Mikrotik: reset settings, backups and DualBoot

Analysis of many small, relatively related, topics: software and hardware reset settings, the Protected RouterBoot function, backups and configuration export, breakdown of flash memory into sections.

Software reset

If you have access to the router from a user with full rights, you can reset all settings via [System] → [Reset Configuration]

What is there:

• Keep user setting - do not delete user accounts.
• CAPS mode - after reset, search for the CAPsMAN controller.
• No Default Configuration - do not create a default configuration after a reset.
• Do Not backup - do not create backup before dumping. If not noted, the created backup will not be password-protected.
• Run After Reset - a script that will be executed after resetting and restarting the router.
• During the reset, the contents of flash memory is not overwritten.

Console option:

/system reset-configuration no-defaults=yes skip-backup=yes 

Hardware reset

It all depends on the model of the router, maybe three options:

There is a reset button

To begin, turn off the power, hold down the reset and turn on the power. We release through:

• 3 seconds (before ACT blink) - boot from the spare bootloader. It helps if a failure occurs when updating the system or firmware.
• 5 seconds (ACT blinking) - reset.
• 10 seconds (ACT stops flashing) - search for the CAPsMAN controller.
• 15 seconds (ACT off) - search for the netinstall server.

Contact area

The wiki claims that all devices are equipped with a similar platform. For the sake of interest, I opened RB491-2nD and did not find one.

Reset technology: turn off the power, close the platform (the beeper makes a wheezing squeak) and do not release until full load.

Jumper

Present on older models.

Reset technology: turn off the power, close the jumper, wait for the full load, remove the jumper.

Protected RouterBoot

It may happen that after resetting someone else’s (otherwise you would have known) the router will not load further than the first peak - this is a new feature from Mikrotik that wipes all flash memory (including RouterOS), you will need to restore netinstall.

About RouterBoot

RouterBoot is the bootloader on Mikrotik devices, you can interact with it through the Serial interface and prevent the interference of the boot process with one of the intended purposes of the Protected RouterBoot.

The loader is divided into two parts:

• Recovery - comes with the device and coincides with the Factory Firmware.
• Current - comes with the system package, but is updated separately.

View current versions in [System] → [RouterBoard]. The [Upgrade] button updates the Current loader. If the system works poorly and boots only from the backup (as written in the section above), then in [Settings] you can explicitly set the recovery bootloader as permanent, the Auto Upgrade option for updating the current bootloader along with RouterOS. And once we are here - the Silent Boot option turns off sounds during the download.

 #   /system routerboard print /system routerboard setting print #   /system routerboard upgrade #    Recovery /system routerboard setting set force-backup-booter=yes #  beeper /system routerboard setting set silent-boot=yes 

On which versions of the firmware does Protected RouterBoot work?

They promise guaranteed work for devices with Factory Firmware 3.24 and higher; if your device is older, you can activate the function by updating the firmware.

 /system package update set channel=bugfix /system package update check-for-updates /system package update install 

 /system package downgrade 

 /system routerboard upgrade /system reboot 

[System] → [RouterBoard] → [Settings]

Turn on Protected RouterBoot = yes, now

• Interaction with RouterBoot during the download phase will be impossible.
• Reset button will work in a single mode - wipe flash memory. The reformat-hold-button and reformat-hold-button-max options define the minimum and maximum value of the hold time of the Reset button. It is necessary to get into the established interval. Formatting memory can take up to 5 minutes.
• Etherboot will not work.
• Reset via contact closures on the board will not work.

I do not urge you to include this option in a mandatory manner, think for yourself when you need it, and when you can do without such measures.

Restoring firmware using netinstall

Netinstall is a universal tool for flashing and pre-configuring MikroTik routers. When used, the internal memory and configuration is formatted, only the settings in [System] → [RouterBOARD] will remain unchanged

Available only for Windows by reference . Conflicts with some firewalls and antiviruses (add to exceptions), there may be problems starting from users with limited rights - run "As Administrator".

Procedure:

• You will need firmware files from here . You can take the whole main, or unpack the necessary packages from extra, only the system package is required.
• Wired connection with the router. Moreover, the PC and the router should be located within the same network segment, it is better to connect the cable directly.
• It is recommended to disable all unnecessary network interfaces on the PC. In practice, there is usually no problem with this.
• Install a static ip on the wired interface to which the router is connected, for example: 192.168.100.1/24.
• If on Mikrotik there is a port labeled Boot, then connect to it, if not - to the first port.
• Run Netinstall, in [Net Booting] you need to enable Boot Server Enabled and specify ip from the previously selected subnet, for example: 192.168.100.10.

• Turn off the power of MikroTik, hold down the Reset and wait 15 seconds (until the router appears in Netinstall). If the Reset button is absent, then we close the contact pad or jumper.
• In [Browse], select the directory with the necessary RouterOS files, mark the necessary ones.
• Click [install].
  

What else is netinstall capable of

• Key - you can upgrade the license. SoftID is required to order a key.
• Keep old configuration - save the configuration and restore it after the firmware.
• IP address / Netmask & gateway - configure ip.
• Baud rate - set the speed of the Serial interface.
• Configure script - the script that will be launched after sewing.
• Apply default config - load the default configuration. Works if the previous three points are not installed.
• Flashfig is a utility for mass customization of new devices, more .

Backup and export configuration in Mikrotik

Binary backup

• It includes almost complete (files, certificates and ipsec keys are not migrated) copy of RouterOS settings.
• Encryption in backups are only system accounts.
• Not editable.
• Recovery overwrites the current configuration.
• It is desirable to restore to a similar model Mikrotik.
• It is possible to restore on other than the original models. But in the binary backup, the interface settings are tied to the internal id and when restoring the real and system ethernet port numbers will be confused. If the new device does not have enough physical interfaces, the settings will be restored, but they will refer to unknown.

Create backup:
[Files] → [Backup]

• Name - the name of the file. default will be -.
  Password - password. The default password is the current user.
  Don't encrypt - do not encrypt backup.
  
  

  Console option:

  
  

   /system backup save #    # name=<string> -  # password=<string> -  # dont-encrypt=<yes|no> -   

  
  

  Recovery:
  [Files] → [Highlight required file] → [Restore]

  
  

  

  
  

  Console option:

  
  

   /system backup load name=<> password=<> 

  
  

  Additionally:

  
  
  • https://www.mikrotikpasswordrecovery.net/ - service to retrieve system accounts from unencrypted backup.
  • https://github.com/BigNerd95/RouterOS-Backup-Tools - an unofficial script for partial unpacking of backup.
  
  

  Export and import configuration

  
  
  • Does not include system user settings. Cry
  • You can save (export) and download (import) only from the console.
  • It is possible to copy both the whole config and part.
  • Not encrypted.
  • You can edit.
  • During the import of the configuration, the current one will not be overwritten.
  • You can restore to any model, there will be no confusion in the interfaces, but if the interfaces are not enough, the corresponding settings will not be restored.
  • In the latest updates, RouterOS repaired the restoration of Scripts and Schedulers. Now they are restored without errors with the specified users, users themselves will not be created.
  
  

  Export options:

  
  
  • compact - only differences from the default configuration. By default in RouterOS 6. Conflict with verbose.
  • verbose is the most complete configuration. By default in RouterOS 5. Conflicts with compact.
  • hide-sensitive - do not export passwords, keys, etc.
  • terse - do not break lines.
    export does not save the configuration to a file, unless you explicitly specify the file key = <file name> rsc extension will be added automatically.
  
  

   #    /export #      /export verbose file=config #   ip address   /ip address export file=config-ip-add #     /import file=config.rsc 

  
  

  RouterOS DualBoot in Mikrotik (Partition)

  
  

  Flash drive can be divided into several sections and install multiple copies of RouterOS (including various). In case of unsuccessful boot, the next one will be loaded from the main partition. The feature is available on devices with MIPS, PowerPC and CCR series.

  
  

  Breakdown into sections:
  [Partition] → [Repartition]

  
  

  

  
  

   /partitions repartition partitions=2 

  
  

  You must specify the total number of sections. There are two limitations: the maximum number of partitions is 8 and the minimum partition size: 32MB for MIPS; 40MB for PowerPC; 48MB for CCR.

  
  

  The new section will be empty; you need to copy the current firmware to it via [Copy to].
  

  
  

   /partitions copy-to part1 

  
  

  In the console, the properties of partitions are better visible: Active (A) - from which the next boot will be made and the partition from which the system® was booted.

  
  

  
  The active partition is changed in its properties by the [Activate] button. The Fallback to option is responsible for selecting the partition if the download failed.

  
  

   #    /partitions activate part1 #    /partitions set part1 fallback-to=part0 #     bootp(netinstall) /partitions set part1 fallback-to=etherboot 

  
  

  [Save Config To] - Save the configuration from the current® partition to the selected one.
  [Restore Config From] - Save configuration from selected partition to current®.

  
  

   /partitions save-config-to part1 /partitions restore-config-from part1 

  
  

  The functionality is interesting, but it has two drawbacks: Not all routers are equipped with enough flash memory. Crashes in RouterOS, even when upgrading, are not so common.