This guide assumes the reader has a basic understanding of typical use cases and technologies/protocols used in an ISP/Telco production environment.

The guide will be focused on RouterOS v7 as it is the current version of RouterOS.

As of RouterOS v7.7 it still uses legacy iptables for packet filtering instead of nftables, which has a negative impact on performance.

RouterOS is based on the Linux Kernel.

The tests confirmed that the configuration does not disrupt layer 4 protocols or cause problems for end-users in the last mile. As of 2022-23 I tested the configuration on my own network ( AS149794), including the firewall rules, to ensure it would work in any environment as long as the instructions are followed.In 2021-22, I tested the configuration further as a downstream customer on AS132559 (IP Transit provider & medium-sized ISP), where I was able to assess the impact and config changes both as an end-user and a consultant.The configuration was first tested and deployed on AS135756 (small-sized ISP) with its proprietor and my peer Mr.I recommend you follow the source here for the most up-to-date information.

This guide is also available on the APNIC Blog, but it is not frequently updated there. In this guide, I will explore common issues and solutions along with best practices. Many ISPs around the globe use MikroTik RouterOS to provide access to their customers via BNGs over PPPoE and for various other roles such as edge routers. The guide will be updated regularly as new technologies, use cases, and more efficient configurations are discovered.

This guide provides configuration instructions for MikroTik RouterOS, but the principles can be applied to other Network Operating Systems (NOSes) as well.

Your donation will help me conduct valuable experiments. Last updated on 23 February 2023 It would be appreciated if you could help me continue to provide valuable network engineering content by supporting my non-profit solitary efforts.

Mikrotik transparent firewall