A Platform
Purpose-Built for MikroTik RouterOS

WebBox: Remote WinBox in the Browser

WebBox is web WinBox for your MikroTik fleet. The MikroWizard gateway runs MikroTik's WinBox 4 for Linux in an isolated sandbox and streams it to your browser. Operators get the full WinBox experience without installing WinBox and without the WinBox port (8291) being exposed to them.

• ✓ Launch from anywhere: Connection Manager, device list, device tree or Network Map, with a gateway availability check.
• ✓ Recorded as MP4: every session is recorded with seeking for later review.
• ✓ Watch and share live: sessions can be watched or shared like terminal sessions.
• ✓ Isolated per session: each session gets its own temporary drive.

WebBox is part of the PAM module and needs the Terminal Gateway addon (v1.3.0). It works with MikroTik devices only. Read the 2.1.0 release post →

Native Remote Winbox, SSH & WebFig 2FA via Built-in RADIUS Server

MikroWizard solves what RouterOS cannot do alone: TOTP 2FA for native remote Winbox desktop access. The built-in RADIUS server (ports 1812/1813) intercepts native remote Winbox, SSH, and WebFig MS-CHAPv2 authentication packets and validates dynamic 6-digit TOTP tokens before granting access — enabling secure remote Winbox management without VPNs or firewall modifications.

• ✓ MS-CHAPv2 Hash Interception: Full RADIUS protocol validation — simply point your RouterOS RADIUS client at MikroWizard.
• ✓ Winbox 3.x & 4.x Native: Compatible with all standard Winbox desktop releases without requiring router plugins or custom firmware.
• ✓ Dual OTP Protection: RFC 6238 TOTP for MikroWizard web portal + dynamic RADIUS OTP for native RouterOS logins.
• ✓ RADIUS Audit Trail: Every authentication attempt (success/denied) recorded in the 5-tier audit system with IP, user, and device metadata.

Secure Remote Access & WebFig Reverse Proxy — Full GUI Without a Public IP or Open Port

Get secure remote access to the complete MikroTik WebFig graphical configuration interface for any router — even behind double-NAT, CGNAT, or private networks — without exposing HTTP port 80/8080 or configuring public IPs. MikroWizard's HTTP/WebSocket reverse proxy securely tunnels remote management sessions on demand.

• ✓ Zero Port Exposure: Router management ports stay closed to the internet — all WebFig traffic is multiplexed through MikroWizard's single HTTPS endpoint.
• ✓ Vault Auto-Login: Encrypted credentials injected automatically — operators gain WebFig access without knowing device passwords.
• ✓ RouterOS v6 & v7: Fully compatible with legacy WebFig and the redesigned WebFig UI in RouterOS v7.
• ✓ Session Audited & Killable: Real-time session monitoring in PAM Active Sessions with duration tracking and instant 1-click killswitches.

Zero-Client In-Browser CLI — SSH & Telnet to RouterOS Without Installing Software

Connect to any MikroTik router via SSH or Telnet directly inside your web browser — no PuTTY, WinBox SSH tab, SecureCRT, or local SSH key management. The xterm.js WebSocket terminal gateway (a Pro feature) delivers full RouterOS CLI capabilities with ANSI colors, interactive command menus, and tab completion.

• ✓ Native xterm.js Emulation: Renders authentic RouterOS banners, color syntax, and interactive pagers.
• ✓ Full Keystroke Recording: Every terminal session recorded in compressed Asciinema v2 format for instant replay and compliance audit.
• ✓ Kernel Command Policy: Intercepts and blocks dangerous Linux target commands (such as rm -rf /) via ptrace before execution.
• ✓ Collaboration Rooms: Share live sessions with colleagues or external vendors as Observer or Collaborator via temporary secure tokens.

Layer-2 MNDP / LLDP / CDP Topology Discovery & Vis-Network Map

MikroWizard automatically discovers your entire network topology by harvesting MikroTik MNDP (MikroTik Neighbor Discovery Protocol) tables alongside LLDP and Cisco CDP data. It dynamically constructs an interactive physics-based vis-network graph without requiring manual map maintenance.

• ✓ MikroTik MNDP Native: Auto-discovers RouterOS neighbors, device identity, board models, and connected interface ports.
• ✓ Multi-Vendor Interconnects: Integrates Cisco CDP and standard LLDP switches seamlessly alongside MikroTik equipment.
• ✓ Interactive Physics Engine: Drag, pan, zoom, and organize nodes with real-time connection link indicators.
• ✓ 1-Click Quick Triage: Click any router node in the map to instantly launch in-browser Terminal or WebFig proxy.

MikroTik Network Map with Root Cause Analysis

Network Map v2 builds on MNDP, LLDP and CDP neighbour discovery. When something goes down, its Problems drawer separates the router that actually failed from the devices that are only unreachable because of it.

• ✓ Radial and tree layouts, path finding and full-screen NOC mode.
• ✓ RouterOS-aware discovery: unmanaged peers recognised by router identity, APs and CPEs classified, bridge ports and RouterOS 7 link-local neighbours shown.
• ✓ Export: PNG of the map and CSV of the device inventory.

Explore the Network Map →

Offline NPK Firmware Repository & Air-Gapped Fleet Upgrades

MikroWizard maintains a local offline cache of RouterOS NPK firmware packages across all hardware architectures, enabling automated fleet-wide firmware upgrades even in completely air-gapped or isolated network segments.

• ✓ NPK Package Repository: Cache routeros, wireless, zerotier, and container NPK packages locally across stable, long-term, and development channels.
• ✓ Air-Gapped Operation: Upgrade edge routers that have zero internet access — essential for mission-critical ISP and industrial deployments.
• ✓ Staged Fleet Rollouts: Schedule bulk firmware pushes using Task Planner to safely update hundreds of routers overnight.
• ✓ Pre-Upgrade Snapshot: Automatically triggers config backups prior to package push for instant 1-click recovery.
• ✓ Architecture Coverage: Supports mipsbe, arm, arm64, x86, tile, and mmips hardware architectures.

MikroTik Firmware Upgrade: RouterOS v6 to v7 Without Guesswork

MikroWizard 2.1.0 ships a rewritten firmware engine that checks package names per architecture, verifies every package and confirms the result after the reboot. In Pro, a multi-step planner takes older routers along the supported path, latest v6 → 7.12.1 → 7.13+.

• ✓ SHA256 verification against MikroTik's official hashes, plus a free-storage check before upload.
• ✓ RouterBOOT after OS and restart-safe progress stored per device.
• ✓ Modes and sources: full, OS only, packages only or bootloader only; from the local repository, MikroTik servers, a specific version or Auto-Pilot latest.
• ✓ Live status: Updating / Rebooting / Updated / Failed badges with inline Retry.
• ✓ Pro: wifi-qcom / wifi-qcom-ac installed across the 7.13 package split, PtP safe ordering (stations before APs), v6 → v7 refused when non-migrating packages such as multicast or user-manager are installed, and the Latest Cloud channel.

See the full firmware engine details →

Live DHCP Lease Tracking, IP History & Connected Device Monitoring

MikroWizard continuously queries RouterOS DHCP server lease tables across all managed routers, recording MAC-to-IP binding histories, hostname records, lease durations, connection interfaces, and Wi-Fi signal metrics for audit and troubleshooting.

• ✓ Historical IP Assignment: Track which MAC received which IP address over time for compliance, subscriber support, and dispute resolution.
• ✓ Hostname & Wi-Fi RSSI: Device hostnames, signal RSSI levels, and interface associations recorded with every lease update.
• ✓ Fleet & Subscriber Scopes: Monitor fleet-wide DHCP pools in NOC Wallboard or provide read-only device views in subscriber self-service.
• ✓ Hotspot & PPPoE Counters: Real-time counts of active Hotspot and PPPoE subscribers integrated into the telemetry engine.

Deep RouterOS Telemetry — CPU, RAM, Interfaces & Latency Graphs

MikroWizard queries the RouterOS API and REST API in real time to collect granular device telemetry: CPU load, free RAM, HDD usage, ping latency history, active Hotspot/PPP users, interface packet counters, TX/RX rates, and config version drift — all visualized without opening WinBox.

• ✓ RouterOS API & REST API: Native integration with legacy RouterOS API (port 8728/8729) and modern RouterOS REST API (v7.1+).
• ✓ Interface Packet Counters: Real-time TX/RX throughput, packet counters, errors, and drop metrics per interface.
• ✓ Ping Latency History: Continuous ICMP latency graphs for SLA validation and connection quality tracking.
• ✓ Config Drift Tracking: Version counters compared against baseline backups to highlight unauthorized on-router modifications.

WireGuard Server Management & Mobile QR Peer Provisioning (RouterOS v7)

MikroWizard's dedicated WireGuard management service configures kernel WireGuard interfaces on RouterOS v7, manages dynamic peer allocations, and auto-generates mobile client QR codes alongside RouterOS CLI peer scripts.

• ✓ RouterOS v7 CLI Provisioning: Auto-generates ready-to-run /interface/wireguard/peers configuration scripts.
• ✓ Instant Mobile QR Codes: Onboard iOS and Android WireGuard clients in seconds with scannable setup codes.
• ✓ Live RX/TX Throughput: Real-time bandwidth telemetry monitored per connected WireGuard peer.
• ✓ MSS Clamping & Keepalives: Optimized tunnel MTU and keepalive configurations to maintain resilient connectivity through NAT.

MikroSpeed: Rust btest-rs Bandwidth Test Engine

Standard single-threaded bandwidth test utilities struggle to saturate multi-gigabit interfaces. MikroWizard provides btest-rs, a custom Rust-compiled RouterOS Bandwidth Test engine supporting Curve25519 EC-SRP5 authentication compatible with RouterOS v6.43+ and v7.

• ✓ Curve25519 EC-SRP5: Zero-knowledge ephemeral authentication handshake fully compatible with native RouterOS protocols.
• ✓ Multi-Threaded Testing: Parallel TCP/UDP streams, with throughput limited only by your test server, router and link.
• ✓ Full Hardware Compatibility: Works across CCR2004, CCR2116, CCR2216, CRS switches, and CHR virtual appliances.
• ✓ Subscriber Self-Service: End-users can run self-service diagnostics through the branded portal without administrator access.

Automated RouterOS Config Backups & Git-Style Visual Diff

MikroWizard automatically backs up RouterOS RSC (/export fine) configurations on scheduled intervals and before any automated changes. Instantly compare any two snapshots using side-by-side and unified visual diff views to spot configuration drift and restore states in one click.

• ✓ RouterOS RSC Export: Generates human-readable RSC export files that can be directly restored via /import.
• ✓ Dual Diff Views: Choose between side-by-side visual diffing and unified patch diffing with clear color-coded indicators.
• ✓ 1-Click Rollback: Push any previous configuration backup back to the router via API with safety checks.
• ✓ Source Traceability: Every backup is tagged by trigger type (Scheduled, Manual, Sequence Execution, Snippet Run).

Golden Master Router Cloner & Two-Way RouterOS Synchronization

Designate a reference "Golden Master" router with your ideal baseline configuration, then replicate it across any number of edge or branch routers — with granular module selection and identity exclusion filters that protect device-specific IP and identity parameters.

• ✓ Flexible Sync Modes: Supports Master-to-Slave push replication and bidirectional Two-Way sync modes.
• ✓ Granular Module Toggles: Choose specific sections to synchronize (IP, Firewall, Wireless, Users, Routing) rather than whole-image overwrite.
• ✓ Identity Exclusion Filters: Keep device-specific attributes (system identity, WAN IP, interface MACs) intact during cloning.
• ✓ Rapid CPE Provisioning: WISPs and ISPs can deploy standardized subscriber routers in minutes with zero-touch consistency.

MikroTik Config Sync in Live Mode

Sync & Clone exports the chosen RouterOS sections from the master, diffs them against each member's export and applies only the missing or different lines: a minimal patch, not a full overwrite. Run it on demand, on a cron schedule, or in live mode, which watches RouterOS change logs and replicates a change made on the master in WinBox, SSH, the API or WebFig.

• ✓ Master mode or Two-way: one-way from master to members, or a change on any member propagates.
• ✓ No loops: changes made by MikroWizard itself are ignored.
• ✓ Local lines: lines tagged #mwe stay local to a router.
• ✓ Synced once: a device in several groups is synced once.

RouterOS-Mirrored RBAC with 19 User Policies — Synced Directly to Device User Groups

MikroWizard's permission profiles align directly with all 19 RouterOS user policies — api, dude, ftp, local, password, policy, read, reboot, rest-api, romon, sensitive, sniff, ssh, telnet, test, tikapp, web, winbox, write — and synchronizes permissions directly with on-router user groups.

• ✓ 19 RouterOS User Policies: Direct mapping ensuring consistent authorization across web UI, terminal, API, and Winbox.
• ✓ Automatic Group Synchronization: Updates on-router /user/group policies directly upon role assignment.
• ✓ Pre-Packaged Role Profiles: Ready-to-use profiles like NOC-ReadOnly, MSP-Admin, Operator, and Auditor.
• ✓ Multi-Tenant Isolation: Restrict operators strictly to authorized router tags and customer domains.

MikroTik Fleet Inventory, Subnet Scanner & Bulk CSV Onboarding

Manage your entire MikroTik fleet from a centralized inventory table: track credentials, firmware versions, RouterOS v6/v7 classification, uptime, WebFig proxy status, and API-SSL encryption. Discover unmanaged routers automatically with the subnet scanner wizard or import existing inventories in bulk via CSV.

• ✓ v6 vs v7 Fleet Classification: Visual indicators show RouterOS version distribution and highlight legacy targets for upgrade.
• ✓ API & API-SSL Configuration: Manage secure TLS encryption ports (8729) and REST API endpoints per router.
• ✓ Subnet Auto-Discovery Scanner: Sweep CIDR network blocks to discover new RouterOS devices with credential probing.
• ✓ Mass CSV Import: Bulk onboard thousands of routers with pre-configured IP, port, and credential assignments.

RouterOS Scripting: Reusable Snippets & Visual Sequence Flowcharts

Replace error-prone manual CLI typing with a reusable RouterOS snippet library and visual sequence flowchart builder. Standardize repetitive tasks like firewall rule updates, interface provisioning, and routing policy adjustments with automated execution audits.

• ✓ Reusable Script Library: Store RouterOS CLI scripts once, execute them consistently across any device group — with automatic server-address substitution via [mikrowizard].
• ✓ Bulk Fleet Execution: Execute scripts against router groups with dry-run verification and detailed result logging.
• ✓ Visual Sequence Flowcharts: Build complex multi-step workflows with conditional branching and automated alert triggers.
• ✓ Task Planner Scheduling: Run periodic maintenance sequences on custom cron schedules with automatic backup generation.

Envelope-Encrypted RouterOS Password Vault & Automated Credential Rotation

Eliminate default passwords and static shared credentials across your MikroTik fleet. MikroWizard's envelope-encrypted vault generates cryptographically secure credentials and handles automated password rotation across router groups via API.

• ✓ Envelope Encryption: Each credential is encrypted with its own data key, which is wrapped by a master key (Fernet), so passwords remain unreadable at rest.
• ✓ Automated Rotation Schedules: Define automated password rotation intervals per device group to meet enterprise compliance.
• ✓ Emergency 1-Click Rotation: Instantly rotate credentials across all devices in a cluster during suspected incidents.
• ✓ Direct RouterOS API Push: Updates on-router /user passwords directly through secure API connections without manual intervention.