Skip to main content

MikroTik RouterOS CLI Cheat Sheet 2026 — Quick CLI Command Reference

5 min read

MikroTik RouterOS CLI Cheat Sheet 2026 — Quick Command Reference

MikroTik RouterOS CLI Cheat Sheet is the complete quick-reference of MikroTik RouterOS CLI commands grouped by function. Copy any command with one click and find what you need with Ctrl+F in under 3 seconds.

Interfaces & Ports

Action Command Useful flags
Enable an interface 
/interface enable <interface>
Disable an interface 
/interface disable <interface>
Monitor interface status once 
/interface monitor <interface> once
 once
Monitor interface traffic once 
/interface monitor-traffic <interface> once
 once
Reset interface counters 
/interface reset-counters <interface>
 -counters
List bridge ports briefly 
/interface bridge port print brief
 brief

IP Addressing

Action Command Useful flags
Add an IP address to an interface 
/ip address add interface=<interface> address=<ip/prefix>
 interface address
Print a list of IP addresses 
/ip address print
Remove an IP address by number 
/ip address remove numbers=<id>
 numbers
Disable an IP address 
/ip address disable numbers=<id>
 numbers

Routing (OSPF, BGP, RIP)

Action Command Useful flags
No commands detected for this group.

Firewall & NAT

Action Command Useful flags
Allow traffic on a port 
/ip firewall filter add chain=input protocol=tcp dst-port=<port> action=accept
 chain protocol dst-port action
NAT masquerade for outbound traffic 
/ip firewall nat add chain=srcnat out-interface=<interface> action=masquerade
 chain out-interface action
Block IP address 
/ip firewall filter add chain=input src-address=<ip> action=drop
 chain src-address action
Allow established and related connections 
/ip firewall filter add chain=input connection-state=established action=accept
 chain connection-state action
Allow ICMP (ping) 
/ip firewall filter add chain=input protocol=icmp action=accept
 chain protocol action
Destination NAT port forwarding 
/ip firewall nat add chain=dstnat dst-port=<port> protocol=tcp action=dst-nat to-addresses=<ip> to-ports=<port>
 chain dst-port protocol action to-addresses to-ports
Add address to address-list 
/ip firewall address-list add list=<list-name> address=<ip>
 list address
FastTrack established connections for higher throughput 
/ip firewall filter add chain=forward connection-state=established,related action=fasttrack-connection
 chain connection-state action

VLAN & Bridge

Action Command Useful flags
Create a new bridge interface 
/interface bridge add name=<bridge-name>
 name
Add an interface as a bridge port 
/interface bridge port add bridge=<bridge-name> interface=<interface-name>
 bridge interface
Enable VLAN filtering on a bridge 
/interface bridge set [find name=<bridge-name>] vlan-filtering=yes
 vlan-filtering
Add a VLAN entry to the bridge VLAN table 
/interface bridge vlan add bridge=<bridge-name> vlan-ids=<vlan-id> tagged=<tagged-interfaces> untagged=<untagged-interfaces>
 bridge vlan-ids tagged untagged
Set the PVID for a bridge port 
/interface bridge port set [find where bridge=<bridge-name> and interface=<interface-name>] pvid=<vlan-id>
 pvid
Create a VLAN interface on a parent interface 
/interface vlan add name=<vlan-name> vlan-id=<vlan-id> interface=<parent-interface>
 name vlan-id interface
List all VLAN entries on a bridge 
/interface bridge vlan print
Display all bridge port configurations 
/interface bridge port print

VPN (L2TP, PPPoE, SSTP)

Action Command Useful flags
Add L2TP client interface 
/interface l2tp-client add name=<name> connect-to=<ip> user=<username> password=<password>
 -client -to
Add PPPoE client interface 
/interface pppoe-client add name=<name> interface=<wan-interface> user=<username> password=<password>
 -client -interface
Enable PPPoE server 
/interface pppoe-server server set enabled=yes
 -server
Add PPP secret for VPN user 
/ppp secret add name=<username> password=<password> service=<service> profile=<profile-name>
 -name

MPLS & Traffic Engineering

Action Command Useful flags
No commands detected for this group.

System & Diagnostics

Action Command Useful flags
Display system resource usage 
/system resource print
Display system identity (name) 
/system identity print
Display system clock and date 
/system clock print
Display routerboard information 
/system routerboard print

⚠️ Dangerous / Destructive Commands

These commands are irreversible. Verify your environment (dev/staging vs prod) before running them.

Action Command Warning
⚠️ Firewall filter 
/ip firewall filter add chain=input src-address=<ip> action=drop
 Irreversible — verify the target before running

FAQ — Frequently Asked Questions

What is the difference between Interfaces & Ports and IP Addressing?

Each group in this MikroTik RouterOS CLI cheat sheet covers a distinct area. Interfaces & Ports focuses on its specific scope, while IP Addressing and the remaining groups cover networking, storage, security and diagnostics respectively.

How do I check the installed MikroTik RouterOS CLI version?

Run the version command (usually ip version or ip --version). The output shows the client and, when applicable, the server version.

Why does MikroTik RouterOS CLI return ‘permission denied’?

A ‘permission denied’ error in MikroTik RouterOS CLI usually means the current user lacks sufficient privileges or credentials are not configured. Check: (1) assigned IAM/RBAC roles, (2) an active authentication context via the corresponding login command.

How do I filter MikroTik RouterOS CLI output by status or name?

Use flags such as --filter, --selector or --query depending on the tool. You can also pipe into grep or jq to process JSON: 

ip list | grep RUNNING

What is the fastest way to debug a MikroTik RouterOS CLI error?

Add the verbose flag (--verbose, -v or --debug) to the failing command. This reveals the underlying HTTP/API calls and the full error response body.

Official sources & references

Commands cross-checked against vendor documentation and high-authority repositories: