I have a number of (~100) mikrotik routers that I manage.
I need to add a firewall rule on all of them due to an IP address change.
On many of them the ONLY IP service that is enabled is Winbox (so no API, SSH etc)
Is there any way of automating/scripting the update through winbox - I don't mind if it is launch "winbox for each router with these parameters" as it is a one off and I can write batch scripts...
If I had SSH enabled I could probably script putty to login, send the commands and log out but that is not an option.
THis is not the soultion you are looking for but as you need to perform changes on all devices I would develop a secure method for you to do this in the future without having to use Winbox. So design a way to use SSH for API, what fits you best, and that is also secure.
When you know what you want to do you just manually change the routers IP + enable remove management so next time you need to do this like force update or what ever you need this can be done via a secure documented way.
As stated does not help you now but will help you next time!
There are lots of options. I sell two of them. https://admiral.linktechs.net/auth/users/auth/login is one, offers script roll-outs, backups and allows you to assign users (home users) to mange devices. https://cloudv3.linktechs.net/login is another one, cheaper, allows you to push scripts out,also does backups, but does not allow remote users to manage devices. Both are self signup and such, both are great Cloud MikroTik Management tools. Both, once the devices are connected, will allow you to push a script to all or some of the devices and update them quickly and effectively. We manage thousands of MikroTiks though both of these solutions.
The problem isn't adding it... but... where?
If you simply add it using "ros_command(...)" in The Dude, SSH, or whatever else, how do you then place it in the right spot?
@djmuk, Maybe a little OT and not really an answer to your question at this point, but with around 100 remotely managed routers, some form of central configuration management, whether TR-069 or something else, together with independent OOB access is pretty much a must.
TR-069 can push configuration changes and run RouterOS scripts via .alter files, so changes can be handled centrally instead of logging into 100 routers one by one.
Of course, that doesn’t help much with the current problem unless it was already provisioned. But going forward I’d definitely make sure there is an automation interface, together with staged deployment and some form of rollback/recovery.
And for your sake, I sincerely hope the Winbox access is behind a VPN. Also, having Winbox as the only management path to 100 remote routers is pretty fragile, to say the least. Winbox should really only be your interactive management tool for one-off operations, not your general configuration management system.
Anyway, as for your actual question, there really isn’t any simple or supported way to automate Winbox itself. You can automate launching and logging in, but not reliably execute RouterOS commands through it.
I suppose you could try OpenClaw if you’re feeling brave.
And yes, that last bit was a joke! I would never ever trust AI-driven GUI automation with firewall changes on ~100 remote routers.
Winbox is over a VPN or restricted by IP address, this has sort of grown like topsy.
This is NOT a fleet of ISP routers - they are all customer site routers with individual configs so I haven't been that bothered about centralised config management, but If i'm going to have to touch each one for this change then adding some centralised management seems sensible...
Lots of options there, just a few. Those do cost something, but i would think the Admiral would be great if they are consumer routers. Not that you need a backup of them, but what is really neat is you can put in their access (email) and then they can login using their own user/pass to the web GUI of Admiral and make SSID, network, and key changes.
The ros_command() "function" is intended to be used to derive monitorable values from devices. But with the tinkering suggested by rex, you can use it to run "any" command. With the caveat that it's going to run on a regular polling cycle (every 30s by default), so you want to try and include some "if" style qualifications, again as rex suggests, otherwise you may insert the same FW rule many, many times.
More of a possible issue (started I think around the beginning of v7) versions of the Dude have trouble maintaining persistent connections to large numbers of Mikrotik devices using the "Router OS" connection option, which is required to run the ros_command().
Those issues aside, you want to start by defining a new "function" using the ros_command() as detailed by rex. Then add a new probe that uses that function and finally add that probe to the devices you want it to run on (This last part can be done though a multiple selection of devices). Devices in general can be added to a map manually or via a subnet scan (in the map settings).
Personally I love the Dude, despite it's numerous failings and lack of attention from Mikrotik. I find the live documentation style of monitoring and the philosophy of extensibility very pleasing. I also find it incredibly annoying that orchestration in general has basically been ignored or at the very least "sub contracted" by Mikrotik for so many years now, whilst every single other producer of networking gear makes a least some effort to build native fleet management tools, some of which are embarrassingly good.
@excession Kudos!
I like seeing people with an open mind.
Maybe one day you’ll f-kng hate my guts and tell me to go f-k myself,
but for now, I’m glad you like the advice.
I find your posts to be very informative rex and always at the highest technical standard. The amount of energy you've put into helping others here is remarkable and well worth the occasional rough edge that advice is sometimes delivered with.
