...
Configuration Undo and Redo
Any action done in the GUI or any command executed from the CLI is recorded in in /system history. You can undo or redo any action by running undo or redo commands from the CLI or by clicking on Undo, and Redo buttons from the GUI.
...
| Code Block | ||
|---|---|---|
| ||
[admin@v7_ccr_bgp] /ip/firewall/filter> add chain=forward action=drop
[admin@v7_ccr_bgp] /ip/firewall/filter> print
Flags: X - disabled, I - invalid; D - dynamic
0 X chain=input action=drop protocol=icmp src-address=10.155.101.1 log=no
log-prefix=""
1 chain=forward action=drop
[admin@v7_ccr_bgp] /ip/firewall/filter> /system/history/print
Flags: U - undoable, R - redoable, F - floating-undo
Columns: ACTION, BY, POLICy
ACTION BY POLIC
F filter rule added admin write
U --- write
[admin@v7_ccr_bgp] /ip/firewall/filter> |
We have added a firewall rule and in /system history we can see all that is being was done.
Let's undo everything:
...
System history is capable of showing exact CLI commands that will be executed during "Undo" or "Redo" actions even if we perform the action from GUI, for example, detailed history output after adding TCP accept rule from WinBox:
...
It is sometimes possible to change router configuration in a way that will make the router inaccessible (except from the local console). Usually, this is done by accident, but there is no way to undo the last change when the connection to the router is already cut. Safe mode can be used to minimize such risk.
The "Safe Mode" button in the Winbox GUI allows you to enter Safe Mode, while in the CLI, you can access it by either using the keyboard shortcut F4 or pressing [CTRL]+[X]. To exit without saving the made changes in CLI, hit [CTRL]+[D].
| Code Block | ||
|---|---|---|
| ||
[admin@MikroTik] ip route>[CTRL]+[X] [Safe Mode taken] [admin@MikroTik] ip route<SAFE> |
...
Now, if the telnet connection (or winbox WinBox terminal) is cut, then after a while (TCP timeout is 9 minutes) all changes that were made while in safe mode will be undone. Exiting session by [Ctrl]+[D] also undoes all safe mode changes, while /quit does not.
...
If too many changes are made while in safe mode, and there's no room in history to hold them all (currently history keeps up to 100 most recent actions), then the session is automatically put out of the safe mode, and no changes are automatically undone. Thus, it is best to change the configuration in small steps, while in safe mode. Pressing [Ctrl]+[X] twice is an easy way to empty the safe mode action list.
System Backup and Restore
System backup is the way to completely clone routers router configuration in binary format. The backup file contains not just configuration, but also statistics data, logs, etc. The backup file is used to save and restore configuration on the same device, for moving configuration to other devices, use export files instead.
| Warning |
|---|
Backup files contain sensitive information (passwords). The file can be encrypted, but even then backups should be stored only in a secure location. |
Restoring backup files should be done only on the same router. A backup must not be used to clone configuration on multiple network routers.
Example to save and load backup file:
| Code Block | ||
|---|---|---|
| ||
[admin@MikroTik] > system backup save name=test password=123
Configuration backup saved
[admin@MikroTik] > file print
# NAME TYPE SIZE CREATION-TIME
0 test.backup backup 12567 sep/08/2004 21:07:50
[admin@MikroTik] >
[admin@MikroTik] > system backup load name=test password=123
Restore and reboot? [y/N]:
y
Restoring system configuration
System configuration restored, rebooting now |
Configuration Export and Import
RouterOS allows to export and import of parts of the configuration in plain text format. This method can be used to copy bits of configuration between different devices, for example, clone the whole firewall from one router to another.
...
More information about Backup and Restore is found here.
Configuration Export and Import
RouterOS allows exporting and importing parts of the configuration in plain text format. This method can be used to copy bits of configuration between different devices, for example, clone the whole firewall from one router to another.
An export command can be executed from each menu (resulting in configuration export only from this specific menu and all its sub-menus) or from the root menu for complete config export and is available for CLI only.
| Warning |
|---|
The Export command does not export system user passwords, installed certificates, SSH keys, Dude, or a User-manager database. Installed certificates, Dude, and User-manager databases must be manually exported and imported into a new device. System user passwords and user SSH keys can not be exported. |
| Note |
|---|
During config import, we suggest using the same RouterOS version used during config export to prevent cases when some of the commands do not exist in one or another RouterOS version. |
Configuration Export
The following command parameters are accepted:
| Property | Description |
|---|---|
| compact | Output only modified configuration, the default behavior |
| file | Export configuration to a specified file. When the file is not specified export output will be printed to the terminal |
show-sensitive (yes|no; Default: no). RouterOS version 7 only hide-sensitive (yes|no; Default: |
no). RouterOS version 6 only | Show sensitive information, like passwords, keys, etc. Hide sensitive information, like passwords, keys, etc. |
| terse | With this parameter, the export command will output only configuration parameters, without defaults. |
| verbose | With this parameter, the export command will output whole configuration parameters and items including defaults. |
...
For example, export configuration from /ip address the menu and save it to a file:
| Code Block | ||
|---|---|---|
| ||
[admin@MikroTik] > /ip address print
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK BROADCAST INTERFACE
0 10.1.0.172/24 10.1.0.0 10.1.0.255 bridge1
1 10.5.1.1/24 10.5.1.0 10.5.1.255 ether1
[admin@MikroTik] > /ip address export file=address
[admin@MikroTik] > /file print
# NAME TYPE SIZE CREATION-TIME
0 address.rsc script 315 dec/23/2003 13:21:48
[admin@MikroTik] > |
By default, the export command writes only user-edited configuration, RouterOS defaults are omitted.
...
| Code Block | ||
|---|---|---|
| ||
[admin@rack1_b4] /ip ipsec policy> print
Flags: T - template, X - disabled, D - dynamic, I - inactive, * - default
0 T * group=default src-address=::/0 dst-address=::/0 protocol=all
proposal=default template=yes
[admin@rack1_b4] /ip ipsec policy> export
# apr/02/1970 17:59:14 by RouterOS 6.22
# software id = DB0D-LK67
#
[admin@rack1_b4] /ip ipsec policy> set 0 protocol=gre
[admin@rack1_b4] /ip ipsec policy> export
# apr/02/1970 17:59:30 by RouterOS 6.22
# software id = DB0D-LK67
#
/ip ipsec policy
set 0 protocol=gre |
| Info | ||
|---|---|---|
| ||
The * flag, it indicates that the entry is system default and cannot be removed manually. |
...
| Warning |
|---|
If some specific menu will not be able to respond to the export command, starting from the RouterOS v7.11, an error message will be printed out in the export command output after a timeout ("#error exporting "/xxx" (timeout)") and the process will move on to the next menu.process will move on to the next menu. |
Starting from RouterOS 7.13, you can export parts of a specific menu. For instance, it is possible to export a specific address-list among multiple address-lists on your router.
[admin@MikroTik] > ip firewall address-list export where list=mylist
Configuration Import
Root menu command import allows running configuration script from the specified file. Script file (with extension ".rsc") can contain any console command including complex scripts.
...
Import command allows to specify the following parameters:
| Property | Description |
|---|---|
| from-line | Start executing the script from the specified line number |
| file-name | Name of the script (.rsc) file to be executed. |
| verbose | Reads each line from the file and executes individually, allowing to debug syntax or other errors more easily. |
| Tip |
|---|
In If the event that the device has a default or existing configuration that requires replacement, it is necessary to initiate a configuration reset. This involves applying a clean, empty configuration using the command /system/reset-configuration no-defaults=yes, followed by a device reboot. |
...
Things that should be removed from export files that were created with "/export", before attempting import on a new device.
- Interface renaming is in conflict conflicts with the default ethernet naming scheme.
| Code Block | ||
|---|---|---|
| ||
/interface ethernet set [ find default-name=ether5 ] auto-negotiation=no name=ether1-gateway set [ find default-name=ether6 ] name=ether2 set [ find default-name=ether7 ] name=ether3 set [ find default-name=ether8 ] name=ether4 set [ find default-name=ether1 ] name=ether5 set [ find default-name=ether2 ] name=ether6 set [ find default-name=ether3 ] name=ether7 set [ find default-name=ether4 ] name=ether8 |
- In older version exports versions "export" default entries might show with "add" instead of the "set" command. That should be edited before import to avoid errors.
- Check if the total number of physical interfaces count matches the new and old devices. If there will are some missing that will end up in error during .rsc import.
...
- Reset the configuration on that device.
- Run the import command again with the "verbose=yes" argument. It will stop also stop the import process on a problem that you already encountered, but will also show the place where the export failed. That This way showing shows you the place where things need to be edited in the .rsc import file.
...
This command clears all configuration of the router and sets it to the factory defaults including the login name and password ('admin' with an empty password or, for some models, check user and wireless passwords on the sticker). For more details on the default configuration see the list.
After executing the configuration reset command is executed router will reboot and load the default configuration, the router will reboot and load the default configuration. Starting from version 7.13, following the reset, a license prompt will be displayed with the option to view the end-user license agreement.
| Tip |
|---|
The backup file of the existing configuration is stored before reset. That way you can easily restore any previous configuration if the reset is done by mistake. |
| Warning |
|---|
If the router has been was installed using Netinstall and had a script specified as the initial configuration, the reset command executes this script after purging the configuration. To stop it from doing so, you will have to reinstall the router. |
...
| Property | Description | ||
|---|---|---|---|
| keep-users | Do not remove existing users from the configuration | ||
| no-defaults | Do not load the default configuration, just clear the configuration | ||
| skip-backup | Skip automatic backup file generation before reset | ||
| run-after-reset | Run specified .rsc file after reset. That way you can load your custom configuration.
|
For example hard reset configuration without loading default config and skipping backup file:
...
And the same using Winbox:
