# MikroTik MikroTik is a networking technology company offering routers, switches, wireless systems, and RouterOS software for wired and wireless networks. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Forensic Walkthrough of a Compromised MikroTik Router and Its Persistence Mechanisms DevFeed: [Forensic Walkthrough of a Compromised MikroTik Router and Its Persistence Mechanisms]() Original publisher: [Read original article]() Author: j2sw Published: 2026-09-16T13:32:46Z Content type: article Language: en Sources: [Justin Wilson (j2sw)]() Topics: [MikroTik](), [Vulnerabilities](), [Persistence](), [remote access](), [backdoor](), [ssh]() Tags: [backdoor](), [cybersecurity](), [firmware](), [forensics](), [incident-response](), [mikortrick](), [mikrotik](), [network-operations](), [network-security](), [persistence](), [remote-access](), [security](), [ssh](), [vulnerabilities]() ### AI overview A forensic walkthrough examines a compromised MikroTik router in a honeypot. The intruders established persistence and remote access through scheduled tasks, scripts, new users, and tunnels. The author suspects, but cannot prove, that the compromise involved the MikroTrick RouterOS vulnerability chain. ### Source excerpt What it looks like when an intruder tries to make your own router work against you. A note before we start: Anything in this post that could identify my network, my organization, or my router's real hostname and IP address has been redacted or made generic. The attacker's own infrastructure, such as IP addresses, ports, ... Read more The post A first-hand forensic walkthrough of a real router compromise appeared first on Justin Wilson (j2sw). ## Security Week 2638: опасные уязвимости в роутерах MikroTik DevFeed: [Security Week 2638: опасные уязвимости в роутерах MikroTik]() Original publisher: [Read original article]() Author: Kaspersky\_Lab ("Лаборатория Касперского") Published: 2026-09-14T15:06:43Z Content type: news Language: ru Sources: ["Лаборатория Касперского" RU]() Topics: [MikroTik](), [Security](), [CVE-2026-86060](), [ssh]() Tags: [2026](), [chromium](), [cve](), [cve-2026-86060](), [gpt](), [microsoft](), [mikrotik](), [openai](), [security](), [ssh](), [tag-9fe8963de219]() ### AI overview The article reports three vulnerabilities in MikroTik routers, including SSH authentication bypass, privilege escalation, and a denial-of-service issue. Two vulnerabilities were actively exploited, and MikroTik released patches for affected RouterOS versions. The report also describes AI-assisted vulnerability discovery involving OpenAI GPT models and briefly mentions vulnerabilities in WeChat and a large Microsoft patch release involving Chromium. ### Source excerpt На прошлой неделе команда CERT из Польши обнародовала информацию о трех уязвимостях в роутерах MikroTik, две из которых активно используются в реальных атаках как минимум со второго сентября. Взлом роутеров возможен в том случае, если на устройстве разрешен доступ по протоколу SSH из Интернета. По данным на пятое сентября в сети наблюдалось более 122 тысяч потенциально уязвимых устройств. Две наиболее опасные уязвимости имеют одинаковый рейтинг 9,2 балла по шкале CVSS. Проблема CVE-2026-67276 позволяет обойти аутентификацию по SSH в том случае, если атакующему известно имя пользователя и модуль публичного ключа. Ошибка CVE-2026-86060, в свою очередь, открывает возможность эскалации привилегий при использовании имени пользователя, содержащего некорректные символы. Читать далее ## Use of VRF in dual WAN setup DevFeed: [Use of VRF in dual WAN setup]() Original publisher: [Read original article]() Published: 2026-08-03T20:58:23Z Content type: tutorial Language: en Sources: [Personal blog of Anurag Bhatia]() Topics: [networking](), [MikroTik](), [Prometheus](), [Containers]() Tags: [containers](), [mikrotik](), [prometheus](), [router](), [routing](), [routing-table](), [vrf]() ### AI overview This article describes migrating a MikroTik home router from multiple routing tables to a VRF-based dual-WAN design. It explains how shared routing domains caused router-bound traffic to return through the wrong ISP during partial outages and made ISP-specific routing for measurement containers difficult. VRFs provide separate layer-3 routing domains for the WAN links, while Prometheus and Semaphore handle packet-loss-based switchover. ### Source excerpt Over the weekend I migrated my home router from multiple routing tables to a VRF-based design, placing each WAN uplink into its own VRF. While multiple routing tables worked for basic policy routing, they have some limitations and that led to several edge cases that became increasingly difficult to work around. Issues with the setup: If the active default route pointed to ISP1, traffic arriving on ISP1 naturally returned via ISP1. However, traffic terminating on the router and arriving via ISP2 would also be replied to through ISP1, since both uplinks still shared the same routing domain. This did not cause issues for traffic on devices below the router but was bad for traffic terminating on the router interface itself. Due to the above reason, I recently lost access to my home router while I was out of the country because ISP1 had a partial outage (their transit went down, peering stayed up) & due to distributed tooling, the auto switch trigger could not happen either to take care of it. Packets from ISP 2 were being returned via the ISP1 route & thus blackholed. I have a special case where I want most of the devices on a redundant setup but some devices (containers) on specific ISP only. These are measurement containers running blackbox exporter behind a specific ISP as well as RIPE Atlas. I don't want these to switch over for accuracy of measurement. Without VRF it was ugly config-wise, as ISP1 failure will lead to ISP2 routing even when the specific routing table did not have that route. Old Setup My old setup was running multiple routing table pairs: ISP1 only & ISP1 as primary (ISP2 as secondary) ISP2 only & ISP2 as primary (ISP1 as secondary) All WAN interfaces, LAN interfaces and routing tables were in the same single "Main" VRF. This by default takes care of full outage events, fibre cuts, etc. For packet loss-based switchover, I have set up Prometheus + Semaphore as covered in this post last year. Understanding VRF VRF is Virtual Routing and Forwarding. It ## Mikrotik Winbox 4.3 is out DevFeed: [Mikrotik Winbox 4.3 is out]() Original publisher: [Read original article]() Author: j2sw Published: 2026-07-29T14:38:07Z Content type: release Language: en Sources: [Justin Wilson (j2sw)]() Topics: [MikroTik](), [Windows](), [Zip](), [GUI](), [layout]() Tags: [2026](), [feature](), [file](), [form](), [input](), [layout](), [mikrotik](), [network-engineering-resources](), [performance](), [redesign](), [render](), [right](), [sorting](), [table](), [toolbar](), [ui](), [v3](), [version](), [widget](), [winbox](), [windows](), [zip]() ### AI overview MikroTik WinBox 4.3 is a release update that adds a Windows ARM64 package and introduces or improves table, form, toolbar, settings, font, login, window-selection, layout, and scrolling behavior. ### Source excerpt What's new in 4.3 (2026-Jul-20 10:14): *) app: add Windows for arm64 version in file WinBox_Windows_arm64.zip;*) form: make multiline input field height logic as in WinBox v3;*) table: add quick comment feature (allow multi-row commenting);*) table: allow opening "Table settings" also via right mouse click;*) table: calculate implicit height to fit 16 regular rows including ... Read more The post Mikrotik Winbox 4.3 is out appeared first on Justin Wilson (j2sw). ## Mikrotik.nix: Declaratively manage RouterOS configuration DevFeed: [Mikrotik.nix: Declaratively manage RouterOS configuration]() Original publisher: [Read original article]() Author: nrabulinski Published: 2026-07-13T00:14:48Z Content type: article Language: en Sources: [Announcements - NixOS Discourse]() Topics: [MikroTik](), [Nix](), [configuration](), [Network]() Tags: [announcements](), [commands](), [configuration](), [feature](), [forgejo](), [github](), [mikrotik]() ### AI overview The author announces mikrotik.nix, an early project for declaratively managing MikroTik RouterOS configuration with Nix. The project is being tested at home, remains rough around the edges, and uses the RouterOS API for activation and cleanup of resources managed by Nix. ### Source excerpt Having just applied my home router configuration, I'm happy to announce my latest project: mikrotik.nix. As the README says, it's very early still, and I'm very much looking for feedback if someone is feeling adventurous enough to try it. So far I'm just converting the output of /export compact from my router to put into my config repo, fixing whatever comes up, and extending the feature-set as I go. The canonical repo can be found here: nrabulinski/mikrotik.nix - Forgejo: Beyond coding. We Forge. and this is also what I recommend depending on, as it has higher uptime than GitHub. There is also a GitHub mirror though, for the purpose of creating issues and PRs GitHub - nrabulinski/mikrotik.nix: Mirror of https://git.rab.lol/nrabulinski/mikrotik.nix - GitHub And finally here's the commit where I add mikrotik.nix to my config: net/home/router: init - fc9c489c6d - nrabulinski/settei - Forgejo: Beyond coding. We Forge. 3 posts - 2 participants Read full topic ## Mikrotik quietly adds features to the Winbox package updates DevFeed: [Mikrotik quietly adds features to the Winbox package updates]() Original publisher: [Read original article]() Author: j2sw Published: 2026-06-12T14:11:16Z Content type: news Language: en Sources: [Justin Wilson (j2sw)]() Topics: [MikroTik]() Tags: [features](), [mikrotik](), [network-engineering-resources](), [packages](), [rosv7](), [routeros](), [system](), [updates](), [updating]() ### AI overview MikroTik has added new features related to updating system packages in Winbox. The article provides few details and says more information will follow. ### Source excerpt Mikrotik has added some new features to system...packages as far as updating goes. More info to come soon. The post Mikrotik quietly adds features to the Winbox package updates appeared first on Justin Wilson (j2sw). ## Netflow for home router & Linux servers DevFeed: [Netflow for home router & Linux servers]() Original publisher: [Read original article]() Published: 2026-04-09T20:20:00Z Content type: article Language: en Sources: [Personal blog of Anurag Bhatia]() Topics: [netflow](), [Linux](), [Monitoring](), [MikroTik](), [Docker]() Tags: [akvorado](), [docker](), [linux](), [mikrotik](), [monitoring](), [netflow](), [pmacct](), [router]() ### AI overview The author describes running an open-source NetFlow collection setup for a home MikroTik router and Linux servers. They compare Pmacct and Akvorado, use Akvorado as the main system and Pmacct as a Linux exporter, and filter collected traffic to examine regular end-device usage. ### Source excerpt For the last few weeks, I have been running a NetFlow collector for the home router. This is something I wanted to do for a long time, but I was missing the time to invest. There are a few open source options, and I guess many commercial solutions offering NetFlow, often bundled with other products. My personal monitoring is 100% open source and presently running Prometheus + Thanos + Node Exporter + Blackbox Exporter + SNMP Exporter + Grafana + Grafana Loki + a few more exporters. So I started looking for open source options which are still under active development and supported. Two of them are quite popular - Pmacct and Akvorado. Pmacct is extremely advanced, flexible, but at the same time overall complicated to set up (and maintain). Even their quickstart file 3100-line file is full of setup options. On the other hand, Akvorado seems simpler to maintain. Some complications, anyway, are expected with NetFlow because the goal is not just to collect the data but also to have a system to store it, analyse it, map IPs to location/AS numbers, etc., dashboards, etc. It's a tool developed by French ISP Free, which is part of the Iliad group, which also owns Scaleway. Setting up Akvorado is easy if you are familiar with Docker. They have a simple 4 command quick-start which deploys all their containers as part of the stack. They deploy a few containers as part of the overall stack. The big picture page on their demo site documentation covers the overall architecture. I started feeding it data from the home (Mikrotik) router and later also added various Linux servers/VMs I manage for R&D, DNS, as well as to host this blog and other infrastructure. For Linux, I am using Pmacct as an exporter, as Akvorado's documentation suggests using it in exporter mode and has a sample config which works. Some data Now that it's been running for a few weeks, I can see major sources of data coming to the home. Before jumping to data, it's important to note that I have regular camera feeds