RouterOS Interfaces: A Complete Overview

RouterOS Interfaces: A Complete Overview

RouterOS Version

Primary Version: 7.16 | Minimum: 7.0 | Difficulty: Beginner | Time: 20 minutes

TL;DR (Quick Start)

RouterOS interfaces are the building blocks of your network configuration. Every packet enters and exits through an interface.

# View all interfaces
/interface print

# View interface details
/interface print detail

# Monitor real-time status
/interface monitor-traffic ether1

Overview

What this covers: Interface types, naming conventions, interface lists, and how interfaces work together in RouterOS.

When you need this: Before configuring any network service - understanding interfaces is foundational to everything else in RouterOS.

Key concepts:

• Physical interfaces (Ethernet, SFP, wireless)
• Virtual interfaces (VLAN, bridge, bonding)
• Interface lists for firewall organization
• Hardware offload and performance considerations

Interface Types in RouterOS

RouterOS supports many interface types, each serving different purposes:

Physical Interfaces

Type	Description	Common Names
Ethernet	RJ45 copper ports	ether1, ether2, etc.
SFP/SFP+	Fiber or copper modules	sfp1, sfp-sfpplus1
Wireless	WiFi radios	wlan1, wlan2
LTE	Cellular modems	lte1

Virtual Interfaces

Type	Description	Use Case
VLAN	802.1Q tagged sub-interface	Network segmentation
Bridge	Layer 2 switching	Combining ports
Bonding	Link aggregation (LACP/802.3ad)	Redundancy and bandwidth
PPPoE	Point-to-Point over Ethernet	ISP connections
Tunnel	VPN endpoints (WireGuard, IPSec)	Site-to-site connections

Physical Interface Management

Viewing Interface Status

# List all interfaces with status
/interface print

# Detailed view with MAC addresses
/interface print detail

# Real-time monitoring
/interface ethernet monitor ether1 once

Understanding Interface Flags

When you print interfaces, flags indicate their state:

Flag	Meaning
R	Running - interface is operational
S	Slave - part of a bridge or bond
D	Dynamic - created automatically
X	Disabled - administratively shut down

Ethernet Interface Configuration

# View current settings
/interface ethernet print detail

# Disable an interface
/interface ethernet disable ether5

# Set auto-negotiation (recommended)
/interface ethernet set ether1 auto-negotiation=yes

# Force specific speed (only when needed)
/interface ethernet set ether1 auto-negotiation=no speed=100M-baseT-full

Common Mistake

Don’t disable auto-negotiation unless you have a specific reason. Gigabit and faster speeds require auto-negotiation to be enabled on copper interfaces. Forcing speed incorrectly causes link failures or duplex mismatches.

Interface Lists

Interface lists group interfaces for use in firewall rules. They’re essential for scalable configurations.

Why Use Interface Lists?

Without lists, you write separate rules for each interface:

# Without lists - hard to maintain
/ip firewall filter add chain=input in-interface=ether1 action=drop
/ip firewall filter add chain=input in-interface=pppoe-out1 action=drop
/ip firewall filter add chain=input in-interface=lte1 action=drop

With lists, one rule covers all:

# With lists - clean and maintainable
/interface list add name=WAN
/interface list member add interface=ether1 list=WAN
/interface list member add interface=pppoe-out1 list=WAN
/interface list member add interface=lte1 list=WAN

/ip firewall filter add chain=input in-interface-list=WAN action=drop

Default Interface Lists

RouterOS creates default lists that correspond to the default configuration:

List	Purpose
WAN	Untrusted external interfaces
LAN	Trusted internal interfaces

Community Tip

Default WAN and LAN lists correspond to the default configuration only. If you manually change your config (e.g., add PPPoE on ether1), you must manually update the interface list members.

Managing Interface Lists

# Create a new list
/interface list add name=DMZ

# Add interfaces to a list
/interface list member add interface=ether5 list=DMZ
/interface list member add interface=ether6 list=DMZ

# View list membership
/interface list member print

# Use in firewall rules
/ip firewall filter add chain=forward in-interface-list=DMZ out-interface-list=LAN action=accept

Bridges: Layer 2 Switching

Bridges combine multiple interfaces into a single Layer 2 domain, functioning like a switch.

Basic Bridge Creation

# Create a bridge
/interface bridge add name=bridge1

# Add ports to the bridge
/interface bridge port add bridge=bridge1 interface=ether2
/interface bridge port add bridge=bridge1 interface=ether3
/interface bridge port add bridge=bridge1 interface=ether4

# Assign IP to the bridge (not individual ports)
/ip address add address=192.168.1.1/24 interface=bridge1

Hardware Offload

Hardware offload allows the switch chip to forward packets without CPU involvement, dramatically improving performance.

# Check hardware offload status
/interface bridge port print
# Look for "H" flag - indicates hardware offloading active

Common Mistake

Multiple bridges disable hardware switching. Keep ports that need high-speed switching on the same bridge and switch chip. “Multiple bridges are not recommended as hardware switching between switch ports is disabled on all but the first bridge.”

Bridge Port Behavior

When an interface becomes a bridge member (slave):

• DHCP client must run on the bridge, not slave ports
• Firewall rules reference the bridge, not slave interfaces
• IP addresses should be on the bridge, not slave ports

Community Tip

If you see “temporary moving client ether1 from slave to master port bridge1, update your config!” - move your DHCP-client configuration from the ethernet port to the bridge interface.

Common Mistake

802.1x (dot1x) authentication does not work when the interface is a bridge member. The EAPOL process cannot complete on slave ports. Configure the port outside the bridge during authentication, or consider alternative authentication approaches.

VLAN Interfaces

VLANs create virtual network segments on a single physical interface.

Creating VLAN Interfaces

# Create VLAN interface on a bridge
/interface vlan add name=vlan100-servers vlan-id=100 interface=bridge1
/interface vlan add name=vlan200-users vlan-id=200 interface=bridge1

# Assign IP addresses
/ip address add address=10.100.0.1/24 interface=vlan100-servers
/ip address add address=10.200.0.1/24 interface=vlan200-users

Bridge VLAN Filtering vs. VLAN Interfaces

There are two approaches to VLANs in RouterOS:

Approach	Use Case	Hardware Offload
VLAN interfaces	Router participates in VLAN (gateway, DHCP)	CPU-bound
Bridge VLAN filtering	Switch traffic between ports	CRS3xx only

Common Mistake

Enabling VLAN filtering on bridges disables hardware offload on most devices. Only CRS3xx series supports bridge VLAN filtering with hardware offload. On older devices (RB2011, etc.), configure VLANs through /interface ethernet switch for hardware acceleration.

Bonding: Link Aggregation

Bonding combines multiple physical interfaces into a single logical interface for redundancy and increased bandwidth.

LACP Bonding Example

/interface bonding add name=bond-core mode=802.3ad \
    slaves=sfp-sfpplus1,sfp-sfpplus2 \
    transmit-hash-policy=layer-2-and-3

Common Mistake

Don’t confuse bonding with bridging. Bonding (802.3ad) creates a single aggregated channel between two devices. Bridging creates separate paths that RSTP will likely block to prevent loops. For true link aggregation, use bonding.

Community Tip

Bonding interfaces on CRS1xx/CRS2xx are not hardware offloaded. Use trunking interfaces instead on those devices.

SFP/SFP+ Interfaces

SFP ports accept fiber or copper modules for flexible connectivity.

Common SFP Configuration

# View SFP status and diagnostics
/interface ethernet monitor sfp-sfpplus1 once

# For 1G SFP modules in SFP+ ports
/interface ethernet set sfp-sfpplus1 auto-negotiation=no speed=1G-baseX

Community Tip

1.25G SFP modules in RouterBoard SFP+ ports require auto-negotiation=no and speed=1G-baseX set on both ends. Re-plug the module or disable/enable the interface after changing speed settings.

SFP Naming Convention

Name Pattern	Meaning
sfp-sfpplusX	SFP+ port capable of 1G and 10G
sfpplusX	SFP+ port for 10G only
sfpX	SFP port (1G max)

Management Interface Considerations

RouterOS responds to management IPs from any interface at Layer 3. This surprises users expecting interface-specific isolation.

How Management Works

When you SSH or WebFig to a MikroTik:

• The connection arrives via the input chain
• It’s processed at L3, not L2
• The router responds from any interface that can reach you

True Management Isolation

For dedicated management access:

# Create management VLAN
/interface vlan add name=vlan-mgmt vlan-id=99 interface=bridge1
/ip address add address=10.99.0.1/24 interface=vlan-mgmt

# Restrict management access via firewall
/ip firewall filter add chain=input in-interface=!vlan-mgmt \
    dst-port=22,80,443,8291 protocol=tcp action=drop

Community Tip

For advanced management isolation, consider VRF (Virtual Routing and Forwarding) to separate management traffic at the routing level, similar to enterprise “big vendor” approaches.

Interface Monitoring

Real-Time Traffic Monitoring

# Monitor traffic on interface
/interface monitor-traffic ether1

# Monitor multiple interfaces
/interface monitor-traffic ether1,ether2

# Monitor with interval
/interface monitor-traffic ether1 interval=2

Statistics and Counters

# View interface statistics
/interface ethernet print stats

# Reset counters for clean baseline
/interface ethernet reset-counters ether1

Cable Testing (Copper Only)

# Test cable quality (interface must be down)
/interface ethernet cable-test ether2

Results show distance to faults:

• open:X - Cable disconnected at X meters
• short:X - Cable shorted at X meters

Troubleshooting Common Issues

Interface Shows “No Link”

Check	Command	What to Look For
Physical connection	Visual inspection	Cable seated, LEDs
Cable quality	/interface ethernet cable-test	Open/short faults
Speed mismatch	/interface ethernet monitor	Auto-negotiation status
Module issues (SFP)	/interface ethernet monitor	sfp-rx-loss, sfp-tx-fault

Interface Running but No Traffic

Check	Command	Solution
Bridge membership	/interface bridge port print	Verify port in correct bridge
VLAN configuration	/interface bridge vlan print	Check tagged/untagged settings
Firewall rules	/ip firewall filter print	Look for blocking rules

Performance Issues

Symptom	Likely Cause	Solution
High CPU with traffic	No hardware offload	Check bridge and VLAN config
Speed negotiating low	Cable/module issue	Test cable, check SFP compatibility
Intermittent connectivity	Duplex mismatch	Enable auto-negotiation

Community Tip

RouterOS 7.x has known link flapping issues not present in v6.49 on some devices. If experiencing intermittent “link down/link up” events, consider testing with v6.49 or generating supout.rif for MikroTik support.

MTU and Fragmentation Issues

MTU misconfigurations cause subtle problems: websites that partially load, VPN tunnels with limited throughput, or connections that stall on large transfers.

Common MTU scenarios:

Tunnel Type	Recommended MTU	MSS Setting
L2TP	1300 (max-mtu/max-mru)	n/a
IPIP with IPSec	1420	1380
EoIP	1458	n/a
WireGuard	1420	1380

Diagnosing MTU problems:

# Test MTU by pinging with do-not-fragment flag
# Decrease size until packets get through
:put [/ping 8.8.8.8 size=1500 do-not-fragment count=1]

Community Tip

Assign reduced MTU on the WAN interface, not LAN interfaces. Too many internet paths drop non-first fragments, so properly sized packets at the edge prevent fragmentation altogether.

Auto-Recovery for Frozen Interfaces

Some interfaces, particularly SFP modules, may freeze in “no-link” state after the connected device reboots. This script monitors and auto-recovers affected interfaces:

# Create the recovery script
/system script add name=interface-recovery source={
    :local ifName "sfp-sfpplus1"
    :local ifStatus ([/interface ethernet monitor [find default-name=$ifName] once as-value]->"status")
    :if ($ifStatus = "no-link") do={
        /interface disable $ifName
        :delay 2s
        /interface enable $ifName
        :log warning "Auto-recovered interface $ifName from no-link state"
    }
}

# Schedule periodic execution
/system scheduler add name=interface-watchdog interval=1m \
    on-event="/system script run interface-recovery"

Customize ifName to match the interface that experiences freeze issues on your device.

Related Topics

Interface Types

• Ethernet Interfaces - physical Ethernet ports
• Bridge Configuration - software bridging
• VLAN Configuration - virtual LANs
• Bonding/LACP - link aggregation

Common Configurations

• IP Address Configuration - assign IPs to interfaces
• DHCP Server - DHCP on interface
• Firewall Basics - interface lists in rules

Wireless

• WiFi Basic Setup - wireless interfaces
• CAPsMAN - managed wireless

Reference

Official Documentation

• MikroTik Interface Overview
• Ethernet Documentation
• Bridge Documentation

Quick Reference Commands

# View all interfaces
/interface print

# View running interfaces only
/interface print where running

# Find interface by name pattern
/interface print where name~"ether"

# Enable/disable interface
/interface enable ether5
/interface disable ether5

# View interface lists
/interface list print
/interface list member print

---

Research compiled from MikroTik forums and official documentation.