Berikut adalah panduan cepat dan perintah dasar untuk konfigurasi MikroTik RouterOS v7.x.
CLI Navigation & Basics
| Command | Description |
/ | Move to root menu |
.. | Move up one menu level |
/menu/submenu | Navigate to specific menu |
? | Display available commands and arguments |
Tab | Auto-complete commands |
Ctrl+X | Enable safe mode |
Ctrl+C | Cancel current operation |
Ctrl+D | Logout |
Universal Commands
| Command | Description |
print | Display items from current menu |
print detail | Display detailed information |
print where <condition> | Filter output by condition |
add | Create new item |
set <id> | Modify existing item |
remove <id> | Delete item |
find | Locate items matching criteria |
edit <id> | Open text editor for item |
move <id> | Reorder items in list |
enable <id> | Enable item |
disable <id> | Disable item |
comment <id> | Add comment to item |
IP Addressing
IPv4 Address Configuration
# Add IPv4 address
/ip address add address=192.168.88.1/24 interface=ether1
# View all addresses
/ip address print
# View detailed address information
/ip address print detail
# Remove address
/ip address remove [find where address="192.168.88.1/24"]
# Disable address
/ip address disable [find where address="192.168.88.1/24"]
IPv6 Address Configuration
# Add IPv6 address
/ipv6 address add address=2001:DB8::1/64 interface=ether1 advertise=no
# Add with EUI-64 auto-generation
/ipv6 address add address=2001:DB8::1/64 interface=ether1 eui-64=yes
# View IPv6 addresses
/ipv6 address print
Routing
Static Routes
# Add static route
/ip route add dst-address=192.168.2.0/24 gateway=172.16.1.2
# Add default route (gateway to internet)
/ip route add gateway=172.16.1.1
/ip route add dst-address=0.0.0.0/0 gateway=172.16.1.1
# View routes
/ip route print
# View only static routes
/ip route print where static
# View routing table (read-only)
/routing route print
# Remove route
/ip route remove [find where dst-address="192.168.2.0/24"]
# Disable hardware offloading for routes
/ip route set [find where static] suppress-hw-offload=yes
Interface Configuration
Basic Interface Management
# View all interfaces
/interface print
# Enable/disable interface
/interface enable ether1
/interface disable ether1
# Set interface comment
/interface set ether1 comment="WAN Interface"
# Monitor interface traffic
/interface monitor-traffic ether1
Bridge Configuration
# Create bridge
/interface bridge add name=bridge1
# Add ports to bridge
/interface bridge port add interface=ether2 bridge=bridge1
/interface bridge port add interface=ether3 bridge=bridge1
# View bridge configuration
/interface bridge print
/interface bridge port print
# Enable VLAN filtering on bridge
/interface bridge set bridge1 vlan-filtering=yes
VLAN Configuration
# Add VLAN interface
/interface vlan add name=vlan10 vlan-id=10 interface=ether1
# Configure bridge VLAN (tagged)
/interface bridge vlan add bridge=bridge1 tagged=ether1 vlan-ids=20
# Configure bridge VLAN (untagged)
/interface bridge vlan add bridge=bridge1 untagged=ether2 vlan-ids=10
# Admit only VLAN-tagged frames
/interface bridge port set [find interface=ether1] frame-types=admit-only-vlan-tagged
DHCP Configuration
DHCP Server
# DHCP server setup wizard
/ip dhcp-server setup
# Manual DHCP server configuration
/ip pool add name=dhcp-pool ranges=192.168.88.10-192.168.88.254
/ip dhcp-server add name=dhcp1 interface=bridge1 address-pool=dhcp-pool disabled=no
/ip dhcp-server network add address=192.168.88.0/24 gateway=192.168.88.1 dns-server=8.8.8.8,8.8.4.4
# View DHCP leases
/ip dhcp-server lease print
# Make lease static
/ip dhcp-server lease make-static [find where address="192.168.88.50"]
# Add static lease
/ip dhcp-server lease add address=192.168.88.100 mac-address=00:11:22:33:44:55 server=dhcp1
DHCP Client
# Add DHCP client on WAN interface
/ip dhcp-client add disabled=no interface=ether1
# View DHCP client status
/ip dhcp-client print detail
# Release and renew DHCP lease
/ip dhcp-client release [find interface=ether1]
/ip dhcp-client renew [find interface=ether1]
Firewall & NAT
Firewall Filter Rules
# Accept established and related connections
/ip firewall filter add chain=input connection-state=established,related action=accept
# Drop invalid connections
/ip firewall filter add chain=input connection-state=invalid action=drop
# Accept ICMP (ping)
/ip firewall filter add chain=input protocol=icmp action=accept
# Accept from LAN
/ip firewall filter add chain=input in-interface=bridge1 action=accept
# Drop all other input
/ip firewall filter add chain=input action=drop
# Forward established/related
/ip firewall filter add chain=forward connection-state=established,related action=accept
# Drop invalid forward
/ip firewall filter add chain=forward connection-state=invalid action=drop
# View firewall rules
/ip firewall filter print
NAT (Network Address Translation)
# Masquerade (source NAT for internet sharing)
/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade
# Port forwarding (destination NAT)
/ip firewall nat add chain=dstnat dst-port=80 protocol=tcp in-interface=ether1 action=dst-nat to-addresses=192.168.88.10 to-ports=80
# View NAT rules
/ip firewall nat print
Troubleshooting & Diagnostics
# Basic ping
/ping 8.8.8.8
# Traceroute
/tool traceroute 8.8.8.8
# Monitor traffic on interface (Torch)
/tool torch interface=ether1
# Monitor interface statistics
/interface monitor-traffic ether1
Resources & Documentation
