Backup

Backup

The RouterOS backup feature allows cloning a router configuration in binary format, which can then be re-applied on the same device. System backups contain the device’s MAC addresses, which are restored when the backup file is loaded.

Backup vs Export

RouterOS provides two methods for saving configuration: binary backups and text exports. Understanding the differences is essential for choosing the right approach.

Feature	/system backup	/export
Format	Binary (.backup)	Text script (.rsc)
Contents	Full configuration including MAC addresses	Configuration commands
Restore	Same device only	Any compatible device
Password	Optional encryption	No encryption
Readability	Binary (not human-readable)	Human-readable text
Partial restore	Not supported	Selectively import sections

When to Use Each Method

Use /system backup when:

• You need a complete clone of the current configuration
• MAC addresses must be preserved (important for licensing, ISP bindings)
• You want optional password protection
• Restoring to the same hardware

Use /export when:

• You need human-readable configuration
• You want to version control your config (git friendly)
• You need to restore partial configuration
• Migrating between different hardware
• You want to easily search/modify configuration

Export Examples

/export file=my-config

This creates my-config.rsc containing all configuration commands. You can also export specific sections:

/ip firewall export file=firewall-rules
/interface export file=interfaces

Restoring from Export

/import my-config.rsc

Caution

When importing, RouterOS executes the commands in the file. Review the export file before importing to ensure it doesn’t overwrite unintended settings.

Overview

RouterOS backups create a complete binary copy of your router’s configuration, including:

• Interface settings and MAC addresses
• Firewall rules and NAT configuration
• Routing tables and BGP/OSPF settings
• DHCP leases and DNS settings
• User accounts and AAA configuration
• Wireless settings and access lists

Backups are essential for disaster recovery, device replacement, and configuration migration between similar devices.

Sub-menu

/system backup

Creating Backups

Basic Backup

Create an encrypted backup with a password:

/system backup save name=router-config password=your-secure-password

Create an unencrypted backup:

/system backup save name=router-config dont-encrypt=yes

Automatic Naming

If no name is specified, RouterOS uses the format [identity]-[date]-[time].backup:

/system backup save password=secure123

This creates a file named like MyRouter-feb13-2026-155000.backup.

Backup Properties

Property	Description
dont-encrypt (yes | no; Default: no)	Disable backup file encryption. When set to yes, the backup is stored in plain text.
encryption (aes-sha256 | rc4; Default: aes-sha256)	Encryption algorithm for the backup file. rc4 is included for compatibility with older RouterOS versions.
name (string; Default: [identity]-[date]-[time].backup)	Filename for the backup file.
password (string; Default: )	Password for encrypting the backup file. When empty and dont-encrypt=no, the backup is unencrypted (RouterOS v6.43+).

Note

RouterOS v6.43 and later: Without a password, the backup file is unencrypted by default.

Caution

Older RouterOS versions (pre-RouterOS v6.43): Without a password, the backup is encrypted using the current user’s password. If the user has no password, the backup is unencrypted.

Restoring Backups

Load Encrypted Backup

/system backup load name=router-config.backup password=your-password

This prompts for confirmation before rebooting:

Restore and reboot? [y/N]: y
Restoring system configuration
System configuration restored, rebooting now

Load Unencrypted Backup

/system backup load name=router-config.backup password=""

Managing Backup Files

List Backup Files

View all files on the router, including backups:

/file print

Output:

# NAME                      TYPE        SIZE  CREATION-TIME
0 router-config.backup      backup     12567  feb/13/2026 15:50:00
1 auto-before-reset.backup   backup     12340  feb/10/2026 09:15:00

Delete Backup File

/file remove router-config.backup

Download Backup

Download backup files using:

• WinBox: Files menu → Download
• FTP: Connect to router IP and download from root
• SFTP: Secure file transfer

sftp [email protected]
sftp> get router-config.backup

Best Practices

Password Management

• Use strong, unique passwords for each router
• Store passwords in a secure password manager
• Document backup passwords in your IT documentation system
• Consider using a consistent password scheme with device identifiers

Backup Schedule

Create a script for automated daily backups:

/system script add name=daily-backup source={
    :local date [/system clock get date]
    :local time [/system clock get time]
    :local identity [/system identity get name]
    :local filename "$identity-$date-$time"
    /system backup save name=$filename password=secure-backup-password
    :log info "Daily backup created: $filename"
}

Schedule the script:

/system scheduler add name=daily-backup interval=1d on-event=daily-backup

Pre-Upgrade Backups

Always create a backup before upgrading RouterOS:

/system backup save name=pre-upgrade password=upgrade123

Backup Verification

Test backup restoration in a lab environment:

1. Restore backup to a spare device
2. Verify all services start correctly
3. Check critical configurations are present
4. Test failover and redundancy features

Cloud Backup

Since RouterOS v6.44, you can store backups securely on MikroTik’s Cloud servers.

Upload a Cloud Backup

/system backup cloud upload-file action=create-and-upload secret-download-key=cloud-secret

Download a Cloud Backup

/system backup cloud download-file action=download number=0

List Cloud Backups

/system backup cloud print

Note

Cloud backups are stored on MikroTik’s infrastructure and require an active internet connection.

Special Considerations

Services Not Included in Backups

The following services require separate backup procedures:

• The Dude: Export Dude server settings separately
• User-manager: Export user database manually
• Hotspot/Mobile PPP users: PPP secrets and profiles not included
• Certificate Authority: Export certificates separately

Restore Between Different RouterOS Versions

Caution

Restoring backups between different RouterOS versions is not recommended and may cause unexpected behavior.

When restoring to a different RouterOS version:

1. Note any version-specific warnings during restoration
2. Verify all services function correctly after reboot
3. Check system logs for errors
4. Consider manual configuration review

MAC Address Considerations

Backups preserve MAC addresses, which is important for:

• License transfers between devices
• ISP provisioning systems bound to MAC
• MAC-based authentication systems

When replacing hardware, either:

• Restore to same hardware model
• Contact MikroTik support for license transfer
• Accept that MAC-based features may need reconfiguration

Troubleshooting

Backup File Not Created

1. Verify sufficient disk space: /system resource print
2. Check file system health: /system routerboard print
3. Ensure user has write permissions

Password Not Accepted

1. Verify password is correct
2. Check if backup was created with different RouterOS version
3. Try empty password for RouterOS v6.43+ unencrypted backups

Restore Fails

1. Confirm backup is from same RouterOS version
2. Verify backup file integrity (check file size)
3. Check for conflicting configurations
4. Review logs: /log print

Missing Configuration After Restore

1. Verify affected services are not excluded services
2. Check if service requires manual restart
3. Review service-specific logs

Cloud Upload Fails

1. Verify internet connectivity
2. Check firewall allows outbound HTTPS (port 443)
3. Validate cloud credentials: /system backup cloud print

Export vs Backup Comparison

RouterOS provides two methods for saving configuration: binary backups and text exports. Understanding the differences is essential for choosing the right approach.

Binary Backup (/system backup)

• Format: Binary (.backup file)
• Contents: Full configuration including MAC addresses, certificates, keys, and user passwords
• Restore: Can only be restored to the same or compatible RouterOS version
• Partial restore: Not possible—full restore only
• Human-readable: No

/system backup save name=router-config password=secure123

Text Export (/export)

• Format: Text script (.rsc file)
• Contents: Human-readable commands that recreate the configuration
• Excludes: MAC addresses, certificates, keys, user passwords (by default), and some hardware-specific settings
• Restore: Can be imported on any RouterOS version or device
• Partial restore: Yes—can edit the .rsc file to select specific sections

/export file=router-config

When to Use Each

Scenario	Recommended Method
Disaster recovery, same device	Binary backup
Migrating to different hardware	Export (then edit for hardware-specific items)
Version upgrades	Export (more compatible)
Need human-readable config	Export
Need to preserve certificates/keys	Binary backup
Selective configuration restore	Export

Caution

Export files do not include user passwords by default. Use /export show-sensitive to include passwords, or manually recreate user accounts after restore.

Related Commands

• /system reset-configuration - Reset to factory defaults
• /system package update - RouterOS software updates
• /file - File management
• /system script - Automated backup scripts
• /system scheduler - Schedule recurring tasks

Related Resources

• Official MikroTik Backup Documentation
• Cloud Backup Documentation
• Getting Started Overview
• System Administration