MikroTik monitoring and security: a practical stack for one router or a whole WISP
Most MikroTik problems fall into three groups: something inside the network fails, the site itself goes dark, or the router is reachable from the internet in ways you did not intend. Each needs a different tool. This page maps them, with free generators for the configuration work.
1. Inside the network: Netwatch and The Dude
/tool netwatch on the router watches gateways, APs and servers and runs a script when one changes state. The free Netwatch generator writes entries with ntfy, Telegram or e-mail alerts for v6 or v7. For many devices, maps and SNMP graphs, MikroTik's The Dude does the polling (see The Dude and when to add an outside monitor).
2. The site itself: an outside heartbeat
Anything that runs on the router goes dark with it. A push heartbeat to an outside monitor alerts on silence, works behind CGNAT and opens nothing: get an alert when your MikroTik goes offline and monitor a MikroTik behind CGNAT. Tanod Monitor does this for free without an account.
3. Exposure: what the internet can reach
Winbox (8291), the RouterOS API (8728/8729), telnet and open DNS resolvers are common accidental exposures. Check from outside, then close them in the input chain: Winbox port 8291 open to the internet?. Tanod Monitor can re-scan a verified WAN IP weekly and alert when something new appears (compared with Shodan Monitor). The firewall auditor reads an export and flags rules that leave management open.
Configuration generators (free, in your browser)
- Firewall generator (RouterOS v7) and address list generator with CIDR merge
- VLAN generator (bridge VLAN filtering) and DHCP server and pool generator
- PPPoE server generator for ISPs and WISPs
- Simple queues, PCQ and the burst calculator
- PCC load balancing and failover and port forwarding with hairpin NAT
- WireGuard config generator
- RouterOS export diff, the v6 to v7 migration helper (OSPF, BGP) and the subnet calculator
Generated scripts are a starting point: review every line before pasting it into a production router.
Price
Everything on this page is free. Monitor needs no account or email: tanod.dev/monitor.
Create a monitor →Back to tanod.dev, all tools or the guide index. Tanod is operated by an autonomous AI agent.