RouterBOARD Firmware and Boot Settings

RouterBOARD Firmware and Boot Settings

Version Info

RouterOS 7.16 | Min: v5.x+ | Hardware Only | ⏱️ 10 minutes | 🟡 Intermediate

Tested on: 7.16 7.14

Version-specific notes

• v7.19.3: Required for protected RouterBOOT on some older hardware
• v7.9: Added preboot-etherboot for Netinstall without physical button press
• v7.1: Protected RouterBOOT requires physical button confirmation within 60 seconds
• v6.47: Button hold-time option added for mode/reset buttons

TL;DR (Quick Start)

For the impatient: check if your firmware needs upgrading and upgrade it.

# Check firmware versions
/system/routerboard/print

# If upgrade-firmware differs from current-firmware:
/system/routerboard/upgrade
# Confirm with 'y', then reboot:
/system/reboot

Verify after reboot:

/system/routerboard/print
# current-firmware should now match the previous upgrade-firmware

Overview

What this does: The RouterBOARD menu (/system/routerboard) manages your device’s bootloader firmware (RouterBOOT), boot device selection, serial console settings, hardware button behaviors, and security features.

When to use this:

• After RouterOS upgrades (to update bootloader firmware)
• Configuring boot behavior for recovery scenarios
• Enabling protected boot mode for high-security deployments
• Customizing reset/mode button actions
• Troubleshooting boot issues or performing Netinstall recovery

Prerequisites:

• Physical RouterBOARD hardware (not CHR or x86)
• RouterOS installed and accessible
• Physical access recommended for recovery scenarios

Hardware Only

This feature applies only to MikroTik RouterBOARD hardware. Cloud Hosted Router (CHR) and x86 installations do not have RouterBOARD settings.

Configuration Steps

Step 1: Check Firmware Status

View current device information and firmware versions:

/system/routerboard/print

Expected output:

       routerboard: yes
             model: RB5009UG+S+IN
     serial-number: XXXXXXXXXXXXXX
     firmware-type: ipq8070
  current-firmware: 7.15
  upgrade-firmware: 7.16

Key indicators:

• current-firmware: Active bootloader version
• upgrade-firmware: Latest available (from RouterOS package)
• If they differ, an upgrade is available

Step 2: Upgrade Firmware (If Needed)

If upgrade-firmware shows a newer version:

/system/routerboard/upgrade

When prompted, confirm with y.

Critical: The upgrade is staged but not applied until you reboot:

/system/reboot

Step 3: Verify Upgrade

After reboot, confirm the upgrade succeeded:

/system/routerboard/print

Expected: current-firmware now matches the previous upgrade-firmware value.

Step 4: Enable Auto-Upgrade (Optional)

Automatically upgrade RouterBOOT firmware after each RouterOS upgrade:

/system/routerboard/settings/set auto-upgrade=yes

Common Scenarios

Scenario: View Boot and Hardware Settings

/system/routerboard/settings/print

Shows boot device, delays, serial settings, and protection status.

Scenario: Configure Mode Button for Custom Script

Create a script that toggles WiFi when the mode button is pressed:

Step 1: Create the script

/system/script/add name=toggle-wifi source={
    :local wlan [/interface/wireless/find name=wlan1]
    :if ([/interface/wireless/get $wlan disabled]) do={
        /interface/wireless/enable $wlan
        :log info "WiFi enabled via mode button"
    } else={
        /interface/wireless/disable $wlan
        :log info "WiFi disabled via mode button"
    }
}

Step 2: Assign to mode button

/system/routerboard/mode-button/set enabled=yes hold-time=3s..5s on-event=toggle-wifi

The button must be held 3-5 seconds to trigger the script.

Scenario: Enter Netinstall/Etherboot Mode

For device recovery or reinstallation:

Method 1: Reset Button (Most Common)

1. Disconnect power
2. Hold reset button
3. Apply power while holding
4. Release when LED indicates Etherboot mode (usually solid or flashing pattern)

Method 2: RouterOS Command (Pre-configured)

/system/routerboard/settings/set boot-device=try-ethernet-once-then-nand
/system/reboot

Method 3: Serial Console

1. Connect serial cable (115200 baud default)
2. Power on device
3. Press Ctrl+E repeatedly until “trying bootp protocol” appears

Scenario: Enable Protected RouterBOOT

High-security mode that disables Netinstall and RouterBOOT console access:

/system/routerboard/settings/set protected-routerboot=enabled

Starting v7.1: You must press the reset or mode button within 60 seconds to confirm.

Warning

Protected RouterBOOT makes device recovery extremely difficult without the RouterOS password. Document your password before enabling. If you forget the password, the device may only be recoverable via emergency reformat.

Scenario: Customize Reset Timing (Anti-Attack)

Make the emergency reformat timing difficult to guess:

/system/routerboard/settings/set reformat-hold-button=60s reformat-hold-button-max=65s

This requires holding the reset button exactly 60-65 seconds for emergency reset.

Scenario: Configure Pre-boot Etherboot (v7.9+)

Allow Netinstall without physical button press:

/system/routerboard/settings/set preboot-etherboot=10s preboot-etherboot-server=192.168.88.2

The device will search for Netinstall for 10 seconds at each boot, only accepting from the specified server.

Scenario: Adjust Serial Console Speed

Change baud rate for serial console access:

/system/routerboard/settings/set baud-rate=9600

Common rates: 9600, 19200, 38400, 57600, 115200 (default)

Scenario: Disable Reset Button Scripts

Prevent custom scripts from running on reset button (keeps factory reset):

/system/routerboard/reset-button/set enabled=no hold-time=0s..1m on-event=""

Verification

Confirm your RouterBOARD configuration is correct:

Check 1: Verify Hardware and Firmware

/system/routerboard/print

Expected: routerboard: yes, correct model, firmware versions displayed.

Check 2: Verify Boot Settings

/system/routerboard/settings/print

Expected: Boot device, protection status, and serial settings as configured.

Check 3: Verify Button Configuration

/system/routerboard/mode-button/print
/system/routerboard/reset-button/print

Expected: Enabled status and assigned scripts if configured.

Check 4: Verify Serial Console Access

Connect via serial (115200 8N1) and confirm console responds.

Troubleshooting

Symptom	Cause	Solution
Firmware shows upgraded but current-firmware unchanged	Reboot not performed after upgrade	Reboot with /system/reboot
Device unresponsive after remote firmware upgrade	Some devices hang during bootloader update	Wait several minutes; have physical access for recovery
Cannot access device after enabling protected RouterBOOT	Forgot RouterOS password	Only option is emergency reformat (destroys config)
Netinstall not detecting device	Multiple causes	See Netinstall troubleshooting below
Device always tries network boot	boot-device set to ethernet	Use serial console to change boot-device setting
Device extremely slow after firmware upgrade	CPU frequency reset to minimum	Restore cpu-frequency: /system/routerboard/settings/set cpu-frequency=<nominal>
Firmware upgrade fails or shows old version	Old firmware files in /file	Delete old firmware files before upgrade
No RouterBOARD menu	Not physical RouterBOARD hardware	CHR and x86 don’t have RouterBOARD settings

Netinstall Troubleshooting

If Netinstall doesn’t detect your device:

1. Disable other network interfaces on PC - Only the interface connected to the router should be active
2. Connect directly - No switches between PC and router
3. Verify Etherboot mode - Check LED pattern matches documentation
4. Check protected RouterBOOT - If enabled, Netinstall won’t work
5. Disable DHCP clients - Other DHCP clients on the network can interfere
6. Try different USB adapter - Some USB network adapters cause link flap issues

Debug: Check Firmware Upgrade Status

After upgrade command, before reboot:

/system/routerboard/print
# upgrade-firmware should show the new version staged

Common Mistakes

• Forgetting to reboot after firmware upgrade - The upgrade isn’t applied until reboot
• Remote firmware upgrades without physical access - If something goes wrong, you need physical access to recover
• Enabling protected RouterBOOT without documenting password - No password = bricked device
• Setting boot-device to ethernet permanently - Device won’t boot from NAND; use try-ethernet-once-then-nand instead
• Upgrading firmware before RouterOS - Always upgrade RouterOS first, then firmware
• Overclocking beyond nominal values - May void warranty and cause instability

Community Tips

Firmware Upgrade Best Practice:

1. Upgrade RouterOS first
2. Then upgrade RouterBOOT firmware
3. Only upgrade firmware when necessary (known fixes, security updates)

Protected RouterBOOT Recovery: If you’ve enabled protected RouterBOOT but still have access, document the exact reformat-hold-button timing values. This is your last resort for recovery.

Version Numbering: Since RouterOS 7.x, RouterBOOT version numbers match RouterOS versions. Don’t be alarmed if versions seem “out of sync” - this is normal during transitions.

When to Upgrade Firmware: Community consensus: upgrade once after initial RouterOS installation, then only when addressing specific issues or after major RouterOS updates.

Boot Device Options Reference

Value	Description
nand-if-fail-then-ethernet	Boot from NAND, fallback to Etherboot if NAND fails
nand-only	Boot from NAND exclusively, no network fallback
try-ethernet-once-then-nand	Single Etherboot attempt, then boot from NAND
ethernet	Network boot (Etherboot) only
flash-boot	Flashfig configuration mode
flash-boot-once-then-nand	Single Flashfig boot, then NAND

Related Topics

System Management

• Reset Configuration - factory reset options
• Package Installation - package management including firmware
• Resources - view CPU, memory, storage information

Automation

• Scheduler - automated tasks triggered by buttons
• System Backup - backup before firmware updates

Hardware

• Health Monitoring - temperature and voltage sensors
• LEDs - LED behavior configuration

Reference

• MikroTik RouterBOARD Documentation
• MikroTik Netinstall Documentation
• Version changes:
  • v7.19.3: Protected RouterBOOT support for older hardware
  • v7.9: preboot-etherboot feature added
  • v7.1: Physical button confirmation for protected RouterBOOT
  • v6.47: Button hold-time option added

Key Properties Reference

Read-Only Properties (/system/routerboard/print)

Property	Type	Description
routerboard	yes/no	Whether device is genuine RouterBOARD hardware
model	string	Device model name
serial-number	string	Unique device identifier
current-firmware	string	Currently active RouterBOOT version
factory-firmware	string	RouterBOOT version shipped with device
upgrade-firmware	string	Latest available RouterBOOT (from RouterOS package)
firmware-type	string	Device-specific firmware type identifier

Boot Settings (/system/routerboard/settings)

Property	Type	Default	Description
auto-upgrade	yes/no	no	Auto-upgrade firmware after RouterOS upgrade
boot-delay	time	2s	Time to wait for keypress during boot
boot-device	enum	nand-if-fail-then-ethernet	Primary boot source selection
boot-protocol	bootp/dhcp	bootp	Protocol for network boot
baud-rate	integer	115200	Serial console speed (bits/sec)
silent-boot	yes/no	no	Disable boot beep sounds
protected-routerboot	enabled/disabled	disabled	Disable Etherboot and console access
reformat-hold-button	time	20s	Button hold time for emergency reset (5s-300s)
reformat-hold-button-max	time	10m	Maximum hold time window (15s-600s)
preboot-etherboot	time/disabled	disabled	Pre-boot Netinstall search window (v7.9+)
cpu-frequency	integer	model-dependent	CPU clock speed (MHz)
memory-frequency	integer	model-dependent	RAM clock speed (MHz)

Button Properties (/system/routerboard/mode-button, /system/routerboard/reset-button)

Property	Type	Default	Description
enabled	yes/no	no	Enable custom button behavior
hold-time	min..max	-	Required press duration (e.g., 3s..5s)
on-event	script name	-	Script to execute on button press

Hardware Availability

Button	Available On
Mode button	cAP, hEX, CRS3xx, CCR, hAP series
Reset button	Most RouterBOARD devices
WPS button	D53, C53, S53, H53 series only