MikroTik backup automation
Scheduled RouterOS backups for your whole fleet
Stop SSHing into routers one by one to run /system backup. mikroHUB schedules automatic config backups across every MikroTik you manage, pulls them over each device's own SSH/SFTP, and keeps them ready to restore.
How it works
Set a schedule once and mikroHUB handles the rest — no scripts to maintain, no manual exports.
Scheduled, automatic backups
Pick a cadence and mikroHUB backs up each router on its own schedule. No cron jobs on the device, no one remembering to do it by hand.
Pulled over the device's own SSH/SFTP
Backups are pulled over the router's existing SSH/SFTP access — the same way you already reach it. Nothing new to install on the device.
Works behind CGNAT over WireGuard
Routers stuck on carrier-grade NAT with no public IP are reachable through a mikroHUB WireGuard tunnel, so backups run on LTE links too.
Full .backup plus readable .rsc export
Each run captures a byte-perfect binary .backup for full restore and an exported .rsc you can open, read, and diff in any text editor.
Why it matters
A backup you didn't take is the one you need at 2 a.m. mikroHUB makes sure every router in the fleet is covered.
Fleet-wide coverage
Back up three routers or three hundred from one place. New devices are picked up automatically, so nothing slips through the cracks.
Restore after a bad change or dead device
Locked yourself out with a firewall rule or lost a router to hardware failure? Restore the last known-good config instead of rebuilding it by hand.
Kept per device, timestamped
Every backup is stored against its device and timestamped, so you can grab the exact version from before a change went wrong.
Credentials protected by an encrypted vault
Device credentials live in a zero-trust, AES-256-GCM encrypted vault — never stored in plaintext, and your backups stay scoped to your org with row-level security.
No extra infrastructure to run
mikroHUB reuses the SSH access your routers already expose. There's no FTP or backup server to stand up, harden, and expose to the internet — one less box to patch and one less attack surface to worry about.
Because backups are pulled over each device's own SSH/SFTP — including through WireGuard for routers behind CGNAT — you don't open new inbound ports or push files to a third-party endpoint. Existing access is all it takes.
Frequently asked questions
How often can backups run?
You set the schedule per fleet, so backups can run on whatever cadence fits your change frequency. Each device follows the schedule automatically with no manual trigger.
Does it work behind CGNAT or NAT?
Yes. Routers with no public IP — typical on LTE behind carrier-grade NAT — are reached through a mikroHUB WireGuard tunnel, and backups are pulled over that link just like any other device.
What's the difference between .backup and .rsc?
The binary .backup is a complete, byte-perfect snapshot for restoring a device to its exact prior state. The .rsc is a human-readable export of the configuration you can read and edit in any text editor.
Can I restore a backup to a device?
Yes. When a change goes wrong or hardware fails, restore the last known-good config from the timestamped backups kept for that device instead of rebuilding it from scratch.
Are my device credentials safe?
Credentials are held in a zero-trust vault encrypted with AES-256-GCM and are never stored in plaintext. Backups are scoped to your organization and isolated by row-level security.
Related
Put your RouterOS backups on autopilot
Connect your MikroTiks, set a schedule, and let mikroHUB keep every config backed up and ready to restore. Free for up to 3 devices.