Services and tools

RouterOS carries a long list of services and tools that have nothing to do with routing: readability for a monitoring system, graphs, a proxy, a file share, a scheduler. The Services and tools part switches them on. Everything in it is off by default, and that is deliberate: every service that is on is something listening while you are not looking.

SNMP

Switch this on if you have a monitoring system that may read the router. You choose between SNMPv2c, with a community as its only protection, and SNMPv3, with a user, an authentication password (SHA1) and a privacy password (AES). On a network where you do not control the traffic, v3 is the answer; inside a management VLAN you trust, v2c is defensible.

The Only from field restricts who may read. Leave it empty and the generator uses your management network. If there is none either, you get the warning that SNMP is reachable from any address, and it has earned that warning. In the script the default public community is disabled and one read-only community is added, with no write access.

NetFlow / IPFIX

Traffic flow export sends a summary of every connection to a collector: who, to where, how much. You fill in the collector address, the port (2055 by default) and the version: NetFlow v9, IPFIX or the old v5. The script enables /ip traffic-flow across all interfaces.

This answers the question "where is my bandwidth going". It says nothing about whether something works, and it costs processing on a busy device.

Other services

Graphing

Enables /tool graphing for interfaces, system resources and queues, visible through WebFig. The tool sets store-on-disk=no: the graphs live in memory and are gone after a reboot. For a quick look at the past few hours that is plenty, for history it is not.

NTP server for the LAN

Lets the router hand out the time to your network. Useful when you have devices that are not allowed out to the internet themselves.

UPnP

Lets devices open ports in your firewall by themselves. The configurator warns about it, and rightly so: it is the exact opposite of what the rest of your configuration is trying to do. Only switch it on for an application that really needs it, and know that your firewall is then no longer only yours.

Web proxy and SOCKS5

A proxy on port 8080 and a SOCKS proxy on 1080, both with an access rule that refuses everything outside your LAN. This is niche; most networks do not need it.

SMB share

Shares files from the router, with guests off and limited to the LAN interface list. Note that the script enables the service, but a user and a share are yours to create in /ip smb users and /ip smb shares. There is a comment in the script reminding you.

E-mail

The router can send mail. You fill in an SMTP server, a port (587 by default), TLS or STARTTLS, optionally a user and password, a sender and a recipient. On its own that does nothing: it is the base the backup and your own scripts lean on. Netwatch can use it too.

Backups

The weekly backup switch is one of the few fields from this part that also appears in the wizard, which tells you something: this is one that should nearly always be on. It creates a scheduler that does two things every week at half past three in the morning: a /system backup save with your backup password, and an /export. With e-mail and a recipient filled in, both files are mailed.

Two things to know. The export is made with show-sensitive, so passwords are in it in readable form: an export is a secret file. And without e-mail the files stay on the router, where they are worth precisely nothing at the moment you need them, because by then the device is broken. So fill in a recipient, or collect them yourself regularly.

Let's Encrypt

Put a hostname here and the script fetches a publicly trusted certificate for WebFig over HTTPS. It temporarily opens port 80 from WAN, requests the certificate with /certificate enable-ssl-certificate, removes that firewall rule again and enables www-ssl. RouterOS attaches the certificate to that service itself and renews it.

Conditions you cannot get around: the name has to point at this device's WAN address at the moment you paste, and you need RouterOS 7.1 or newer. The configurator says so in a warning. This certificate is for your management interface; the hotspot portal gets nothing out of it.

Your own scripts and the scheduler

At the bottom there is a table for custom scripts: a name, the source, and optionally an interval and a start time. Without an interval the script is put on the router but only runs when you start it. With an interval the generator adds a scheduler entry of the same name.

This is also the place for the script you want to call from netwatch: one line there, the real content here.

Updates, from the System part

Upgrading is not in this section but under System and time, although it belongs in the same conversation:

• Update channel: stable, long-term or testing. For a device you do not touch every week, long-term is a defensible choice.
• Automatic updates creates a script that checks every Sunday at four in the morning whether a new version exists and installs it. Mind the consequence: installing means rebooting. On a home router that is fine. On a device carrying a tunnel or a phone system you want to pick that moment yourself.
• Upgrade RouterBOOT automatically only appears on real RouterBOARD hardware and updates the bootloader when it lags behind.

And ZeroTier?

That one is not here but in the VPN part: a single field for your sixteen character network id. It needs the zerotier package, an ARM, ARM64 or x86 device and a device-mode confirmation, and after pasting you still have to authorise the new member in the ZeroTier console. See VPN for remote access.

What belongs in a base configuration

The right-hand column is not a matter of taste. Those are services that listen, and a service you do not use is also a service you cannot have misconfigured.

Much of what is here falls under device-mode: the scheduler, fetch, e-mail, proxy, SOCKS and SMB. With the scheduler set to no, as on many devices shipped in "home" mode, your weekly backup is ignored without an error. The checks above the script report it; verify with /system/device-mode/print.

Further reading: System and time, Netwatch and monitoring and Management access.