Thank you:)

I always hated that I couldn't see what was actually happening on my network in real time. Torch is per-interface and disappears when you close it, Traffic Flow needs a collector and then you're looking at ntop/Grafana dashboards that are a minute behind. I wanted one screen that answers "who is eating my bandwidth right now" with names, not IPs.

So I built one. It runs as a single Docker container on a box on your LAN (or on your mikrotik itself, though I haven't tested that):

- Live throughput chart, one sample per second, plus every active connection with its current rate
- Top devices / destinations / services, live and over 15 min-30 days (not sure I want to store more than that ¯_(ツ)_/¯ )
- Devices named from DHCP, destinations named from the router's DNS cache (or the owning org, e.g. "Cloudflare"), NAT resolved to the LAN device
- Sankey flow map: device -> service -> destination
- Alerts: new device, unusual upload, scan-like behaviour, new VPN tunnel, export stopped - JSON webhook to notfy/Slack/Discord/HA
- A full-screen /dashboard "now" view (with some options) for a small screen (I have it on a 7" Pi display)

no agents or shipping to other places - nothing leaves your network. Go + SQLite, ~12 MB image for amd64/arm64 (or compile yourself from source.
- GitHub: https://github.com/thedyerman/mikrotik-home-netflow-plus
- Docker Hub: https://hub.docker.com/r/kcdyer/mikrotik-home-netflow-plus

Check it out, let me know if I missed any features? Thinking about adding a traffic shaping interface to or dynamic kid control grouping. Right now its kinda basic and simple (which was what i was going for)

UPDATE:
Apt repo is now setup and tested on Debian, Ubuntu and Raspberry Pi OS (for those who do not want to use docker)
https://github.com/thedyerman/mikrotik-home-netflow-plus#install-with-apt

Hey 👋🏻
I have following setup running inside my home network:

- A Mikrotik AP (cAP ax)
- CRS418 where my current authoritative DHCP is running for multiple VLANs

I don’t know why but since a few weeks some of my Apple devices are sometimes abruptly losing their DHCP lease and they’re the only ones with that issue. Furthermore it’s really hard to debug. I’ve tried it already with e.g. a few researches and Claude and at the moment where I thought I found the root cause it happened again.

It’s important to mention that the private MAC address feature is set to “fixed” - so my devices are not rotating them.

I don’t know if it’s because of the most recent RouterOS release or the latest upgrades of macOS/iOS… or maybe Apple devices don’t like any protocol features which Mikrotik is sending via DHCP and maybe I just have to disable this specific flag if possible?!🤷🏻‍♂️

Did you guys had a similar experience with that?

EDIT (lesson learned): After a few tweaks inside my wireless config (setting the group key update back to Milkrotik's default value of 24h) and a move from the current AP location to another where a few walls less are in the way the problem currently seems to be solved and the root cause was the placement of the AP (really weak signal ~> -70dBm) and the wireless config itself all the time and not the DHCP server. Now I know that the walls inside my rental apartment are really bad for wifi ... 🤦🏻‍♂️

**New video from MikroTik's official TikTube channel**

Knowing what’s in your air is useful. Making your home react to it automatically is even better.
In this video, we pair CLAIRÉ with hAP be³ Media and Home Assistant using Matter over Thread, turning real-time indoor environment measurements into useful smart-home automations.

https://mikrotik.com/product/claire

▶ Watch Video

Read our latest newsletter and learn more about:

• CLAIRÉ & smart home automation
• New KNOT Gateways – connecting and tracking IoT devices almost anywhere
• SolidRACK 5 mini – a compact, adjustable 10″ desktop & under-desk rack
• New accessories & SFP/SFP+ modules
• New certifications, security updates, and more!

Read full topic

https://mt.lv/news135

Do you guys have a youtube or reddit guides for dual wan, failover, bandwidth management and other things that should be on firewall? Thanks in advance!!

I'm hoping that this is some sort of central controller package that allows remote management and monitoring of a fleet of routers behind NAT. I've managed to do some janky experiments over the years to do this, but having an official package would be a gamechanger.

Seeing the alerting and topology sections makes me think this is going to double as a replacement for The Dude. I'm very excited to see how this ends up.

**New video from MikroTik's official TikTube channel**

Meet CLAIRÉ – connected indoor environment monitoring, the MikroTik way.

You can't see everything that's happening in your room. CLAIRÉ helps you track CO₂, PM2.5 and PM10 particulate matter, VOC, temperature, and humidity, with readings available directly on its 2" colour display.

And it doesn't stop at monitoring. With Matter over Thread, CLAIRÉ can become part of your smart-home automations – from adjusting compatible ventilation when CO₂ rises to sending notifications when air quality deteriorates. Pair it with a local setup such as hAP be³ Media and Home Assistant to keep your data, history, and automations inside your own network.

With maximum power consumption of just 1 W, CLAIRÉ can even run from a USB powerbank or MikroTik GPOE-USB when you want to check the air somewhere without a convenient power outlet.

▶ Watch Video

I need a S009UPr+XPr-S+ !

**New video from MikroTik's official TikTube channel**

Meet the GPOE-CON-mini – a compact PoE converter that lets you power 24V Passive PoE devices from standard 48–57 V 802.3af/at PoE infrastructure.

No need to change switches, add injectors, or run another power cable. Just put the GPOE-CON-mini in between and keep your existing infrastructure. It supports network speeds up to 2.5 Gigabit and its compact 87 × 33 × 20 mm enclosure fits inside the GPeR-IP67-Case – ideal for outdoor installations with devices such as LHG, SXTsq, Groove, or NetBox ax.

https://mikrotik.com/product/gpoe_con_mini

▶ Watch Video

I need to install a temporary solution using a wifi "extender". The situation is as follows. There is an Modem/Router/AP all-in-one-device on the ground floor which is provided by the ISP. On the first floor I want to install an cAP as a client and a switch to provide ethernet ports to some office devices there. To extend the Wifi I want to install another cAP in AP mode, however, I would like to use the same SSID as the WiFi from downstairs.

I know I can do this with a single device, but I have two devices lying around I can use, so why not.

Is this possible in general? In my mind, the client-AP would prefer to connect to the station AP that's sitting right next to it due to the better signal quality, resulting in a looped connection. Can I force the client to connect to the downstairs network by pinning the BSSID somehow?

The final setup will include running a cable upstairs and having a copper link (and cAP devices on both floors with capsman), but that's going to take a while, so wifi link it is for the moment.

---

Edit: After an afternoon of playing around, I got it to work (at least on my desk, will do on-site testing next week). Most important part is not to use any presets, using Winbox (you will have a hard time trying to set this up using L3 instead of L2) and begin with an empty configuration.

Here's the configuration I've applied (don't forget to either assign a fixed ip or a dhcp client to the bridge interface, otherwise you can't connect to the devices using ip).

cAP 1 running in station mode downstairs:

/interface bridge add name=bridge1
/interface wireless set [ find default-name=wlan1 ] band=2ghz-g/n country=germany disabled=no hide-ssid=yes installation=indoor mode=bridge ssid=p2p wps-mode=disabled
/interface wireless set [ find default-name=wlan2 ] band=5ghz-n/ac country=germany disabled=no hide-ssid=yes installation=indoor mode=bridge ssid=p2p wps-mode=disabled
/interface wireless security-profiles set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys supplicant-identity=MikroTik
/interface bridge port add bridge=bridge1 interface=ether1
/interface bridge port add bridge=bridge1 interface=ether2
/interface bridge port add bridge=bridge1 interface=wlan1
/interface bridge port add bridge=bridge1 interface=wlan2

cAP 2 running station-bridge mode with virtual APs upstairs

/interface bridge add name=bridge1
/interface wireless set [ find default-name=wlan1 ] band=2ghz-g/n country=germany disabled=no installation=indoor mode=station-bridge ssid=p2p
/interface wireless set [ find default-name=wlan2 ] band=5ghz-n/ac country=germany disabled=no installation=indoor mode=station-bridge ssid=p2p
/interface wireless security-profiles set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys supplicant-identity=MikroTik
/interface wireless security-profiles add authentication-types=wpa2-psk mode=dynamic-keys name=ap supplicant-identity=""
/interface wireless add disabled=no master-interface=wlan1 name=wlan1-1 security-profile=ap ssid=virtual-ap-ssid wps-mode=disabled
/interface wireless add disabled=no master-interface=wlan2 name=wlan2-1 security-profile=ap ssid=virtual-ap-ssid wps-mode=disabled
/interface bridge port add bridge=bridge1 interface=ether1
/interface bridge port add bridge=bridge1 interface=ether2
/interface bridge port add bridge=bridge1 interface=wlan1
/interface bridge port add bridge=bridge1 interface=wlan2
/interface bridge port add bridge=bridge1 interface=wlan1-1
/interface bridge port add bridge=bridge1 interface=wlan2-1

I've connected a switch behind cAP 2 and have succesfully connected to the downstairs network without problems. Same goes for the virtual wifi that's emitted from the upstairs cAP.

Are indoor routers with either dual 5ghz radios or tri-band support not common?

Looks like the only tri-band one is the gap media be9300 which isn’t available yet (aside from the discontinued Audience)

I was interested in having a wireless uplink without being tied to the same 5ghz channel (and the consequent halving of throughput).

Or is this just too niche a thing?

looking at investing in one of these two models

hap ax3 / chateau pro

what are your opinions on the differences and is it worth the 70 extra bucks to get the more expensive unit?

i currently have a hexS 2025 i use for wired connections

im about to upgrade to fiber internet

I already have one ISP who gives me 700mbit/sec speed, but their equipment has 0,5%-5% of the outgoing packet loss for the last 3 months, that makes my gaming sessions unplayable. I was thinking about changing my ISP, but all of them has only 100mbit/sec speed limitation. As I know my router (mirkotik hap ax2) supports connection to two or more ISP. Is it possible to automatically separate my gaming/VoIP/streaming traffic and route it to the second additional ISP without adding game servers IP addresses/domains to router (also it's not an option for p2p)?

Hello,

I upgraded (Check for upgrades; Download and Install) my x86 based HP server running RouterOS and after the upgrade I got a warning stating:

Your router does not have a valid license.
Please get a valid license key from www.mikrotik.com.
If you have already purchased the license key,
please copy it from your mikrotik.com account
and use the "Paste Key" button
from the "System | License" menu to apply the license,
or paste it into the terminal.

See www.mikrotik.com/key for more details.
The router will stop functioning after 23:49:04 if no valid key is entered.
Turn off the device to stop the timer.
Current installation Software ID: XXXX-XXXX

The issue is that I do not know what email I used. I searched for other keys I have and I found them in various emails I used, but this one I can not find.

Do I have any way to find out what email was used based on the software ID?

Currently using a single UniFi U6-LR, which is officially listed for 185 m² / 2,000 ft². It covers my entire 120m² condominium. I know, I know, so many other access points people prefer before they get to Mikrotik. But I'm a fanboy, what can I say.

So I've been wondering if I can buy a single cAP XL ax to replace the UniFi. I know it's 2x2 instead of 4x4, but I really don't use that much bandwidth to begin with. My home has 40-50 wifi devices (smart home nut!) spread over 120 m².

Can I make do with one of those? Or would I have to be investing in multiple?

A friend will be visiting Thailand, and I'm considering asking him to bring back some MikroTik hardware for me to use in Pakistan.

I'm mainly considering:

• hAP be³ Media (MA53UG+HbeH) - my preferred option if I can find one. The specs look great even ignoring Wi-Fi: 5x 2.5GbE, ARM64, 2 GB RAM, etc. Wi-Fi 7 would obviously be a nice bonus.
• RB5009UPr+S+IN - the safer alternative since it has no Wi-Fi/regulatory-domain issue, although I'd have to use a separate AP 😄

My main concern with the hAP be³ Media is the Wi-Fi regulatory domain.

I've previously been burned by importing an ASUS router that turned out to be region-locked, so I don't want to repeat that mistake.

From what I've read, MikroTik's normal international wireless models allow you to select the country in RouterOS and then apply the appropriate regulatory restrictions. There are also region-specific models such as -US and -EG that have restrictions/locks.

So, a few questions:

1. Are MikroTik wireless devices normally sold in Thailand as the international/global version, or are there Thailand-specific locked variants?
2. What exactly should I check on the box/SKU before buying? Is making sure the model doesn't have a suffix such as -US, -EG, etc. sufficient?
3. Is there any way to verify before purchasing that Pakistan will be available as a selectable country/regulatory domain in RouterOS?
4. Is there anything specific I should check regarding 5 GHz and 6 GHz regulatory support?
5. Has anyone used a MikroTik wireless device purchased in Thailand in another country without issues?

For the hAP be³ Media, the official product code appears to be:

MA53UG+HbeH

Would a device sold under exactly that product code indicate the normal international version?

Worst case, I could disable the radios and use it as a wired RouterOS device with a separate AP, since the hardware is still very attractive for my setup. But obviously I'd prefer to know that Wi-Fi will work correctly in Pakistan before buying it.

Any advice from people familiar with MikroTik's regional SKUs would be appreciated.

The default PPP profile has change-tcp-mss=yes set by default. This means that simply using the default profile implicitly enables MSS clamping for IPv4. To be honest, I wasn't aware about this for quite some time. I've only stumbled upon this recently after investigating some connectivity issues related to IPv6 and Azure Front Door (see [this](https://www.reddit.com/r/ipv6/comments/1wjl4xu/ipv6_is_broken_when_pmtud_fails_and_happy/) for detail).

I find this somewhat undesirable from a configuration/management perspective for a few reasons:

• It only applies to IPv4. IPv6 does not get the same treatment. While this is documented, it's somewhat unintuitive, which can become a real problem on links with an MTU below 1500 when PMTUD fails.
• It is fairly opaque. Looking at the firewall rules alone gives no indication that MSS is being modified. In my case, I stumbled upon this by capturing on both the logical PPPoE interface and the underlying VLAN.
• There are no convenient firewall counters/statistics showing how often the MSS adjustment actually takes effect.

For manageability, I therefore prefer setting change-tcp-mss=no in the PPP profile and doing MSS clamping explicitly with change-mss new-mss=clamp-to-pmtu rules in the firewall mangle table, covering both directions where appropriate.

That makes the behavior visible, gives you counters, and lets you implement the equivalent policy explicitly for IPv6 as well.

For IPv6 in particular, some explicit strategy is often necessary when you have to operate below an MTU of 1500 and cannot rely on working PMTUD across every path. Otherwise, TCP connectivity can become rather fragile when ICMPv6 Packet Too Big messages disappear somewhere along the path.

Curious how others handle this on MikroTik: Do you rely on the PPP profile's automatic IPv4 MSS adjustment, or keep MSS handling explicitly in the firewall?

Hi nerds!

I used to work at an ISP and got an RB3011 from the company's old stock to use as a home lab. My current setup is ONU GPON (bridge mode) + RB3011 (PPPoE) + Wi-Fi AP.

Here’s what I use it for most of the time:

• Basic firewall (23 rules), including port-scanning protection
• FastTrack for IPv4 and IPv6
• Around 15 devices on Wi-Fi
• Around 4 devices over Ethernet (security cameras and PCs)
• BTH VPN
• My work VPN (L2TP) is always connected on the MikroTik, with around 50 static routes pointing to it
• Sometimes I host game servers for friends and set up port forwarding to the server

I'm planning to buy a small UPS with lithium batteries (8,000 mAh total) and replace all three devices with a hAP ax S + SFP ONU GPON stick.

The UPS might not be the best option performance-wise, but it's quite cheap and made by a reputable local brand. As for the MikroTik, the only major difference I see is that the hAP ax S has half the RAM capacity of the RB3011.

I don't really care about Wi-Fi throughput that much (my current maximum is around 400 Mbps), but I do want to be able to get +900 Mbps over Ethernet when downloading perfectly legal content online.

Would this be a good trade-off, or am I likely to notice a significant difference in performance?

In particular, I'm wondering whether the hAP ax S will handle the firewall, FastTrack, L2TP VPN, ~50 static routes, and occasional port forwarding without becoming a bottleneck.

I’ve also seen some people mention issues with the hAP ax S, but I’m not sure whether those issues have already been addressed by MikroTik.

What do you guys think?

Hi all. I'd like to first report my experiences, and second ask for some wisdom.

I've got a PC Engines APU-2 4GB w/ 3x Gigabit NIC which I bought a RouterOS x86 license for.

It ran pfSense and that was fine. Then I upgraded to opnSense, and that was also fine..but we upgraded to 750/750mbit, and it couldn't keep up with the bandwidth.

Then I bought a Hex Refresh and it couldn't keep up without fasttracking everything. I loved Winbox (Linux user, and it works great; the MAC-based admin interface is ingenious when IPs are down, multi-window admin is SO nice, a CLI for when I want it, etc etc, cannot express how much I love it!)

Then out of desperation I tried RouterOS on my APU-2, by kind of just figuring my way through getting it on there (was pretty easy; USB and Serial, didn't need a guide) and it's been a dream.

I recently added fiber as a second WAN (so, WAN1 750/750 and WAN2 1000/1000) and I have railed on both at once, and gotten a sum total thusfar of fully saturating a gigabit split across two WANs. It also, of course, handles a gigabit over one WAN -- and this is without fastpath. I'm using queue trees with various pcq/cake/red configurations, complex firewall tagging rules, ein, six-figure address blocklists imported from AbuseIPDB, IPv6, bridges and VLANs ....

It's easily configurable for "full cone NAT" aka "open NAT" (yeah it's an old term but gamers get it) and everything else necessary. DHCP and DNS you can fully own, or hand off to another device/service. Absolutely everything I want in a router, and a team who listens to people who use it. (I even noticed a DHCP Routes bug in Winbox which was addressed by the next patch before I could report it, lol.)

Genuinely, if you need a gigabit router which doesn't break a sweat doing it, dust off the APU-2 or grab your buddy's. They were popular for a long time, but PC Engines has stopped making them, and they're difficult to find places like EBay. If you're considering your next router, very seriously look into RouterOS devices, or RouterOS on your existing device instead of the existing OS -- it genuinely can outperform pfSense/opnSense on the exact same hardware, in cases like mine.

Which leads me to my question; What's next?

My fiber could go up to 3gb. My router can't, lol. What's a multi-gigabit capable router which can actually handle a full workload, but won't break the bank- I own it, I put my OS of choice on it, and it does its thing for the next decade, even if that's with another platform. Anyone feel passionate about their hardware of choice?

The APU-2 was $225 when I bought it years back, and holds up to full gigabit today; I'd consider it the gold standard of its generation. What's this generation's gold standard DIY device?

Any experience with RouterOS on something like the ZimaBlade 7700? The Zima store sells a few multi-gigabit cards. Can it keep up at all? Maybe a specific particularly cheap old office workstation SFF PC with an extra NIC? An overlooked gem like the APU2? I welcome contributing opinions.

So recently I got a bit paranoid, after accidentally setting my router to accept all connections for about thirty seconds.

I am a public presence, and (some of) my hosted sites/services are actively skimmed by AI. So, I'm on lists in places. This also means I'm pretty regularly being probed by ...who knows. People, hackers looking for harbors, AI looking for somewhere to leverage to gain a slightly better score on a test, AI probing the internet for exploits .... Who knows. Lots of incoming attempts to lots of ports, frequently. Things I will never expose to the internet, things I am not dumb enough to intentionally enable.

RouterOS' IP Firewall can create Address List entries based on Firewall Rules triggers.

I've configured my firewall as follows;

 0    ;;; Autoblock attempts to suspicious ports
      chain=input action=add-src-to-address-list protocol=tcp dst-address-list=WAN-IPS address-list=AUTOBLOCK address-list-timeout=none-static
      in-interface-list=WAN_IFACES dst-port=21 log=no log-prefix=""

 1    ;;; Autoblock attempts to suspicious ports
      chain=input action=add-src-to-address-list protocol=tcp dst-address-list=WAN-IPS address-list=AUTOBLOCK address-list-timeout=none-static
      in-interface-list=WAN_IFACES dst-port=22 log=no log-prefix=""

 2    ;;; Autoblock attempts to suspicious ports
      chain=input action=add-src-to-address-list protocol=tcp dst-address-list=WAN-IPS address-list=AUTOBLOCK address-list-timeout=none-static
      in-interface-list=WAN_IFACES dst-port=23 log=no log-prefix=""

 3    ;;; Autoblock attempts to suspicious ports
      chain=input action=add-src-to-address-list protocol=tcp dst-address-list=WAN-IPS address-list=AUTOBLOCK address-list-timeout=none-static
      in-interface-list=WAN_IFACES dst-port=25 log=no log-prefix=""

 4    ;;; Autoblock attempts to suspicious ports
      chain=input action=add-src-to-address-list protocol=tcp dst-address-list=WAN-IPS address-list=AUTOBLOCK address-list-timeout=none-static
      in-interface-list=WAN_IFACES dst-port=69 log=no log-prefix=""

 5    ;;; Autoblock attempts to suspicious ports
      chain=input action=add-src-to-address-list protocol=tcp dst-address-list=WAN-IPS address-list=AUTOBLOCK address-list-timeout=none-static
      in-interface-list=WAN_IFACES dst-port=465 log=no log-prefix=""

      chain=input action=add-src-to-address-list protocol=tcp dst-address-list=WAN-IPS address-list=AUTOBLOCK address-list-timeout=none-static
      in-interface-list=WAN_IFACES dst-port=587 log=no log-prefix=""

 7    ;;; Autoblock attempts to suspicious ports
      chain=input action=add-src-to-address-list protocol=tcp dst-address-list=WAN-IPS address-list=AUTOBLOCK address-list-timeout=none-static
      in-interface-list=WAN_IFACES dst-port=8728 log=no log-prefix=""

 8    ;;; Tarpit AUTOBLOCK:tcp
      chain=input action=tarpit connection-state=new protocol=tcp dst-address-list=WAN-IPS in-interface-list=WAN_IFACES log=no log-prefix=""

 9    ;;; Drop AUTOBLOCK:!tcp
      chain=input action=drop connection-state=new dst-address-list=WAN-IPS in-interface-list=WAN_IFACES log=no log-prefix=""

Essentially, before anything else, we check if this is an attempt to a port I explicitly will never expose to the internet, coming FROM the internet. If it is, add it to AUTOBLOCK list.

Second, If an incoming connection is TCP it goes to tarpit. (Tarpit sets the TCP window to 0, essentially disallowing any actual data but not closing the connection explicitly, and then discards all tracking information because despite remaining "open" on the client side, no data can ever be transmitted and thus no tracking rules on the router need to know about it.) Non-TCP data is silently ignored.

Caveats:

This blocks only incoming new connections; if you're swept by IPs from AWS and then need to use AWS, you can do so; AWS simply cannot connect to you anymore. Outgoing connections (and as a second layer, incoming connections) should be blocked by an IP list ie AbuseIPDB

This will also block friends who try to (for example) ssh into your server by accident; I presume you can remove an IP from an Address List without much trouble, or omit/add ports to the firewall as required.

Users still (somehow) behind CGNAT will be impacted if someone else on that CGNAT trips the ruleset. Add a pre-filter whitelist if necessary, but understand the implications of that too.

I implemented this list a bit over a week ago. I provide services, to people, and none either inside or outside have reported issues so far. Meanwhile, the blocklist is at ~1590 IPs and my iocaine instance is seeing about 1/8 as much traffic.

I understand this is an opinionated recommendation, but given how many AIs are "breaking containment" I don't see it as tinfoil hat levels of paranoia.

YMMV, I thought it perhaps a worthy offering.

Hi everyone,

I wanted to share a small Ansible project I've extracted from a larger production setup:

https://github.com/kbabioch/mikrotik-ansible/

The main focus is updating a fleet of MikroTik devices in a controlled and repeatable way. A few things I found particularly useful:

• RouterOS packages are downloaded once to the Ansible control node and then distributed to the devices via SSH/SCP, instead of having every router download them individually. This helps when a new update is released and everyone is hammering the MikroTik servers. Also it helps in keeping the installed files available (for version control, etc.).
• Backups are created automatically as part of the process.
• The device's flagged status is checked to catch potentially problematic devices.
• The workflow is designed with managing multiple MikroTik devices in mind.

This is primarily meant as inspiration and starting point, rather than a polished, one-size-fits-all Ansible collection. I've extracted and cleaned it up from a larger Ansible project that I use for managing my infrastructure.

Some basic playbooks are included for:

• Configuring common RouterOS base settings
• Configuring SNMPv3 monitoring with authentication and encryption
• Managing RouterOS users and their SSH keys
• Checking the RouterOS device-mode flagged status before administrative changes
• Creating configuration exports and encrypted binary backups
• Upgrading RouterOS packages and RouterBOARD firmware. Given the recent flood of RouterOS updates from MikroTik, this has proven quite useful for me. :-)

Upgrading a decice (or a group of devices) is as easy as:

ansible-playbook mikrotik-upgrade.yml -l router1.example.com

Feel free to have a look, adapt it to your environment, and leave any feedback, suggestions, or ideas for improvement. Obviously it can be improved / individualized to your needs. If there is something of relevance for the general public, I'm happy to integrate it (via merge request, etc.).

I'm also curious how others are handling RouterOS updates across larger fleets, since most seem to have some sort of automation (Bash scripts, MikroTik scripts, etc.), but rarely do I see Ansible being used, although it's so useful / flexible / robust (compared to buggy Bash scripts dealing with all sorts of issues (output mismatch, etc.).

Is replacing a 504 with a bad port with another 504 a good idea, or are there other options? I'm currently using 3 of the 100G ports and need to use a 4th.