Automatic MikroTik backup

01Export or .backup?

RouterOS has two kinds of backup, and they serve different purposes:

A .backup file cannot be read or compared, and it is meant to restore the same router: on other hardware it can bring along the original MAC addresses and interface names. The .rsc export is the list of commands that recreates the configuration; you can open it, search for a rule, compare two dates and apply just one section.

In practice: export every day for history and restores; .backup before upgrading RouterOS or swapping boards, as an extra safety net.

02RouterOS 7 hides passwords in the export

Starting with RouterOS 7, /export leaves out sensitive data: PPPoE passwords (/ppp secret), wireless and VPN keys, RADIUS secrets. RouterOS 6 did the opposite: the export included everything, and you had to ask it to hide them.

A backup without secrets is safer to store, but it will not restore a PPPoE concentrator: subscribers would not be able to authenticate. Choose deliberately which one to keep, and protect the place where the full backup is stored.

03A user just for backups

Do not use the admin user for backups. Create a group with the minimum it needs and a user that only accepts connections from the backup server:

/user group add name=backup policy=ssh,read,sensitive
/user add name=backup group=backup password="change-this-password" address=192.0.2.10/32

Replace 192.0.2.10 with the server IP. The read policy allows running the export; sensitive is what lets the export include passwords; ssh is the access. Without write, this user cannot change anything on the router.

04Scheduling on the router itself

Without a server, RouterOS can generate the export every day on its own:

/system script add name=daily-backup source="/export show-sensitive file=daily-backup"
/system scheduler add name=daily-backup interval=1d start-time=03:00:00 on-event=daily-backup

On RouterOS 6, drop show-sensitive: there the export is already complete. It works, but it has limits that matter for an ISP:

• the file stays on the router itself: if the router dies, the backup goes with it;
• each new file replaces the previous one, so there is no history and nothing to compare;
• to send it by email or FTP, the credentials for those services are stored on every router;
• with dozens of devices, nobody notices when one of them stops producing the file.

05Central collection with Nexus

Nexus logs in over SSH (or Telnet), detects the version and runs the right export: /export show-sensitive on RouterOS 7 and /export on 6. By default Nexus keeps the full configuration, so everything can be restored. If the installation is set to strip passwords from backups, it uses /export hide-sensitive.

Along with the configuration, it records as comments the version, board and CPU (/system resource print), the installed version (/system package update print) and the router's recent change history (/system history print).

It also strips the date and time line RouterOS puts at the top of the export, and transient warnings such as an interface being down. That way a new version only appears when the configuration actually changed.

For SwOS switches, Nexus downloads the backup.swb file through the switch web interface.

06Restoring from the export

To rebuild a whole router from the .rsc, upload the file to the device and reset the configuration, running the script:

/system reset-configuration no-defaults=yes run-after-reset=backup.rsc

To recover just one part (a firewall rule, a pool, a route), copy the lines from the backup and paste them into the terminal. Importing the whole export with /import on a router that is already configured usually fails halfway, because many items already exist.

The full walkthrough, with what to check first, is in How to restore a configuration from backup.