MikroTik RouterOS stock definitions

Stock definitions for MikroTik RouterOS, from the mikrotik/ folder. They check the configuration as returned by /export, where each section line (for example /ip service) is followed by its set or add lines. This page documents release v1.2.0. See importing a stock template to load one into rConfig.

Build templates

Caution

Build templates are starting templates to edit, not compliance checks. The rules use example values (hostnames, addresses, servers), so expect them to fail until you replace those values with your own standard.

RouterOS build template

routeros-build-template.policy · 10 rules · minimum rConfig 8.3.0 · Synthetic tested

Starting template for a new RouterOS build, not a compliance check: identity, timezone, service lockdown, LAN bridge, DHCP, DNS, NAT, firewall filter, NTP and remote logging. Replace the example values (for example 192.168.88.0/24 and Europe/Dublin) with your own before use.

Every rule uses example values, so most rules fail against the sample until they are edited. Each rule matches lines in /export form: the section line, then a set or add line in that section with the given arguments in any order.

Rule	Method	What it checks
Identity is set (/system identity, set name=)	evaluate_block	Under /system identity, a set line has a name= value. Any name passes.
Timezone is Europe/Dublin (/system clock, set time-zone-name=Europe/Dublin)	evaluate_block	Under /system clock, a set line has time-zone-name=Europe/Dublin.
Telnet, FTP, www, www-ssl, API and API-SSL services are disabled and SSH strong crypto is on	evaluate_block	Under /ip service, each of telnet, ftp, www, www-ssl, api and api-ssl has its own set ... disabled=yes line, and under /ip ssh a set line has strong-crypto=yes.
LAN bridge bridge1 holds ether1 and has a /24 address	evaluate_block	There is an add name=bridge1 under /interface bridge, ether1 is added to bridge1 under /interface bridge port, and bridge1 has a /24 address under /ip address.
DHCP server dhcp1 on bridge1 uses pool dhcp_pool (.10 to .254) and a /24 network with a .1 gateway	evaluate_block	There is a dhcp_pool pool with a .10 to .254 range, a dhcp1 server on bridge1 using that pool, and a /24 DHCP network with a .1 gateway.
DNS servers are 8.8.8.8 and 8.8.4.4 with remote requests allowed (/ip dns)	evaluate_block	Under /ip dns, a set line has servers=8.8.8.8,8.8.4.4 and allow-remote-requests=yes.
Source NAT masquerades out ether1 (/ip firewall nat)	evaluate_block	Under /ip firewall nat, an add line has action=masquerade, chain=srcnat and out-interface=ether1.
Input and forward firewall filter rules accept established, related and LAN traffic and drop the rest	evaluate_block	Under /ip firewall filter, all nine add lines are present: accept established and related, drop invalid, accept ICMP and LAN on input, then drop; and the matching forward rules ending in a drop.
NTP client is enabled with servers 216.239.35.0 and 216.239.36.0 (RouterOS 6 or 7 form)	evaluate_block	Either the RouterOS 6 form (one set enabled=yes line with primary-ntp and secondary-ntp) or the RouterOS 7 form (set enabled=yes, then one add address= per server under /system ntp client servers).
Info, warning and error topics log to a remote action at 192.168.88.2 (/system logging)	evaluate_block	Under /system logging action, an action has remote=192.168.88.2, and under /system logging the info, warning and error topics each go to action=remote.

Known limitations

• Each rule matches lines in /export form: the section line (for example /ip service), then a set or add line in that section with the given arguments in any order. Long lines that /export wraps with \ are matched across the break.
• To edit a value, change it inside the regex and keep the escaping: / is written \/ and . is written \., for example time-zone-name=Europe\/Dublin.
• The two catch-all drop rules (add action=drop chain=input and add action=drop chain=forward) must match the whole line, so a drop rule with other arguments does not satisfy them.