How to Reset a MikroTik Router and Reconfigure It

In Depth

In Depth

A reset wipes a MikroTik router back to its default configuration, or to nothing at all. Done well it takes twenty minutes; done in a hurry it erases your ISP login, Wi-Fi and firewall, so back up first and know which reset you need.

Warning A reset erases the whole configuration: ISP login, VLANs, Wi-Fi, port forwards, VPNs, hotspot and firewall rules. Export and back up first. If the internet has simply stopped, work through MikroTik internet connection problems before you reset anything.

Reboot, reset, Netinstall or restore?

MikroTik is clear that a forgotten password cannot be recovered. The supported routes are a configuration reset or a Netinstall, both of which erase the configuration. Only do this on equipment you own or manage.

Back up before you touch the button

Make two copies. /export file=before-reset writes a readable script you can open in a text editor and copy settings from. /system backup save name=before-reset password=… makes an encrypted binary backup. MikroTik says a backup restores reliably only on the device it was made on, and on the same RouterOS version, because it contains the device's MAC addresses. On RouterOS 7 the export hides passwords and keys unless you add show-sensitive, and it never includes user passwords, certificates or SSH keys. Download both files from WinBox's Files window to your laptop. Backups contain passwords and keys, so store them safely.

The software reset makes its own backup unless you choose skip-backup, but that file stays on the router you are rebuilding.

The reset button, as MikroTik documents it

What happens depends on when you press and how long you hold. MikroTik's RouterOS configuration reset page describes:

• Press and hold before applying power, release after about 3 seconds: loads the backup RouterBOOT loader. It is for recovery after a failed RouterBOOT upgrade.
• Hold while applying power, release when the LED starts flashing: resets the RouterOS configuration to defaults. MikroTik gives no fixed number of seconds for this; watch the LED.
• Keep holding about 5 more seconds after the flashing starts, until the LED turns solid: release to enable CAPs mode, where the device looks for a CAPsMAN controller.
• Keep holding until the LED turns off (blinking, then solid, then off): release for Netinstall. The device waits for a Netinstall server.

The solid-LED stage is never the normal default configuration. On wireless models such as the hAP ax² and hAP ac², the hardware manuals call it CAP mode. The hEX and RB4011 manuals, for wired routers, say it clears all configuration and bridges all interfaces. MikroTik's CAP default configuration is similar: ether1 becomes a management port with a DHCP client and the other Ethernet ports are bridged. So if you release at the solid LED you lose the router's firewall and NAT set-up, and you should reset again. The hEX and RB4011 manuals give about 20 seconds for the Netinstall stage. Read the manual for your exact model. Very old boards such as the RB750, RB751 and RB951 had a reset jumper hole under a rubber foot instead; leaving that jumper closed clears the configuration on every boot.

Resetting from WinBox or the terminal

If you can still log in, System > Reset Configuration or /system reset-configuration is cleaner than the button. In WinBox 4 the dialog shows Keep users, Keep apps, CAPS Mode, No Default Configuration, Do Not Backup and Run After Reset. The documented command options are:

MikroTik's own first-time guide says removing the default configuration is only for advanced users, because it also removes the built-in security rules. If a Netinstall configuration script was used when the router was installed, a reset runs that script again.

Warning Never reset a router you reached over the internet or a VPN. The default configuration blocks management from the WAN side, so you will lose the connection and someone will have to visit the site.

What you get after a reset

MikroTik applies a default configuration that depends on the device type. You can always see it with /system default-configuration print.

Earlier MikroTik models use the user admin with no password. Later models are made with a unique default password for each device, printed on the serial number sticker, on the box and on the quick guide sheet. A standard reset puts that same password back, so photograph the label before you mount the router. If the sticker is missing, MikroTik says to ask the distributor that supplied the router, giving the serial number.

RouterOS v6 or v7

Check the version under System > Resources first:

• Wi-Fi menus. RouterOS 7.13 and later manage Wi-Fi 5 wave2 and Wi-Fi 6 radios in the WiFi menu (/interface wifi, with the wifi-qcom or wifi-qcom-ac package). Older radios stay on the legacy Wireless menu (/interface wireless). Follow the menu your router actually shows.
• Upgrading from v6. You cannot jump to the newest v7 in one go. MikroTik says to choose the "upgrade" channel, install the intermediate v7.12.1 first, then check for updates again.
• Bootloader. After any RouterOS update, run System > RouterBOARD > Upgrade and reboot.
• WinBox. WinBox 4 runs natively on Windows, macOS and Linux and has a newer layout; the menu names in this guide are the same.

Firewall, DNS and the password

Keep the default firewall. Its input rules protect the router and its forward rules protect the devices behind it. Add specific rules for port forwards rather than deleting the defaults.

DNS is set under IP > DNS. "Allow Remote Requests" lets LAN devices use the router as their DNS server. MikroTik advises limiting port 53 to known hosts, which the default firewall does by dropping input from the WAN; if you have removed those rules, you have an open DNS resolver.

Set a long, unique admin password immediately. Better still, create a named full-access user, test it, then remove admin. In Zanzibar, keep the router on a UPS during the update: a power cut mid-upgrade is a common reason for needing Netinstall.

When to call Extrion

If the router runs a hotel, office or multi-site network, has VLANs, VPNs or a hotspot, or you have no backup, let an engineer plan the rebuild so the business is not offline while you guess. Extrion can configure and document MikroTik routers as part of our networking, Wi-Fi and cabling service, or contact us with your model and RouterOS version.

This guide is general information. Procedures, product features and firmware change, so check your own equipment's documentation before you start.