A companion for the MikroTik work you do every week.

What it's for

Three jobs, done properly

Everything else the app does is convenience. These are the reasons to install it.

• CGNAT you can reason about

  Design a netmap pool from its parameters, watch every block tile as you type, and review the diff before it is applied. Each rule carries its own definition, so the router stays the source of truth.

  • Two-level jump chains, so rule evaluation stays fast with hundreds of blocks.
  • Idempotent: applying the same pool twice changes nothing.
  • Export a pool as a RouterOS script when you would rather paste it yourself.
  Read more →

• A security audit that only reads

  Seventeen checks across services, accounts, firewall, discovery, certificates and the clock. Every finding carries what was actually found and, where one command fixes it, that command.

  • Clear-text services, logins open to the internet, an input chain that never drops, open resolvers.
  • Nothing is applied. Several of these fixes can lock you out of the router you are auditing.
  • A menu the router will not return is reported as not run — never as passed.
  Read more →

• WireGuard without the ceremony

  Create an interface, add a peer, and hand the client its configuration as text, a file or a QR code — without handling a key yourself.

  • Keypairs are generated on your Mac; only the public key ever reaches the router.
  • The private key is shown once and never stored.
  • Peers list their last handshake and transfer, so a stale one is obvious.
  Read more →

How it works

The router is the source of truth

Every rule carries a structured comment encoding the entire pool. On connect the app reads the live rules, rebuilds the pools from those comments, and diffs what you want against what is there.

Plan

• + 2 create
• ~ 67 update
• − 66 delete

You review the plan before anything is written.

Applying the same pool twice is a no-op, and rules without a valid mikro: comment are never touched.

Everything under the router it belongs to

Save a profile per router and switch between them. Connect, and the sidebar fills in.

• Overview

  Identity, model, RouterOS version and uptime, with live CPU, memory and storage meters.

• Health

  Sample the connection table for per-block port utilisation and the busiest clients.

• DNS

  Resolvers, cache, DNS-over-HTTPS and static entries.

• Time

  NTP client with regional pool.ntp.org presets.

• Logs

  The router's log, newest first, filtered by text or severity.

• Snapshots

  Dated configuration records with a diff between any two, plus real router backups.

Built to be careful

• No elevated privileges. Sandboxed, outgoing HTTPS only — it never touches your Mac's own networking.
• Router passwords go to the macOS Keychain, and only if you ask.
• WireGuard private keys are generated on your Mac, shown once, and never stored.
• Self-signed router certificates are rejected unless you explicitly opt in.

Questions

Does Mikro Manager change anything without asking?

No. Every write is shown as a plan of creates, updates and deletes first, and the security audit only ever reads. Applying the same CGNAT pool twice changes nothing at all.

Does it need a helper tool, or root on my Mac?

Neither. It is sandboxed and speaks only outgoing HTTPS to the router's REST API. It never touches your Mac's own networking.

What does it need on the router?

RouterOS v7 with the www-ssl service enabled and an account with write access to the menus you intend to change. If the REST API was never set up, the app can do it for you over the console.