GLACXYSTEM Config Tools
Basic · system · interfaces
New router user (full, write or read). Leave the password empty to get a strong random one in t...
An address on an interface.
An address pool for DHCP, PPPoE or hotspot.
Router name shown in Winbox and the terminal.
Correct clock (Philippine time) for logs, schedules and certificates.
Message shown when someone opens the terminal (RouterOS 7).
DNS servers and cache for the router and its clients.
Address, pool, DHCP server and network in one go.
Many VLANs on one port, each with its own address and DHCP if wanted.
Ethernet ports back to ether1, ether2 ... names.
Give a port another MAC address (e.g. when the ISP is tied to a MAC).
Every ethernet port back to its factory MAC.
Reach routers behind this one from Winbox, even without IP.
Restart the router every day at a quiet hour.
Save a readable config (.rsc) and a full backup on the router (Files).
A complete starting config for a fresh router: internet (DHCP/static/PPPoE), LAN with DHCP, DNS...
Protection
MikroTik's own DDoS detection: too many new connections from one address to one target are drop...
Hardening: unsafe services off, Winbox/SSH only from your network, password guessers blocked fo...
The old Winbox hole (RouterOS before 6.42.1) let attackers read user.dat. Closes Winbox to the...
Stops ARP spoofing (Netcut and similar): the router only trusts addresses it gave out by DHCP.
A phone that shares the hotspot to other devices stops working for them (TTL 1 out of the hotsp...
The router does not answer ping from the internet.
Broken / spoofed packets dropped before anything else.
Hides the router and your network from traceroute from the internet.
Web proxy and SOCKS closed to the internet (open proxies get abused for spam).
The router answers DNS only for your clients, not for the internet (stops DNS amplification).
Bandwidth test server off (or password only).
MAC-Telnet, MAC-Winbox and MAC-ping only from your LAN list.
The router is not announced (MNDP/CDP/LLDP) outside your LAN list.
Which router services are on, on which port, from where.
Protected RouterBOOT: the reset button can no longer wipe the router (stolen-router protection)...
Blocking
Clients cannot reach these addresses (or these clients are cut off).
A device (by MAC) gets no internet.
Close TCP/UDP ports through the router.
Clients cannot open the ISP modem / ONU page.
Block sites by name in the traffic (works for plain DNS; heavy on CPU, use for a few sites).
The router answers blocked sites with a dead address; clients are made to use the router's DNS.
NAT · FastTrack · queues
Open a port from the internet to a device inside (CCTV, server, game).
Faster routing, lower CPU (note: queues and some rules are skipped for fasttracked traffic).
Local traffic (LAN to LAN, router pages, local servers) is never slowed by simple queues.
Load balance · routing · VPN
Share clients over 2-6 internet lines by weight (e.g. 200M:100M = 2:1). Each connection stays o...
Two or more Starlink dishes (or any DHCP modems) shared by weight. The gateways come from DHCP...
Every new connection takes the next line in turn (by weight). Fills all lines evenly; a few sit...
Equal-cost routes: the simplest load balance for lines of the same speed. Each line is checked...
Main line first, the next lines as backup (up to 6). Every line is checked for real INTERNET ev...
Game traffic (by game ports) goes out through the line you choose, e.g. the low-ping fiber, whi...
Learns game SERVER addresses from game ports (raw, light on CPU) and sends ALL traffic to those...
Chosen websites go out through one line (the router looks up their addresses by itself and keep...
Video and social apps go out through one line (e.g. Starlink or the cheaper ISP), so games and...
Chosen devices or networks (e.g. the office, a VIP client) always use one line.
Traffic to chosen ports (e.g. 443 or a game port) goes out through one line.
With 2+ ISPs, connections that come IN on the public-IP line (Winbox, CCTV, port forwards) answ...
Game ports go through a VPN tunnel (lower ping to foreign servers, or around a blocked route).
Traffic to chosen game server addresses goes through a VPN tunnel.
Everything from the LAN (except local networks) goes through a VPN tunnel; the router itself ke...
A WireGuard server for phones, laptops or other routers. Each peer: name, its public key, its t...
A VPN server so you (or a branch) can reach this router and its LAN from anywhere.
A BGP session with your upstream or another router: your AS, their AS, their address, the netwo...
Queues · QoS
One speed limit per client address, made for a whole range at once.
The whole line shared fairly: every active client gets an equal part, up to a per-client limit,...
A speed limit with a short burst (pages open fast, long downloads settle down). Calculates the...
Games, calls and DNS first; video and social media next; big downloads last. Needs the real lin...
Hotspot · PPPoE
PPPoE server on one port: subscriber pool, one plan (speed), server and NAT. Add accounts after...
Many PPPoE plans at once (name, download, upload). An existing plan with the same name gets the...
PPPoE subscriber accounts (one per line: username password).
Hotspot voucher codes made here (random, easy to read). Print them from the list shown.
A device skips the hotspot login (bypassed), is blocked, or must log in (regular).
Sites that open before hotspot login (payment, your Facebook page).
Everyone must log in again (after changing plans or vouchers).
Full PPPoE for an ISP: subscriber ports bridged, pool, all plans, EXPIRED (unpaid) profile that...
Monitor · clean up
Watch an address; log when it goes down and comes back.
Ping from the router.
Path from the router to an address.
Empty the DNS cache.
Empty the log in memory.
Traffic and rule counters back to zero.
The router sends a short report to your Telegram group: CPU, memory, uptime, PPPoE and hotspot...
Every day or week the router e-mails you its config (.rsc) and full backup. Uses your mail acco...
Remove · reset (careful)
Every own filter, NAT, mangle and raw rule removed. The router is OPEN until you add rules agai...
Every simple queue and queue tree removed (speed limits gone).
Static ARP entries removed.
All DHCP servers, networks, leases and DHCP clients removed (the internet may stop if it comes...
Static DNS entries and DNS servers removed.
Hotspot servers, profiles, users, bindings and walled garden removed.
Every static IP address removed: you can only reach the router by MAC (Winbox neighbors) after...
Every IP pool removed (DHCP, PPPoE and hotspot stop giving addresses).
Bridges, VLANs and bridge ports removed.
PPPoE servers, secrets and profiles removed; everyone online is disconnected.
Static routes removed (the internet stops unless it comes by DHCP/PPPoE).
Restart, turn off, or wipe the router.