory and topology engine actively discovers and monitors Cisco, Linux, and other third-party switches via standard LLDP and CDP neighbour discovery.

No. MikroWizard is one platform made of independent modules. Privileged access management (PAM) works with any Windows or Linux server and network device over SSH, Telnet, RDP and VNC, and multi-vendor central management covers Cisco IOS/IOS-XE/NX-OS, Juniper, Huawei VRP, Aruba, EdgeOS, Linux and custom SSH/Telnet devices with backups, snippets and the task planner. The MikroTik toolset (firmware upgrades, Sync & Clone, Network Map, WebBox, RADIUS OTP for WinBox) is an extra module you can use with or without PAM. Workspace modes (MikroTik / PAM / All, Free & Pro) tailor the navigation, device tabs and actions to the modules you actually use.

Yes, in the Pro edition with the Terminal Gateway addon v1.3.0 (MikroWizard 2.1.0 and later). RDP and VNC desktop sessions open in the Connection Manager next to SSH, Telnet and WebFig as HTML5 sessions in the browser, so operators have nothing to install. They work with any Windows or Linux host. Every session is recorded and replayable in the browser, can be watched or shared live like terminal sessions, and is governed by session DLP policies for clipboard, file transfer, watermarking and forensic recording. You can also publish single applications from an RDP host as RemoteApp entries. Read the 2.1.0 release notes.

WebBox is web WinBox for MikroTik devices (Pro, requires the Terminal Gateway addon v1.3.0). The gateway runs MikroTik's WinBox 4 for Linux in an isolated sandbox and streams it to your browser, so operators need no local WinBox install and the WinBox port is not exposed to them. You can launch it from the Connection Manager, device list, device tree or Network Map. Each session gets an isolated temporary drive, is recorded as an MP4 with seeking, and can be watched or shared live. WebBox works with MikroTik devices only.

In both Free and Pro, the MikroTik firmware engine checks package names per architecture, and each package is verified with SHA256 against MikroTik's official hashes, free storage is checked before upload, RouterBOOT is upgraded after the OS, and the result is confirmed after reboot. Progress is stored per device, so a restart never loses track or leaves a router halfway, and failed updates are retried automatically (1–5 retries, default 2). Pro adds the multi-step path for older routers (latest v6 → 7.12.1 → 7.13+) and safety rules: it refuses a v6 → v7 upgrade when packages that don't migrate (e.g. multicast, user-manager) are installed, upgrades stations before APs on point-to-point links, and installs wifi-qcom / wifi-qcom-ac across the 7.13 package split.

A script pushes the same commands everywhere, whatever is already configured. MikroTik Sync & Clone (Pro) exports the RouterOS config sections you choose on a master router (e.g. /ip address, /ip dns, /ip route, firewall), diffs them against each member's export and applies only the missing or different lines, a minimal patch rather than a full overwrite. Run it on demand, on a schedule, or in live mode, where a change made on the master in WinBox, SSH, API or WebFig is replicated to members automatically (one-way master mode or two-way). Changes made by MikroWizard itself are ignored to avoid loops, and lines tagged #mwe stay local to a router.