routeros documentation
routeros is a thick, friendly layer over the MikroTik RouterOS API for the Jennifer language. Each guide below covers one topic file of the module with background, the full function surface, worked examples, and the pitfalls the abstraction protects you from.
Conventions used in every guide
All snippets assume an established connection:
import "@jennifer/routeros/" as mt;
def c as mt.Client init mt.connect("192.168.88.1", "admin", "secret");
# ... snippets go here ...
mt.disconnect($c);Errors: every validation failure raised by routeros is an Error{kind: "routeros"} with a human-readable message; errors coming from the router or the wire are Error{kind: "mikrotik"}. Catch either with try { ... } catch (e) { io.printf("%s\n", $e.message); }.
Verbose mode: $c = mt.setVerbose($c, true); prints every command the client sends to stdout (mt> /ip/address/add address=... interface=...), with credentials redacted - see core.md. It returns a copy, so keep the returned client. MT_VERBOSE=1 in the environment turns it on at connect time without touching the script.
Ids: RouterOS gives every list item an internal id like "*3". The add* functions return it, the typed structs carry it in .id, and the generic verbs accept it. Most routeros helpers let you use a name or a comment instead, so you rarely touch ids directly.
The condensed, everything-on-one-page reference is cheatsheet.md. For the RouterOS side itself - every menu, property, and behavior these topics wrap - see MikroTik's official RouterOS documentation.
Guides
| Guide | Covers |
|---|---|
| cheatsheet.md | the whole API surface on one page |
| core.md | connecting, the generic add/set/remove verbs, shared validation |
| interfaces.md | listing, enabling, renaming physical and virtual interfaces |
| interfacelist.md | interface lists: WAN/LAN groups for firewall matching |
| lte.md | LTE / cellular uplink: signal, APN, backup WAN |
| ethernet.md | port settings: speed, duplex, MTU, PoE, link state |
| bonding.md | link aggregation: LACP trunks, failover bundles |
| bridges.md | bridges and bridge ports (virtual switches) |
| switch.md | switch chip: hardware offload inventory and verification |
| vlans.md | 802.1Q tagged interfaces |
| firewall.md | filter rules: the builder, comment handles, shortcuts |
| nat.md | masquerade and port forwarding |
| upnp.md | UPnP: LAN devices open their own port forwards |
| trafficflow.md | NetFlow / IPFIX export to a collector |
| raw.md | firewall raw: pre-conntrack drop / notrack |
| addresslist.md | firewall address lists: one rule, living list |
| mangle.md | packet marking: queue marks, policy routing, MSS clamp |
| contrack.md | connection tracking: the live connection table |
| ip.md | IP addresses on interfaces |
| ipv6.md | IPv6: the stack switch, addresses, router advertisements |
| arp.md | the ARP table: who is on the LAN, pinned bindings |
| neighbor.md | neighbor discovery: what is on this segment (LLDP/CDP/MNDP) |
| dhcp.md | DHCP server, leases, and the WAN-side DHCP client |
| ppp.md | PPPoE dial-in WAN (DSL/fiber) |
| hotspot.md | the captive guest portal: vouchers, bypass, walled garden |
| vpn.md | remote-access VPN: L2TP, SSTP, OpenVPN, IKEv2, PPP users |
| dns.md | resolver settings and static DNS entries |
| routing.md | static routes and the default route |
| queues.md | bandwidth limiting with simple queues |
| wireless.md | WiFi: SSIDs, passwords, guest networks, clients (classic menu) |
| wifi.md | modern WiFi (wifiwave2/ax, RouterOS v7) |
| wireguard.md | WireGuard VPN tunnels (RouterOS v7) |
| eoip.md | EoIP: one LAN across two sites |
| gre.md | GRE: routed site-to-site links, any vendor |
| ipsec.md | IPsec: standards-based site-to-site, multi-vendor |
| vrrp.md | VRRP: two routers, one gateway, automatic failover |
| tools.md | ping, bandwidth test, fetch, e-mail alerting |
| sms.md | text messages over the cellular modem |
| netwatch.md | continuous host monitoring with on-change scripts |
| scheduler.md | scripts on a timer |
| script.md | the stored-script repository (run by name) |
| users.md | router accounts, groups, active sessions |
| services.md | management services: hardening the ways in |
| certificates.md | TLS: self-signed, Let's Encrypt, the acme flow |
| clock.md | clock and NTP: a router that knows what time it is |
| files.md | files and configuration backups |
| disk.md | storage devices: list, format, eject |
| cloud.md | MikroTik Cloud DDNS: a stable name for a dynamic WAN |
| snmp.md | SNMP: plug the router into monitoring |
| radius.md | RADIUS: central authentication for logins/VPN/hotspot |
| health.md | system health: temperature, voltage, fans |
| container.md | run OCI containers on the router (v7) |
| capsman.md | CAPsMAN: central management of many access points |
| log.md | reading the router log, routing what gets logged |
| system.md | packages, updates, firmware, reboot |
One runnable example per topic lives in ../examples/ (MT_HOST=... MT_USER=... MT_PASSWORD=... jennifer run examples/<topic>.j).
Disclaimer
MikroTik and RouterOS are trademarks of SIA Mikrotīkls. routeros is an independent, community-written client library, not affiliated with, endorsed, or supported by SIA Mikrotīkls - and it configures live network equipment. Use at your own risk; no warranty of any kind.
Licensed under the GNU LGPL v3.0 only - see ../LICENSE.
Running the tests
jennifer test src/routeros_test.jThe white-box overlay exercises everything network-free: validators, row folding, builders, and normalization. Functions that need a live router are thin compositions of those tested helpers.