Console (Command Line Interface)

Console (Command Line Interface)

Version Info

RouterOS 7.16 | Min: v6.0+ | 15 minutes | Beginner

Tested on: 7.16 7.14

Version-specific notes

• v7.0+: F1 provides context-sensitive help at any menu level
• v6.x: Basic console features; help accessed via ?

TL;DR (Quick Start)

For the impatient: navigate and configure efficiently.

# Navigate to a menu level
/ip/address

# Execute command from any location using full path
/ip/route/print

# Quick typing with abbreviations
pi 10.1 c 3 si 100
# Equivalent to: ping 10.0.0.1 count 3 size 100

# Enable safe mode before risky changes (press Ctrl+X)
# Changes auto-revert if connection drops

# Tab completion - press Tab to complete commands
/ip/fir[Tab]  # completes to /ip/firewall

Overview

What this does: The console provides text-based access to all RouterOS configuration and management features. Commands are organized hierarchically in menu levels, with powerful features like auto-completion, safe mode, and command history.

When to use this:

• Remote administration via SSH or Telnet
• Local access via serial console
• Scripting and automation
• Terminal within WinBox
• Direct keyboard/monitor connection

Access methods:

• SSH (recommended, encrypted)
• Serial console (physical access)
• Telnet (legacy, unencrypted)
• WinBox terminal window
• Keyboard and monitor (direct)

Prerequisites:

• Network access to router (for SSH/Telnet)
• Serial cable and terminal software (for serial)
• Valid user credentials

Menu Structure

RouterOS organizes commands in a hierarchical menu system. The prompt shows your current location:

[admin@MikroTik] /ip/route>

Navigation Commands

Command	Action
/	Return to root level
..	Move up one level
/path/to/menu	Jump to specific menu
menu print	Execute command in submenu

Example Navigation

# Start at root
[admin@MikroTik] >

# Navigate to IP address menu
/ip/address
[admin@MikroTik] /ip/address>

# Move up one level
..
[admin@MikroTik] /ip>

# Return to root
/
[admin@MikroTik] >

# Execute command without changing location
/ip/route/print
[admin@MikroTik] >

Keyboard Shortcuts

Master these shortcuts for efficient CLI navigation:

Essential Shortcuts

Key	Function
Tab	Auto-complete command/argument
Tab Tab	Show all matching options
F1	Context-sensitive help (v7+)
?	Help (alternative)
Ctrl+X or F4	Toggle safe mode
Ctrl+C	Interrupt current command
Ctrl+D	Logout (empty line only)

Line Editing

Key	Function
Home or Ctrl+A	Beginning of line
End or Ctrl+E	End of line
Ctrl+K	Delete from cursor to end
Ctrl+U	Delete from cursor to start
Delete	Delete character at cursor
Backspace	Delete character before cursor
Ctrl+L or F5	Repaint screen

History Navigation

Key	Function
Up or Ctrl+P	Previous command
Down or Ctrl+N	Next command
F3 or Ctrl+R	Search command history

Special Modes

Key	Function
F7	Toggle HotLock mode (auto-complete)
#	Send internal chat message

Quick Typing

Abbreviations

Commands and arguments can be shortened if unambiguous:

# Full command
ping 10.0.0.1 count 3 size 100

# Abbreviated
pi 10.1 c 3 si 100

# More examples
/in pr          # /interface print
/ip r pr        # /ip route print
/sy re          # /system reboot

Tab Completion

Tab completion works with:

• First letters of commands
• Distinctive substrings
• Property names and values

/interface x[Tab]   # completes to: /interface export
/interface mt[Tab]  # completes to: /interface monitor-traffic
/ip address add a[Tab]  # completes to: address=

HotLock Mode

Press F7 to enable HotLock mode. The prompt changes to >> and commands auto-complete as you type:

[admin@MikroTik] >>

Press F7 again to disable.

Safe Mode

Safe mode automatically reverts configuration changes if your session terminates unexpectedly (e.g., connection drops, SSH timeout).

Enabling Safe Mode

Press Ctrl+X or F4. The prompt shows <SAFE>:

[admin@MikroTik] /ip/address<SAFE>

How It Works

1. Enter safe mode before making risky changes
2. All changes are tracked in system history (flagged with F)
3. If session ends abnormally, changes automatically undo
4. TCP timeout is approximately 9 minutes

Exiting Safe Mode

Action	Result
Ctrl+X	Save changes, exit safe mode
Ctrl+D	Discard changes, exit safe mode
/quit	Save changes, logout

Viewing Pending Changes

/system/history/print

Changes made in safe mode show an F flag.

Multi-User Safe Mode

If another user has safe mode active:

Hijacking Safe Mode from someone - unroll/release/don't take it [u/r/d]:

• u (unroll): Undo their changes, take safe mode
• r (release): They keep safe mode
• d (don’t take): Cancel your request

Safe Mode Limitations

• History holds maximum 100 actions
• If exceeded, safe mode automatically disables without undo
• Commands requiring reboot (reset, restore) are not covered
• Work in small chunks for best results

Core Commands

These commands are available in most menu levels:

Command	Description
print	Display items; assigns temporary numbers
add	Create new item
set	Modify existing item
remove	Delete item
find	Return items matching criteria
edit	Open editor for text values
move	Reorder items in list
enable	Enable disabled item
disable	Disable enabled item
export	Output configuration commands

Print Command Options

The print command supports various output formats:

# Basic print
/interface/print

# Tabular format
/interface/print brief

# Property=value format
/interface/print detail

# Count items only
/interface/print count-only

# Filter output
/interface/print where type=ether

# Show specific properties
/interface/print proplist=name,type,mtu

# Auto-refresh every 2 seconds
/interface/print interval=2

# Export to file
/interface/print file=interfaces

# No paging (continuous output)
/interface/print without-paging

Item Numbers vs Names

Item numbers are assigned by print and are temporary:

• Reset each session
• Change after print commands
• Useful for interactive batch operations

# Use numbers for quick batch operations
/interface/set 0,1,2 mtu=1460

Item names are stable identifiers:

• Persist across sessions
• Preferred in scripts
• More reliable

# Use names in scripts
/interface/set ether1 mtu=1460

Do not use item numbers in scripts. They are session-specific and unreliable.

Login Parameters

Append parameters after username with +:

admin+ct80w

Parameter	Default	Description
w	auto	Terminal width
h	auto	Terminal height
c	on	Colors (off to disable)
t	off	Disable terminal auto-detection
e	on	Enable “dumb” terminal mode

Example: admin+c disables colors for serial connections.

Serial Console Access

For physical access via serial port:

Default Settings

Parameter	RouterBOARD	x86
Baud rate	115200	9600
Data bits	8	8
Stop bits	1	1
Parity	None	None
Flow control	None	None

Connection Steps

1. Connect null-modem cable (or USB-serial adapter)
2. Configure terminal software (PuTTY, screen, minicom)
3. Set parameters: 115200, 8N1, no flow control
4. Press Enter to see login prompt

View Port Settings

/port/print detail

Example output:

name=serial0 used-by="Serial Console" baud-rate=115200 data-bits=8
parity=none stop-bits=1 flow-control=none

Change Baud Rate

# Disable console first
/system/console/disable 0

# Change baud rate in RouterBOARD settings
/system/routerboard/settings/set baud-rate=9600

# Re-enable console
/system/console/enable 0

# Reboot to apply
/system/reboot

Console Settings

View and configure console behavior:

/console/settings/print

Property	Description
sanitize-names	Replace reserved characters in filenames with underscores

Common Scenarios

Scenario: Lock Console Session

Temporarily lock your session (requires password to unlock):

:lock

Enter password to resume.

Scenario: Internal Chat

Send messages to all logged-in administrators:

# Anyone online?

All active CLI users see the message.

Scenario: Multi-Line Commands

Commands can span multiple lines. The prompt shows unclosed elements:

[admin@MikroTik] > {
{...

Prompt	Meaning
{...	Open brace
(...	Open parenthesis
"...	Open quote
\...	Line continuation

Scenario: Export Configuration

# Export current level
/ip/address/export

# Export to file
/export file=full-config

# Export compact (no defaults)
/export compact

# Export specific section
/ip/firewall/export file=firewall-rules

Scenario: Safe Configuration Change

# Enter safe mode
# Press Ctrl+X

# Make risky firewall change
/ip/firewall/filter/add chain=input action=drop

# Test connectivity... if OK:
# Press Ctrl+X to save

# If locked out, wait for TCP timeout (~9 minutes)
# Changes auto-revert

Verification

Confirm console access and settings:

Check 1: Verify Console Settings

/console/settings/print

Check 2: View Active Sessions

/system/resource/print

Shows current user and session information.

Check 3: Check Command History

/system/history/print

Shows recent configuration changes with flags.

Check 4: Test Safe Mode

# Enter safe mode (Ctrl+X)
/system/identity/set name=test-safe-mode
/system/history/print
# Should show F flag on the identity change
# Exit safe mode (Ctrl+X) to save, or Ctrl+D to discard

Troubleshooting

Symptom	Cause	Solution
Commands not auto-completing	Ambiguous input	Press Tab twice to see options
Safe mode not activating	Another user has it	Choose unroll/release/don’t take
Changes not saved after safe mode	Used Ctrl+D to exit	Use Ctrl+X or /quit to save
Serial console garbled	Wrong baud rate	Match terminal to router settings (115200)
Locked out after firewall change	Blocked own connection	Wait for safe mode timeout (9 min)
History full, safe mode disabled	Too many changes	Work in smaller chunks
Tab completion not working	HotLock mode active	Press F7 to toggle off

Debug: Check for Active Safe Mode

If you left safe mode active on another session:

/system/history/print

Look for F flags indicating uncommitted safe mode changes.

Debug: Reset Console Settings

/console/settings/set sanitize-names=no

Common Mistakes

• Using item numbers in scripts - Numbers change; use names instead
• Making large changes in safe mode - History limit is 100 actions
• Forgetting safe mode is active - Check prompt for <SAFE>
• Using Ctrl+D to save - Ctrl+D discards; use Ctrl+X to save
• Wrong serial parameters - RouterBOARD default is 115200, not 9600

Community Tips

Efficient Navigation: Use full paths for one-off commands instead of navigating:

/ip/route/print

Faster than /ip/route then print.

Safe Mode Best Practice: Work in small chunks. Enter safe mode, make one change, exit, repeat. This prevents hitting the 100-action history limit.

Serial Console Recovery: If locked out of SSH/Telnet, serial console always works (with physical access). Keep a USB-serial adapter handy.

Script-Safe Commands: Always use item names, not numbers:

# Good
/interface/set ether1 mtu=1460

# Bad (numbers change)
/interface/set 0 mtu=1460

Related Topics

Remote Access

• SSH - secure remote access
• IP Services - management service ports
• MAC Server - Layer 2 management access

User Management

• User Management - user accounts and permissions
• Logging - audit console commands

Automation

• Scheduler - scheduled tasks
• System Backup - configuration backup

Reference

• MikroTik Console Documentation
• MikroTik CLI Documentation
• Serial Console Documentation

Console Menu Summary

Menu	Description
/console/settings	Console behavior settings
/system/console	Serial console configuration
/system/history	Command history and safe mode tracking
/port	Serial port settings

All Keyboard Shortcuts Reference

Shortcut	Function
Tab	Auto-complete
Tab Tab	Show options
F1 / ?	Help
F3 / Ctrl+R	Search history
F4 / Ctrl+X	Toggle safe mode
F5 / Ctrl+L	Repaint screen
F7	Toggle HotLock
Up / Ctrl+P	Previous command
Down / Ctrl+N	Next command
Home / Ctrl+A	Line start
End / Ctrl+E	Line end
Ctrl+K	Delete to end
Ctrl+U	Delete to start
Ctrl+C	Interrupt
Ctrl+D	Logout
#	Internal chat

Print Command Parameters

Parameter	Description
brief	Tabular output
detail	Property=value format
count-only	Item count
proplist	Specific properties
where	Filter criteria
from	Specific items
interval	Auto-refresh seconds
file	Export to file
without-paging	Continuous output