Setting up a MikroTik site in ten minutes

This guide takes a MikroTik router with two internet lines and gives the whole site one public IPv4 address that stays the same when the router switches lines. You add the site, download one setup file, fill in four settings, import it, and open the ports you need. Everything the file adds is labelled TunnelNet, so it is easy to find and easy to remove.

Before you start

• RouterOS 7. In WinBox or the router's web page, open System > Packages and check that the version starts with 7. RouterOS 6 is not supported.
• Two internet lines plugged in, for example Starlink on one port and a cellular modem on another, each working on its own.
• Your local network must not use 10.10.0.x. The tunnel uses that range. Most MikroTik networks use 192.168.88.x, which is fine.
• A TunnelNet Business account, at $49 per site per month (includes 1 TB of traffic).

The addresses in this guide, such as 203.0.113.10, are examples. Your dashboard shows your site's real address.

Step 1: Add a site

Sign in to your dashboard and choose Add a site. A site is one location with its own router: an office, a shop, a warehouse. If this is your first site, the dashboard takes you through buying it first. Give the site a name you will recognize. Its public address shows on the site's page, and that address stays with the site.

Step 2: Choose MikroTik and download your file

Open the site's Router setup page. Under "Which router is at this site?", choose MikroTik, then click Download MikroTik file.

Your browser makes a new private key for this router and puts it in the file. We never see it and we don't keep a copy, so keep the file private and somewhere safe. The file is named after your site and ends in .rsc, for example tunnelnet-main-office.rsc.

Each download makes a new key. Once you download a new file, the one you downloaded before stops working, and the router needs the new one.

Tip: the file also contains a forward for each port you have opened. If you already know which devices and ports you need, you can do step 6 first, then download, and set up the router once.

Step 3: Fill in your two lines

Open the file in a text editor. Near the top are four line settings:

:global tnLine1gw "192.168.1.1"
:global tnLine2gw "192.168.2.1"
:global tnLine1if "ether1"
:global tnLine2if "ether2"

• tnLine1gw and tnLine2gw: the gateway address of each internet line. IP > Routes on the router shows your gateways.
• tnLine1if and tnLine2if: the port each line is plugged into, for example ether1 and ether2.

Line 1 is your main line. Line 2 is the backup. Change only these four values and save the file.

Step 4: Import it

Drag the file into Files in WinBox or the web page. Then open Terminal and run:

/import file-name=tunnelnet-main-office.rsc

Use your own file's name. Everything it adds is labelled TunnelNet.

What the file sets up

• An encrypted tunnel to TunnelNet, with your site's public address on it.
• Replies to people who reach your site go back through the tunnel, so they come from your site's address.
• A check, once a second, that line 1 still reaches the internet. While it can't, the router sends the tunnel out line 2 instead, and moves it back when line 1 returns.
• Rules so that only what you open is reachable. Nothing on the router itself can be reached through the tunnel.
• A forward to the device behind the router for each port you have opened.

Your staff's own browsing is not changed. It keeps using your normal lines the way it does today.

Step 5: Check it is connected

Once the router reaches us, your site shows Connected in your dashboard. The status turns green only when the router has really connected.

Step 6: Open a port, and limit who can use it

A new site answers nothing. You choose what people can reach.

1. On the site's Ports page, under "Devices behind this router", add the device: a name and its address on your own network. It must start 10., 192.168. or 172.16 to 172.31. For example, a recorder at 192.168.88.10.
2. Choose Open a port. Pick the device, the port on the device, the public port people will use, and TCP or UDP.
3. Under "Who may connect", choose Only these addresses and list the addresses or ranges, separated by commas, such as your office or your monitoring company (for example 198.51.100.24, 192.0.2.0/24). There is a button to add your current address.
4. Choose Open port.

The allowlist is checked on our side, before traffic reaches your line, so nobody else can even try the port. You can choose Anyone instead, but only for something meant to be public. The dashboard warns you when you do.

Your router needs the new forward too. If you change ports after your router is set up, email support@minakilabs.com (support@minakilabs.com) and we will walk you through updating it.

To test, connect from outside the site, from a place whose address is on your list. You should reach your device at your site's address and the public port you opened, for example http://203.0.113.10:8080.

How to undo

Everything the file added is labelled TunnelNet. You can delete each of those items by hand, or paste these commands into Terminal:

/tool netwatch remove [find comment~"TunnelNet"]
/ip firewall nat remove [find comment~"TunnelNet"]
/ip firewall filter remove [find comment~"TunnelNet"]
/ip firewall mangle remove [find comment~"TunnelNet"]
/ip route remove [find comment~"TunnelNet"]
/routing table remove [find name=tunnelnet]
/ip address remove [find comment~"TunnelNet"]
/interface wireguard peers remove [find comment~"TunnelNet"]
/interface wireguard remove [find name=tn-wg]

That removes the tunnel, the line checks, the forwards and the rules, and leaves the rest of your router as it was.

How it did in our lab

We tested this exact file, as a customer downloads it, on MikroTik's virtual router running RouterOS 7, with two lines set up like CGNAT connections. We cut the main line while a server outside our network checked the site every 200 milliseconds. In our lab, the site's address answered again 1.8 to 2.6 seconds after the cut, on the same address throughout. Your time depends on your router and your lines. The full method, results and limits are in One static IP across any internet line.

Need help?

Setup help on your first site is included, by email. Write to support@minakilabs.com with your router model and what you see. Support is by email only.

Not sure whether your line is behind CGNAT? See Stuck behind CGNAT? What it means for a small business. Ready to start? Go to the TunnelNet Business page, or add your first site.

TunnelNet is operated by MinakiLabs LLC.