NettPortal
Documentation

Documentation

Router Settings

The Router Settings page in NettPortal provides a comprehensive interface for configuring all MikroTik RouterOS settings on your routers. Whether you need to configure basic network settings, security, wireless, bandwidth management, or advanced features, this guide covers everything you need to know. Even if you're not technical, we'll explain everything in simple terms.

🎯 What is Router Settings?

Router Settings is a powerful centralized management interface that allows you to configure all aspects of your MikroTik routers without manually accessing each router. You can configure one router at a time, or select multiple routers to apply the same settings to all of them at once. All settings are validated before applying, and the system includes automatic error detection and fixing capabilities.

Getting Started

  1. Navigate to Routers from the main menu
  2. Click the Settings button (found in the top right of the Router List page, or in the Router Details page)
  3. Select one or more routers from the Select Routers section
  4. Choose the appropriate settings tab (Basic Network, Security, DNS & Time, etc.)
  5. Configure your settings and click Apply Settings
  6. Review the confirmation and summary modals before finalizing

💡 Tip: Multiple Router Configuration

You can select multiple routers at once and apply the same settings to all of them simultaneously. This is perfect for bulk configuration changes, network-wide updates, or applying standard settings across your entire router fleet. The system will show you a summary of what will be applied to each router before confirming.

Available Settings Tabs

The Router Settings page is organized into the following tabs, each covering a specific area of router configuration:

🌐 Basic Network

Configure fundamental network connectivity settings including WAN interface, bridge configuration, and DHCP server.

WAN Interface Configuration

  • Interface Selection: Choose which interface connects to your ISP (typically ether1)
  • DHCP Client Mode: Automatically obtain IP address, gateway, and DNS from your ISP
  • Static IP Mode: Manually configure IP address, gateway, and network settings
  • Use Peer DNS/NTP: Automatically use DNS and NTP servers provided by your ISP

Bridge Configuration

  • Bridge Name: Name of the bridge interface (default: Hotspot-bridge)
  • Bridge IP Address: IP address assigned to the bridge (e.g., 192.168.90.1/24)
  • Bridge Ports: Select which physical interfaces (ether2, ether3, etc.) should be part of the bridge

⚠️ Important: Bridge Ports

After creating a bridge, you must add physical interfaces (ports) to it. Without ports, the bridge won't work and clients won't be able to connect. Typically, you add all LAN interfaces (ether2, ether3, etc.) to the bridge, but NOT the WAN interface (ether1).

DHCP Server Configuration

  • Enable/Disable: Turn DHCP server on or off
  • IP Pool: Select which IP address pool to use for client assignments
  • Gateway: Default gateway IP address (usually the bridge IP)
  • DNS Servers: DNS servers to provide to DHCP clients (comma-separated)

🔧 Auto-Fix Warnings

If the system detects missing NAT/masquerade rules or DHCP configuration issues, an "Auto-Fix Warnings" button will appear. Click it to automatically fix these issues without manual intervention.

🔒 Security & Access

Manage router security, service access control, admin users, and firewall rules to protect your network.

Service Access Control

Enable or disable RouterOS services and restrict access by IP address:

  • API: Required for NettPortal (port 8728) - Cannot be disabled
  • API-SSL: Secure API access (port 8729)
  • SSH: Secure shell access (port 22)
  • Telnet: Unencrypted terminal access (port 23)
  • FTP: File transfer protocol (port 21)
  • Winbox: MikroTik management tool (port 8291)
  • WWW/Webfig: Web interface (ports 80/443)

For each service, you can specify allowed IP addresses (comma-separated) to restrict access. Leave empty to allow from any IP. The system automatically adds your WireGuard subnet to API service restrictions to ensure NettPortal can always connect.

Admin User Management

Change the default 'admin' user password or create new admin users:

  • Username: Select which admin user to modify
  • New Password: Set a new password (must be at least 8 characters)
  • Confirm Password: Re-enter the password to confirm

⚠️ Warning: Password Changes

Changing the admin password will affect all management access. Make sure you remember the new password, as losing it may require physical router access to reset.

Firewall Rules

Add, edit, or remove firewall filter rules for network security:

  • Chain: Input, forward, or output chain
  • Action: Accept, drop, reject, or other actions
  • Protocol: TCP, UDP, ICMP, or all protocols
  • Source/Destination Address: IP addresses or networks
  • Ports: Source or destination ports
  • Interface: Incoming or outgoing interface
  • Comment: Optional description for the rule

🕐 DNS & Time

Configure DNS resolution, time synchronization, and timezone settings for accurate network time and name resolution.

DNS Configuration

  • DNS Servers: Primary and secondary DNS servers (comma-separated, e.g., 8.8.8.8,4.2.2.2)
  • Allow Remote Requests: Allow external devices to query this router's DNS
  • Cache Size: DNS cache size (default: 2048KiB)
  • Max TTL: Maximum time-to-live for cached entries (default: 7d)
  • Query Timeouts: Server and total timeout settings
  • UDP Packet Size: Maximum UDP packet size for DNS queries
  • Concurrent Queries/TCP Sessions: Limits for simultaneous DNS operations

💡 DNS-DHCP Synchronization

When you change DNS servers, the system automatically updates the DHCP server configuration to provide the same DNS servers to DHCP clients. This ensures consistency across your network.

NTP Client Configuration

  • Enable NTP: Turn on Network Time Protocol synchronization
  • Primary NTP Server: Primary time server (e.g., pool.ntp.org)
  • Secondary NTP Server: Backup time server (e.g., time.google.com)

Timezone Configuration

  • Auto-Detect: Automatically detect timezone from router location
  • Manual Selection: Manually select timezone from a list

📶 Wireless

Configure wireless interfaces, SSID, security, and wireless protocol settings for WiFi access points.

Wireless Interface Configuration

  • Interface Selection: Choose which wireless interface to configure
  • Enable/Disable: Turn wireless interface on or off
  • Mode: Access point (ap-bridge) or station mode
  • SSID: Wireless network name
  • Band: 2.4GHz or 5GHz frequency band
  • Channel: Specific WiFi channel (auto if not specified)
  • Country: Regulatory domain for compliance
  • Channel Width: 20MHz, 40MHz, or 80MHz
  • Wireless Protocol: 802.11 standard (b/g/n/ac/ax)

Security Profile Configuration

  • Profile Name: Name for the security profile
  • Authentication Types: WPA2-PSK, WPA3-PSK, or both
  • WPA2 Passphrase: Password for WPA2 networks (minimum 8 characters)
  • WPA3 Passphrase: Password for WPA3 networks (minimum 8 characters)
  • Mode: Dynamic keys or static keys

⚡ Bandwidth & Queue

Configure bandwidth limits, traffic prioritization, and queue management for controlling network traffic and ensuring fair bandwidth distribution.

Simple Queue Configuration

  • Queue Name: Name for identifying the queue
  • Target: IP address, IP range, or interface to apply the queue to
  • Max Limit Download: Maximum download speed (e.g., 10M)
  • Max Limit Upload: Maximum upload speed (e.g., 5M)
  • Priority: Traffic priority (1-8, where 8 is highest priority)
  • Burst Configuration: Enable burst limits for temporary speed boosts
  • Burst Limits: Download and upload burst speeds
  • Burst Threshold: Speed threshold to trigger burst
  • Burst Time: Duration of burst allowance
  • Parent Queue: Optional parent queue for hierarchical bandwidth sharing
  • Enable/Disable: Turn queue on or off
  • Comment: Optional description

🌐 Hotspot & PPPoE

Configure Hotspot captive portal and PPPoE server settings for user authentication and connection management.

Hotspot Server Configuration

  • Server Name: Hotspot server identifier (default: hotspot1)
  • Interface: Interface to run Hotspot on (typically the bridge)
  • Address Pool: IP pool for Hotspot users
  • Profile: Default Hotspot profile
  • Addresses Per MAC: Number of IP addresses per MAC address (default: 1)
  • Enable/Disable: Turn Hotspot server on or off

Hotspot Profile Configuration

  • Profile Name: Name for the profile
  • Hotspot Address: IP address for the Hotspot portal
  • DNS Name: DNS name for the Hotspot portal
  • HTML Directory: Directory containing Hotspot HTML pages

PPPoE Server Configuration

  • Service Name: PPPoE service identifier
  • Interface: Interface to run PPPoE server on
  • Default Profile: Default PPPoE profile for users without a specific profile
  • One Session Per Host: Allow only one PPPoE session per host MAC address. Prevents multiple connections from the same device.
  • Max MTU: Maximum MTU (Maximum Transmission Unit) size in bytes. Default: 1480 for PPPoE.
  • Max MRRU: Maximum MRRU (Maximum Receive Reconstructed Unit) size. Used for multilink PPPoE.
  • MRRU: MRRU (Maximum Receive Reconstructed Unit) size for multilink connections.
  • Keepalive Timeout: Timeout for PPPoE keepalive packets. Keeps connections alive during inactivity.
  • Max Sessions: Maximum number of concurrent PPPoE sessions allowed on the server.
  • PADO Delay: Delay before sending PADO (PPPoE Active Discovery Offer) response, in milliseconds.
  • Enable/Disable: Turn PPPoE server on or off

💡 PPPoE Server Settings

These settings control how the PPPoE server accepts and manages connections. Most settings use router defaults unless you need specific configurations. See PPPoE Profile Management for per-user settings like bandwidth, data limits, and IP configuration.

PPPoE Profile Configuration

  • Profile Name: Name for the profile
  • Local Address: Local IP address for PPPoE connections
  • Remote Address: Remote IP address pool (or 'dhcp' for dynamic)
  • Rate Limit: Bandwidth limit string (e.g., 10M/5M)
  • Idle Timeout: Disconnect idle connections after this time
  • Use MPLS: Enable MPLS support
  • Use Compression: Enable data compression

⚙️ Advanced

Configure advanced RouterOS features including firewall mangle rules, static routes, system administration, VPN servers, and advanced queue management.

Firewall Advanced

  • Disable Hotspot Sharing: Prevent hotspot users from sharing their connection
  • Enable FastTrack: Enable fast connection tracking for better performance
  • Address Lists: Create lists of IP addresses for firewall rules
  • Mangle Rules: Create packet marking rules for advanced traffic control

Static Routes

  • Destination Address: Network or IP address to route to
  • Gateway: Gateway IP address for the route
  • Interface: Optional interface for the route
  • Distance: Route priority/distance
  • Comment: Optional description

System Admin

  • Logging: Configure system logging (action, topics, prefix)
  • Scheduler: Create scheduled tasks/scripts (start date, time, interval, on-event script)
  • Backup: Configure automatic configuration backups (interval, name)

VPN Servers

  • PPTP Server: Configure PPTP VPN (max MRRU, default profile)
  • L2TP Server: Configure L2TP VPN (max MRRU, default profile)
  • SSTP Server: Configure SSTP VPN (certificate, default profile)
  • OpenVPN Server: Configure OpenVPN (certificate, port, protocol)
  • IPSec: Configure IPSec VPN (peer configuration)

Queue Advanced

  • Queue Tree: Create hierarchical queue trees (parent, packet mark, limits, priorities)
  • PCQ Types: Configure Per Connection Queue types (dst-limit, src-limit, total-limit, burst settings)

Auto-Fix Functionality

All settings tabs include an Auto-Fix Errors button that appears when configuration errors are detected. This feature automatically fixes common issues such as:

  • "Item not found" errors: Automatically recreates missing configuration entries
  • Missing NAT/masquerade rules: Creates required NAT rules for internet access
  • DHCP configuration issues: Fixes DHCP server and pool configurations
  • Service configuration errors: Recreates missing or corrupted service entries
  • DNS configuration issues: Fixes DNS server and cache settings
  • Wireless interface problems: Enables disabled interfaces and assigns security profiles
  • Queue configuration errors: Recreates missing queue entries
  • VPN server issues: Verifies and fixes VPN server configurations

✅ How Auto-Fix Works

When you click "Auto-Fix Errors", the system analyzes the errors, identifies what needs to be fixed, and automatically applies the fixes. A summary is shown after the fix operation completes, detailing what was fixed and any remaining issues. The settings are then reloaded to reflect the changes.

Best Practices

🔒 Security Best Practices

  • Always change default admin passwords immediately after router setup
  • Disable unused services (Telnet, FTP, WWW) to reduce attack surface
  • Restrict service access to specific IP addresses when possible
  • Keep API service enabled and restricted to WireGuard subnet for NettPortal access
  • Regularly review and update firewall rules
  • Use strong passwords (minimum 8 characters, mix of letters, numbers, and symbols)

🌐 Network Configuration Best Practices

  • Always add physical interfaces to bridges after creating them
  • Ensure NAT/masquerade rules are properly configured for internet access
  • Use static IP addresses for critical network devices
  • Configure proper DNS servers for reliable name resolution
  • Enable NTP client for accurate time synchronization
  • Test settings on one router before applying to multiple routers

⚡ Bandwidth Management Best Practices

  • Set realistic bandwidth limits based on your connection capacity
  • Use parent queues for shared bandwidth scenarios
  • Configure burst limits to allow temporary speed boosts
  • Set appropriate priorities for different types of traffic
  • Monitor queue usage and adjust limits as needed

📋 General Best Practices

  • Review the confirmation modal carefully before applying settings
  • Check the summary modal after applying to verify success
  • Use the auto-fix feature when errors are detected
  • Backup router configuration before making major changes
  • Test changes during low-traffic periods when possible
  • Document any custom configurations for future reference

Troubleshooting

❌ "Item not found" Errors

If you see "Item not found" errors when applying settings:

  • Click the Auto-Fix Errors button in the summary modal
  • The system will automatically recreate missing configuration entries
  • If errors persist, check router connectivity and ensure the router is provisioned

🔌 Bridge Not Working

If clients can't connect after creating a bridge:

  • Ensure physical interfaces are added to the bridge
  • Check that the bridge has an IP address assigned
  • Verify DHCP server is enabled and configured on the bridge
  • Ensure NAT/masquerade rules are configured for internet access

🌐 No Internet Access

If clients can't access the internet:

  • Check WAN interface configuration (DHCP client or static IP)
  • Verify NAT/masquerade rules exist and are enabled
  • Ensure default route is configured
  • Check DNS server configuration
  • Use the auto-fix feature to automatically create missing NAT rules

🔒 Router Lockout

If you're locked out of router management:

  • The system prevents disabling API service to avoid lockout
  • WireGuard subnet is automatically added to API service restrictions
  • If locked out, you may need physical access to reset the router
  • Always verify service access settings before applying

Summary

The Router Settings page provides comprehensive control over all MikroTik RouterOS configuration options. With support for multiple router configuration, automatic error detection and fixing, and intuitive organization into logical tabs, managing your router fleet has never been easier.

🎉 Key Features

  • Configure one or multiple routers simultaneously
  • Seven main tabs covering all RouterOS settings
  • Advanced tab with five sub-tabs for specialized configuration
  • Automatic error detection and fixing
  • Settings validation before applying
  • Confirmation and summary modals for safety
  • Real-time settings loading from routers
  • Tooltips and help text for all settings
Advanced Routeros - Documentation - NettPortal