Advanced shows the same device as the wizard, unfolded. You switch each part on or off and fill in only what you need. Whatever you entered in the wizard is already there.
How you get there
On the second screen, next to the wizard, sits the Advanced card. You can also switch over halfway through the wizard: every step has a link to it, and you land on the part you were working on. Choose advanced without ever picking a role and it starts with the default parts for your model. After an import you always end up here, because an existing configuration rarely fits one role.
The screen
On the left is the list of parts, on the right the part you have open. Every entry in the list carries a dot: on, off, or not applicable to this device. A part that cannot apply cannot be clicked, and the text next to it says why: No wifi radio, No wired ports, Containers require ARM64 or x86. A field with a mistake in it colours the part in the list.
At the top of the list is a search box. It searches the names of the parts and the labels of the fields inside them, so typing mtu or dhcp leaves the parts that hold such a field. Useful when you know what you are looking for but not where it lives.
The parts
They follow the order of MikroTik's manual, not the order in which you fill them in:
- System — identity, time zone, NTP, logging, upgrades, and the RouterOS version you generate for. This part is always on.
- Management access — which services are open, on which ports, from which addresses, and the administrator password.
- Bridge and ports — which ports are in the bridge, spanning tree, hardware offloading, MTU, an offbridge port for emergency access, bonding.
- VLANs — the table of VLANs and, per port, access or trunk.
- WAN / internet — DHCP, static, PPPoE or LTE, several uplinks with failover or load balancing, provider presets such as KPN and Ziggo.
- LAN and DHCP — address, range, reservations.
- DNS and IPv6.
- Firewall and NAT — the default rules, port forwarding, isolation between VLANs, bogons, brute-force protection.
- Wi-Fi and CAPsMAN — SSIDs, security, bands, channels, per VLAN, or managed centrally.
- VPN (WireGuard, IKEv2, L2TP, SSTP, OpenVPN, tunnels), routing (OSPF, BGP, policy), QoS, hotspot and PPPoE server, high availability (VRRP, Netwatch), services and tools and containers.
- Carried over from your configuration — only after an import: the lines kept verbatim.
Management access, bridge and ports, WAN, LAN, DNS and firewall are on by default, and Wi-Fi when your device has a radio. The rest you switch on when you need it. Switching a part off erases nothing: what you typed stays and comes back the moment you switch it on again.
Adding your own lines
At the bottom of every part sits an Extra lines box. Put your own RouterOS commands there, one per line. They land in the script right after that part's own output, with a comment line above them saying where they came from. So one line we do not generate does not mean editing the whole script by hand afterwards.
How the script is put together
A preview runs along under the settings. It is not just the script: the lines the part you have open is responsible for are highlighted, the rest is dimmed around them for context, and above it sits a count of how many of the lines are this part's. That shows you at once what a tick adds.
The order of the script is the order in which RouterOS needs the objects: interfaces first (bridge, VLAN, WireGuard, tunnels), then interface lists, Wi-Fi, bridge ports, pools, DHCP, addresses, DNS, address lists, the raw rules, the filter rules, NAT, mangle, the IPv6 firewall, queues, VPN, routing, VRRP and Netwatch, services, containers, the system identity, carried-over lines, and right at the end /user. The administrator password is therefore the last thing that runs, so a script that breaks halfway does not lock you out straight away.
The script opens with a header: the model, the role, the date, the RouterOS version it was generated for, and the line telling you to apply it to an empty device. If the port names of your model were never checked against real hardware, that is in the header too.
Checks
Above the script sit the warnings and errors. A few of the things that are checked: subnets that overlap, a VLAN id used twice in the table, a VLAN tagged nowhere, a port used in two roles at once, a password that is too short, management left open to the internet, an MTU that differs at the two ends of a cable. An error is a real mistake; a warning is something to decide about deliberately.
Field errors sit separately at the top, each as a link: click it and you are in the part and the field where it goes wrong. On top of that the tool looks for lines RouterOS accepts but does not carry out because device-mode blocks them, such as the scheduler, containers, fetch, hotspot and IPsec. That is the nasty kind of mistake, because the device itself says nothing about it.
What you do not have to remember
The order of firewall rules, the right spelling per RouterOS version, which settings belong to your Wi-Fi package: the generator handles that. You decide what should happen, not how it is written down.
Further reading: The wizard, Multiple devices in one site and Using the script.