MikroTik Configuration Generator

Terminal-ready generator

Build a clean router configuration.

Set the network values. The safe, readable script updates live beside you.

Non-destructiveNo reset or delete commands

CONFIGURATION

Router settings

Router & WAN

Router identitysystem name

WAN mode

WAN interfaceinternet port

Local network

LAN bridge

LAN gatewaywith CIDR

Bridge portscomma-separated

LAN networknetwork CIDR

DNS serverscomma-separated

DHCP server

Automatically issue LAN addresses

Pool start

Pool end

NAT masquerade

Share the WAN connection with LAN clients

GENERATED SCRIPT

router-config.rsc

Live

49 linesDHCP WANFirewall on

# ============================================================
# MikroTik Config Forge • RouterOS v7
# Router: LACFIBER-Router
# Safe mode: no reset and no delete commands
# ============================================================

# 01 • SYSTEM IDENTITY
/system identity set name="LACFIBER-Router"

# 02 • LAN BRIDGE
:if ([:len [/interface bridge find where name="LAN"]] = 0) do={ /interface bridge add name="LAN" protocol-mode=rstp comment="CFG: LAN bridge" }
:if ([:len [/interface list find where name="CFG-LAN"]] = 0) do={ /interface list add name="CFG-LAN" comment="CFG: trusted LAN" }
:if ([:len [/interface list member find where list="CFG-LAN" and interface="LAN"]] = 0) do={ /interface list member add list="CFG-LAN" interface="LAN" }
:if ([:len [/interface bridge port find where bridge="LAN" and interface="ether2"]] = 0) do={ /interface bridge port add bridge="LAN" interface="ether2" comment="CFG: LAN port" }
:if ([:len [/interface bridge port find where bridge="LAN" and interface="ether3"]] = 0) do={ /interface bridge port add bridge="LAN" interface="ether3" comment="CFG: LAN port" }
:if ([:len [/interface bridge port find where bridge="LAN" and interface="ether4"]] = 0) do={ /interface bridge port add bridge="LAN" interface="ether4" comment="CFG: LAN port" }
:if ([:len [/interface bridge port find where bridge="LAN" and interface="ether5"]] = 0) do={ /interface bridge port add bridge="LAN" interface="ether5" comment="CFG: LAN port" }
:if ([:len [/ip address find where address="192.168.88.1/24" and interface="LAN"]] = 0) do={ /ip address add address=192.168.88.1/24 interface="LAN" comment="CFG: LAN gateway" }

# 03 • WAN UPLINK
:if ([:len [/interface list find where name="CFG-WAN"]] = 0) do={ /interface list add name="CFG-WAN" comment="CFG: internet uplinks" }
:if ([:len [/interface list member find where list="CFG-WAN" and interface="ether1"]] = 0) do={ /interface list member add list="CFG-WAN" interface="ether1" }
:if ([:len [/ip dhcp-client find where interface="ether1"]] = 0) do={ /ip dhcp-client add interface="ether1" add-default-route=yes default-route-distance=1 use-peer-dns=no disabled=no comment="CFG: WAN DHCP" }

# 04 • DNS
/ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=yes cache-size=4096KiB

# 05 • DHCP SERVER
:if ([:len [/ip pool find where name="CFG-LAN-POOL"]] = 0) do={ /ip pool add name="CFG-LAN-POOL" ranges=192.168.88.10-192.168.88.254 }
:if ([:len [/ip dhcp-server find where name="CFG-LAN-DHCP"]] = 0) do={ /ip dhcp-server add name="CFG-LAN-DHCP" interface="LAN" address-pool="CFG-LAN-POOL" lease-time=12h disabled=no }
:if ([:len [/ip dhcp-server network find where address=192.168.88.0/24]] = 0) do={ /ip dhcp-server network add address=192.168.88.0/24 gateway=192.168.88.1 dns-server=192.168.88.1 comment="CFG: LAN network" }

# 06 • INTERNET NAT
:if ([:len [/ip firewall nat find where comment="CFG: WAN masquerade"]] = 0) do={ /ip firewall nat add chain=srcnat out-interface="ether1" action=masquerade comment="CFG: WAN masquerade" }

# 07 • BASELINE INPUT FIREWALL
:if ([:len [/ip firewall filter find where comment="CFG: accept established"]] = 0) do={ /ip firewall filter add chain=input action=accept connection-state=established,related,untracked comment="CFG: accept established" }
:if ([:len [/ip firewall filter find where comment="CFG: drop invalid"]] = 0) do={ /ip firewall filter add chain=input action=drop connection-state=invalid comment="CFG: drop invalid" }
:if ([:len [/ip firewall filter find where comment="CFG: allow ICMP"]] = 0) do={ /ip firewall filter add chain=input action=accept protocol=icmp comment="CFG: allow ICMP" }
:if ([:len [/ip firewall filter find where comment="CFG: LAN management"]] = 0) do={ /ip firewall filter add chain=input action=accept in-interface="LAN" comment="CFG: LAN management" }
:if ([:len [/ip firewall filter find where comment="CFG: drop WAN input"]] = 0) do={ /ip firewall filter add chain=input action=drop in-interface="ether1" comment="CFG: drop WAN input" }

# 11 • SERVICE HARDENING
/ip service disable [find where name="telnet" or name="ftp" or name="www" or name="api" or name="api-ssl"]
/ip service set winbox address=192.168.88.0/24
/ip neighbor discovery-settings set discover-interface-list=CFG-LAN

:log info "CFG: base configuration completed"
:put "Configuration completed. Review router logs and test connectivity."

Review the script, enable Safe Mode in Winbox, then paste it into a RouterOS v7 terminal.