Netinstall Recovery and Reinstallation

Netinstall Recovery and Reinstallation

Version Info

RouterOS 7.16 | Min: v5.x+ | Hardware Only | 15 minutes | Intermediate

Tested on: 7.16 7.14

Version-specific notes

• v7.9: Added preboot-etherboot for Netinstall without physical button press
• v7.1: Protected RouterBOOT requires physical button confirmation within 60 seconds
• v6.47: Linux netinstall-cli tool introduced

TL;DR (Quick Start)

For the impatient: reinstall RouterOS on a corrupted or locked device.

Windows:

1. Download Netinstall.exe and RouterOS packages from mikrotik.com/download
2. Disable all network adapters except one, set static IP (e.g., 192.168.88.2/24)
3. Run Netinstall as Administrator, set Client IP (e.g., 192.168.88.3)
4. Power off device, hold reset button, power on, release when device appears
5. Select device, browse to packages, click Install

Linux:

sudo ip addr add 192.168.88.2/24 dev eth0
sudo ./netinstall-cli -r -a 192.168.88.3 routeros-7.16-arm.npk

After install, access device at 192.168.88.1 with user admin (password on sticker or blank).

Overview

What this does: Netinstall reinstalls RouterOS on MikroTik devices via network boot (BOOTP/TFTP). It reformats the device’s storage and installs a fresh RouterOS image. The device license and RouterBOOT settings are preserved, but all configuration is erased.

When to use this:

• Device is corrupted or won’t boot (boot loop)
• Forgot admin password and cannot access device
• Downgrading RouterOS to an earlier version
• Recovering from failed upgrade
• Starting fresh with factory RouterOS installation

Prerequisites:

• Physical RouterBOARD hardware (not CHR or x86)
• Direct Ethernet connection to device (no managed switches)
• Single active network adapter on computer
• Netinstall tool matching target RouterOS version
• RouterOS packages for correct device architecture

Data Loss Warning

Netinstall reformats the device storage. All configuration, files, User Manager database, and Dude database will be permanently erased. Backup before proceeding if possible.

What Netinstall Preserves vs Erases

Item	Preserved	Erased
RouterOS License	Yes	-
RouterBOOT Settings	Yes	-
Serial Number	Yes	-
Configuration	-	Yes
User Accounts	-	Yes
Files on Storage	-	Yes
User Manager DB	-	Yes
Dude Database	-	Yes
SSH Host Keys	-	Yes

Device Architectures

Download the correct RouterOS packages for your device architecture:

Architecture	Example Devices	Package Suffix
ARM	hAP ax series, CCR2004	-arm
ARM64	CCR2116, CCR2216	-arm64
MIPSBE	RB4xx, RB7xx, RB9xx, hEX	-mipsbe
MMIPS	hEX S (RB760iGS)	-mmips
SMIPS	hAP lite	-smips
TILE	CCR1009, CCR1016, CCR1036, CCR1072	-tile

Download “All packages” if unsure - Netinstall selects the correct architecture automatically.

Configuration Steps

Step 1: Prepare Your Computer (Windows)

Disable all network adapters except the one connected to the router:

1. Open Control Panel > Network and Sharing Center > Change adapter settings
2. Right-click each unused adapter and select Disable
3. Only the Ethernet adapter connected to the router should remain enabled

Set a static IP address:

1. Right-click the active adapter > Properties
2. Select Internet Protocol Version 4 (TCP/IPv4) > Properties
3. Select Use the following IP address
4. Enter:
   • IP address: 192.168.88.2
   • Subnet mask: 255.255.255.0
   • Leave gateway blank

Step 1: Prepare Your Computer (Linux)

Configure the network interface:

# Replace eth0 with your interface name
sudo ip link set eth0 up
sudo ip addr add 192.168.88.2/24 dev eth0

Step 2: Download Required Files

1. Go to mikrotik.com/download
2. Download Netinstall (Windows) or Netinstall-cli (Linux)
3. Download RouterOS packages for your device architecture (or “All packages”)

Step 3: Configure Netinstall (Windows)

1. Run as Administrator - Right-click Netinstall.exe > Run as administrator
2. Select the correct network interface from the dropdown
3. Click Net booting and enable it
4. Set Client IP Address to an unused IP (e.g., 192.168.88.3)
5. Click Browse and navigate to the folder containing RouterOS packages

Step 4: Enter Etherboot Mode

Connect an Ethernet cable directly between your computer and the device’s boot port (usually ether1 or marked “BOOT”).

Method 1: Reset Button (Most Common)

1. Disconnect power from the device
2. Press and hold the reset button
3. Connect power while holding the button
4. Watch the LED pattern:
   • LED turns on briefly
   • LED turns off
   • When LED turns off, release the button
5. Device should appear in Netinstall within 30 seconds

Method 2: Serial Console

1. Connect serial cable (115200 baud, 8N1)
2. Power on device
3. Press Ctrl+E repeatedly until “trying bootp protocol” appears

Alternatively, press any key during boot to enter RouterBOOT menu, then press:

• o for boot device
• 1 for try-ethernet-once-then-nand
• x to exit and boot

Method 3: From RouterOS (If Accessible)

/system/routerboard/settings set boot-device=try-ethernet-once-then-nand
/system/reboot

Step 5: Install RouterOS (Windows)

1. The device appears in Netinstall’s device list (MAC address and IP shown)
2. Select the device by clicking on it
3. Select the packages to install (at minimum: routeros and system)
4. Choose configuration option:
   • Keep old configuration - Attempts to preserve (not guaranteed)
   • Apply default config - Factory defaults
   • Apply empty config - No configuration
5. Click Install
6. Wait for installation to complete (progress bar shown)
7. Device reboots automatically when finished

Step 5: Install RouterOS (Linux)

# Basic install with default configuration reset
sudo ./netinstall-cli -r -a 192.168.88.3 routeros-7.16-arm.npk

# Install with empty configuration
sudo ./netinstall-cli -e -a 192.168.88.3 routeros-7.16-arm.npk

# Install with custom script
sudo ./netinstall-cli -r -a 192.168.88.3 -s /path/to/config.rsc routeros-7.16-arm.npk

# Specify interface
sudo ./netinstall-cli -r -a 192.168.88.3 -i eth0 routeros-7.16-arm.npk

Step 6: Connect to Reinstalled Device

After installation completes:

1. Restore your computer’s network settings to DHCP or set IP in 192.168.88.x range
2. Connect to the device using:
   • WinBox via MAC address (device discovery)
   • WinBox via IP: 192.168.88.1
   • WebFig: http://192.168.88.1
   • SSH: ssh [email protected]
3. Login as admin with:
   • Password from sticker on device (newer devices)
   • Blank password (older devices)

Common Scenarios

Scenario: Boot Loop After Upgrade

Device continuously reboots and never reaches RouterOS:

1. The upgrade may have failed due to insufficient storage
2. Use Netinstall to perform a clean installation
3. Consider installing fewer packages if storage is limited

Scenario: Forgotten Password Recovery

Cannot access device due to forgotten password:

1. Use Netinstall with reset configuration option
2. All configuration including passwords will be erased
3. Device boots with default admin/blank or sticker password

Scenario: Downgrade RouterOS Version

Need to install an older RouterOS version:

1. Download the older RouterOS packages from MikroTik archive
2. Use Netinstall normally with older packages
3. RouterOS will be downgraded to the specified version

Scenario: Install with Pre-configured Script

Deploy custom configuration automatically after reinstall:

1. Create a RouterOS script file (.rsc) with your configuration
2. Use the -s option (Linux) or script field (Windows)

sudo ./netinstall-cli -r -a 192.168.88.3 -s initial-config.rsc routeros-7.16-arm.npk

Example script (initial-config.rsc):

:delay 15s
/interface/bridge add name=bridge1
/ip/address add address=10.0.0.1/24 interface=bridge1
/interface/bridge/port add bridge=bridge1 interface=ether2
/interface/bridge/port add bridge=bridge1 interface=ether3
/ip/dhcp-server/network add address=10.0.0.0/24 gateway=10.0.0.1 dns-server=10.0.0.1
:log info "Initial configuration applied"

Scenario: Remote Reinstall with Preboot Etherboot (v7.9+)

Configure device to automatically search for Netinstall server on boot:

/system/routerboard/settings set preboot-etherboot=10s preboot-etherboot-server=192.168.88.2

The device will search for a Netinstall server for 10 seconds on each boot. If found, it enters Netinstall mode; otherwise, it boots normally.

Linux CLI Options Reference

Option	Description
-r	Reset configuration to defaults
-e	Apply empty configuration (no defaults)
-a <ip>	Client IP address to assign to device
-i <iface>	Network interface to use
-s <file>	Pre-configure with .rsc script
-k <file>	Install license key file
-b	Discard branding package
-m	Multiple device mode (batch install)

Boot Port Location

Device Type	Boot Port
Most routers	ether1
Labeled devices	Port marked “BOOT”
CCR series	Check product manual
CRS switches	Usually ether1 or sfp1
hAP series	ether1

Verification

Confirm successful installation:

Check 1: Device Boots Normally

After Netinstall, device should boot to RouterOS within 60 seconds.

Check 2: Verify RouterOS Version

/system/resource print

Expected: Shows installed RouterOS version.

Check 3: Verify Default Configuration

/ip/address print
/interface/bridge print

Expected: Default IP 192.168.88.1/24 on bridge or LAN interface.

Check 4: Verify License

/system/license print

Expected: License level matches device capabilities.

Troubleshooting

Symptom	Cause	Solution
Device not appearing in Netinstall	Multiple network adapters active	Disable all adapters except one
Device not appearing in Netinstall	Firewall blocking BOOTP/TFTP	Disable Windows Firewall or add exceptions (UDP 67, 68, 69)
Device not appearing in Netinstall	Wrong boot mode	Retry reset button timing - hold until LED turns off
Device not appearing in Netinstall	Managed switch between PC and device	Use direct Ethernet connection
Device not appearing in Netinstall	Virtual switches (Hyper-V, VMware)	Disable virtual network adapters
Device not appearing in Netinstall	Protected RouterBOOT enabled	Must disable from RouterOS or use emergency reformat
Device not appearing in Netinstall	USB network adapter link issues	Try different USB adapter or motherboard port
Install fails	Wrong architecture packages	Download “All packages” or correct architecture
Install hangs at percentage	Network issue or timeout	Restart Netinstall and retry
Can’t access device after install	Wrong IP range	Set computer IP to 192.168.88.x range
Can’t access device after install	Connected to WAN port	Connect to LAN port (not ether1)
DHCP snooping blocking	Switch filtering BOOTP	Disable DHCP snooping or mark port as trusted

Debug: Device Detection Issues

If the device doesn’t appear:

1. Check Etherboot mode - LED should turn off after holding reset ~15 seconds
2. Verify cable connection - Use a known-good Ethernet cable
3. Check Netinstall log - Look for “Device found” messages
4. Try different port - Some devices only support Netinstall on ether1
5. Restart Netinstall - Sometimes helps after configuration changes

Debug: Protected RouterBOOT Recovery

If Protected RouterBOOT is enabled and you’ve lost access:

1. Determine the reformat-hold-button timing (default: 20 seconds)
2. Power off device
3. Hold reset button
4. Power on and hold for exactly reformat-hold-button to reformat-hold-button-max time
5. Release button
6. Device reformats storage and enters Etherboot mode
7. Use Netinstall to reinstall RouterOS

Warning

Emergency reformat erases everything including configuration and all files. This is the last resort when RouterOS password is forgotten and Protected RouterBOOT is enabled.

Common Mistakes

• Holding reset button too long - Triggers Netinstall mode instead of factory reset (or vice versa)
• Using a managed switch - DHCP snooping or link-flap issues can prevent detection
• Multiple network adapters - Netinstall may send packets on wrong interface
• Wrong architecture packages - Device won’t boot with incompatible packages
• Forgetting to run as Administrator - Netinstall needs elevated privileges on Windows
• Virtual adapters active - Hyper-V, VMware, VirtualBox adapters interfere with detection

Community Tips

Reset button timing varies by device: Different devices have different LED patterns and timing. Consult the device manual or MikroTik wiki for specific instructions.

Use direct connection: Avoid switches between your computer and the device. Even unmanaged switches can cause link detection issues.

Antivirus interference: Some antivirus software blocks BOOTP/TFTP. Temporarily disable it during Netinstall.

Windows Firewall: Create inbound rules for UDP ports 67, 68 (BOOTP) and 69 (TFTP) or temporarily disable the firewall.

Linux permissions: netinstall-cli requires root privileges to bind to BOOTP ports.

Reset Button Reference

Hold Duration	LED State	Action
~3 seconds (before power)	-	Load backup RouterBOOT bootloader
~5 seconds	Flashing	Factory reset (load default config)
~10 seconds	Solid	Enable CAPs mode
~15 seconds	Off	Enter Netinstall/Etherboot mode
reformat-hold-button time	-	Emergency reformat (Protected RouterBOOT)

Related Topics

System Management

• Reset Configuration - software reset without reinstall
• RouterBOARD Settings - bootloader and firmware settings
• System Backup and Restore - backup before recovery

Package Management

• Package Installation - upgrading RouterOS normally

Reference

• MikroTik Netinstall Documentation
• MikroTik Downloads
• MikroTik RouterBOARD Documentation
• Version changes:
  • v7.9: preboot-etherboot feature added for remote reinstall
  • v7.1: Physical button confirmation for Protected RouterBOOT changes
  • v6.47: Linux netinstall-cli tool introduced

Netinstall-CLI Quick Reference

# Show help
./netinstall-cli --help

# Basic reinstall with reset
sudo ./netinstall-cli -r -a 192.168.88.3 routeros-7.16-arm.npk

# Empty config (no defaults)
sudo ./netinstall-cli -e -a 192.168.88.3 routeros-7.16-arm.npk

# With custom script
sudo ./netinstall-cli -r -a 192.168.88.3 -s config.rsc routeros-7.16-arm.npk

# Multiple packages
sudo ./netinstall-cli -r -a 192.168.88.3 routeros-7.16-arm.npk wifi-qcom-7.16-arm.npk

# Specify interface
sudo ./netinstall-cli -r -a 192.168.88.3 -i enp3s0 routeros-7.16-arm.npk

Firewall Exceptions (Windows)

If Windows Firewall blocks Netinstall, add these exceptions:

Protocol	Port	Direction	Purpose
UDP	67	Inbound	BOOTP Server
UDP	68	Outbound	BOOTP Client
UDP	69	Both	TFTP

Or temporarily disable Windows Firewall during the Netinstall process.