Add a MikroTik router

Adding a MikroTik takes two parts: you create the device record on the dashboard, then you run a setup script on the router. The script connects the router to ISPMan over a secure WireGuard management tunnel and gives ISPMan its own login on the router. After that, the dashboard can show the router’s status and build hotspot and PPPoE servers on it for you.

Before you start

The script dialog asks you to confirm three things. Check them in WinBox first:

Requirement	How to check
RouterOS newer than 7.18.2	System → Resources in WinBox, or /system resource print in the terminal. Upgrade first if needed.
The wireless or wifi-qcom package is installed (which one depends on the board’s architecture)	System → Packages. Install the right package from the MikroTik download page if it’s missing.
Device mode is advanced	Run /system/device-mode/print and look for mode: advanced. If it says home, run /system/device-mode/update mode=advanced, then unplug the power and plug it back in after about 3 seconds.

You also need:

• The router connected to the internet on its uplink port (usually ether1).
• WinBox (or WebFig) access to the router with its admin login.
• A role that can manage devices: owner, admin, operator or devices admin.

Step 1: Create the device

1. Go to Devices → All Devices (/dashboard/devices/all) and click Add.
2. In Add new Router Device, fill in:
   • Name this device, for example Kasarani Main Router.
   • What OS is this device running? Choose mikrotik.
   • Device Location, for example Kasarani, Block B.
3. Click Create Device. You’ll see “ISP Device Created Successfully” and the router appears in the list.
4. Click the router’s row to open its device page.

Step 2: Download the setup script

1. On the device page, click Script. The Download MikroTik Setup Script dialog opens.

2. Tick each prerequisite once you’ve confirmed it. The download buttons stay disabled until all three are ticked.

3. Check the network fields:

   Field	What to enter
   LAN Bridge	The bridge your customers connect to. Leave the default br-ispman.
   Uplink Interface	The port that has internet. Default ether1.
   Enable DHCP Client?	On if your uplink gets its address by DHCP. Turn it off if the link uses something else, like PPPoE or a static address.
   Static IP	Only when DHCP is off: the router’s address on the uplink.

4. Click Download Script to save ispman.rsc, or Copy Script to copy it to your clipboard.

Step 3: Run the script on the router

1. Open WinBox and connect to the router (the Neighbors tab finds it by MAC address).

2. Open Files and drag ispman.rsc into the window.

   • If you used Copy Script instead: in Files click + (New File), name it ispman.rsc, paste the script and save.

3. Open New Terminal and run:

   /import ispman.rsc

4. Leave the router powered and connected. ISPMan takes over from here.

Step 4: Watch onboarding finish

Until onboarding is done, the device page shows a Pending Tasks panel. Each task shows a spinner while it’s in progress and a tick when it’s done:

Task	Meaning
WireGuard Credentials	Tunnel keys were created for this router.
OS Upgrade	RouterOS version check/upgrade is done.
WireGuard Config	The management tunnel is up.
API Access Setup	ISPMan can log in to the router and read it.
Wireless Package	The wireless package is in place.
Captive Readiness	The router is ready to serve the captive portal.

When everything is done, the panel disappears and the page fills with the router’s Device Info (board, CPU, memory, uptime, RouterOS version) and its live tables. You can now add a hotspot or PPPoE server from the buttons at the top of the page. See Hotspot and PPPoE.

Tip

If the page says “Device not connected to VPN network.”, the router is checking in but the management tunnel isn’t working yet. If it says “Device is not online.”, ISPMan hasn’t heard from the router recently. Check the router has internet, then re-run the script.

Onboarding with the Assistant

If you have the Assistant, you can ask it to onboard a MikroTik instead. It reads the router live and walks you through the steps in a fixed order:

1. Device
2. VPN tunnel
3. API access
4. RouterOS version
5. RADIUS
6. LAN bridge & ports
7. Hotspot server
8. PPPoE server
9. Ping script

Each step comes as a card with an Apply button. Nothing changes on the router until you press Apply, and a step is refused until the steps before it are done. The VPN tunnel and API access steps are scripts you paste into WinBox yourself; the card shows them. You can choose to set up only a hotspot or only PPPoE (one of the two must stay). A router running a RouterOS version older than 7.15 is upgraded before you continue.

Only owners, admins, operators and devices admins can apply onboarding steps.

If something goes wrong

• Start over: open More → Re-Onboard on the device page and confirm. This resets the onboarding progress; download the script again and run it.
• Do it by hand: More → Start Manual Onboarding resets onboarding and shows a Manual Onboarding Scripts card with separate scripts to paste into the terminal in order: WAN Configuration, WireGuard, Bridge & Ports, and API User, RADIUS & Access List. Under Service Scripts you’ll find the Hotspot Server and PPPoE Server scripts, and under Optional the RouterOS Upgrade, Wireless Package and Admin Access List scripts. When you’re done, click Complete Manual Onboarding.
• Dedicated Device Scripts: until the router is onboarded, the page also offers Hotspot Server Script and PPPoE Server Script. Each asks for the LAN bridge, uplink, a name and a network, then generates a .rsc to import with /import. They’re also under the More menu later.

Caution

The Admin Access List script adds a firewall rule that drops management access from everywhere except whitelisted ranges. Only run it when you’re sure you are connecting from an allowed range, or you’ll lock yourself out.

Deleting a router

On the device page, click Delete and confirm. Remove the router’s hotspots and PPPoE servers first: ISPMan asks you to make sure the device has no assigned resources.

Related

• Devices overview
• The MikroTik device page
• Remote access: Winbox and WireGuard
• Hotspot
• PPPoE