MikroControl
Sign in Get started

RouterOS 7+ · $1 / router / month

Operate every MikroTik from one portal.

Each router joins a private WireGuard spoke. From there you watch vitals, close WAN services, filter DNS, ship firmware, and catch compromise indicators — without exposing Winbox to the internet.

Get started Sign in to the portal

No per-user seats. No feature add-ons. Create an account and enroll the first router in minutes.

mikrocontrol.net/fleet

Fleet

Managed routers

12 total 11 online
Router Status
HQ Core online
Warehouse Edge online
Branch 12 clock
Tower AP online

Hub-and-spoke

Routers never see each other on the management overlay.

IoC alerts

SOCKS, extra users, persistence, and open WAN services.

NetFlow

Top talkers, destinations, and risk on 24h / 7d / 30d.

MSP tenancy

Master → reseller → client → site, with sibling isolation.

Features

The operations desk for RouterOS fleets.

One portal for the work you already do in Winbox — plus the alerts and reports you cannot see from a single box.

Isolated management tunnel

Each router is a WireGuard spoke with a /32 address. REST and SSH stay on the overlay. Site-to-site never shares this interface.

Fleet vitals

CPU, memory, disk, version, and handshake. Know who is online before the customer calls.

Compromise alerts

SOCKS, unexpected users, persistence scripts, MAC Telnet on all, and WAN services with empty ACLs — plus one-click mitigations.

Traffic reports

NetFlow v5 into 24h, 7d, and 30d reports: top talkers, destinations, ports, and a risk score per router.

DNS content filtering

Profiles for ads, malware, adult, social, streaming, and more. Quiet hours, DoH blocking, and MAC/IP bypasses.

Firmware and backups

Push RouterOS packages over the tunnel. Scheduled config exports, SHA-256 dedup, and diffs against the previous run.

Terminal and timed Winbox

In-browser SSH over WireGuard. When you need the native client, open Winbox from your IP for a limited window.

Built for MSPs

Hierarchical orgs, sites, and roles. Operators see their subtree. Siblings stay isolated.

How it works

Enroll a router. The spoke comes up on its own.

  1. 01

    Create your organization

    Sign up, name the MSP or client tree, and invite operators. Access follows the org hierarchy.

  2. 02

    Import the enrollment script

    Download a generated RouterOS script and import it in Winbox. The router builds a WireGuard spoke to MikroControl only.

  3. 03

    Operate over the tunnel

    Restrict WAN management, apply a filter profile, watch alerts, and keep firmware current — all without a public API.

Isolation

A management network that cannot become a mesh.

The overlay is hub-and-spoke by construction: per-peer /32 addresses, allowed-ips only the controller, and forwarding off. Routers talk to MikroControl, not to each other.

  • Restrict Winbox, SSH, and www to the tunnel — with an optional LAN exception.
  • Timed WAN Winbox from your current IP when you need the native client.
  • Continuous scans for WAN service exposure, rule drift, clock skew, and known IoCs.
MikroControl hub · 10.200.0.1 HQ Core Warehouse Branch 12 Tower AP No router-to-router paths on the management overlay

Pricing

Simple pricing that scales with the fleet.

One rate. Every operator feature. Pay for routers, not seats.

Operator plan

$1 per router / month

Billed on the routers you enroll. No per-user fees, no add-on SKUs.

  • Unlimited operators and organizations
  • Isolated WireGuard management overlay
  • Vitals, alerts, reports, DNS profiles, firmware, backups
  • In-browser SSH and timed Winbox
Get started

Already have an account? Sign in

Questions

Do I have to expose Winbox on the internet?

No. Enroll over a private spoke, then restrict www, SSH, Winbox, and API to the tunnel. Timed Winbox is a short, source-IP firewall accept when you need the native client.

Can managed routers reach each other?

Not on the management overlay. Each peer is a /32 with allowed-ips set only to the controller. Site-to-site, when it ships, will be a separate overlay.

Which RouterOS versions are supported?

RouterOS 7 and newer, including classic wireless and wifiwave2 hardware. Enrollment is a standard import of a generated .rsc.

How does the $1 per router price work?

You pay one dollar per managed router per month. Operators, organizations, and sites are included. Create an account to enroll — no extra SKUs for reports, filtering, or terminal access.

Put the fleet on a tunnel. Keep Winbox off the WAN.

Create an account, enroll the first router, and start operating at $1 per router per month.

Get started Sign in