mikrotik-chr-installer/README-EN.md

MikroTik CHR Installer

Automated MikroTik Cloud Hosted Router (CHR) installation script for Linux VPS/VDS servers.

📋 Overview

This script automates the complete installation of MikroTik Cloud Hosted Router (CHR) on any Linux-based VPS or VDS server. It handles everything from downloading the CHR image to configuring network settings and performing the installation — all with a single command.

Key Features

• 🚀 One-command installation — fully automated process
• 🌐 Auto-detection of network settings — IP address, gateway, interface
• 📦 Automatic dependency installation — works on Debian/Ubuntu, CentOS, RHEL, Fedora
• 🔧 Pre-configured autorun — CHR boots with network already configured
• ✅ Image validation — MBR signature and integrity checks
• 🔄 Flexible options — customizable version, password, and installation modes

🎯 Use Cases

1. Quick VPS Migration to MikroTik

Replace your Linux VPS with a full MikroTik router in minutes. Perfect for:

• Setting up a VPN server (WireGuard, L2TP, PPTP, OpenVPN)
• Creating a secure gateway for your infrastructure
• Building a remote network management point

2. Network Lab Environment

Quickly deploy MikroTik instances for:

• Testing RouterOS configurations before production
• Learning MikroTik administration
• Certification exam preparation (MTCNA, MTCRE, etc.)

3. Site-to-Site VPN Hub

Transform a cheap VPS into a central VPN hub connecting multiple sites:

• Cloud-based router for distributed networks
• Backup connectivity point
• Geographic routing optimization

4. Traffic Management & Monitoring

Deploy CHR for:

• Bandwidth management and QoS
• Traffic analysis with built-in tools
• Firewall and security gateway

📦 Requirements

• Linux-based VPS/VDS server (Debian, Ubuntu, CentOS, RHEL, Fedora)
• Root access
• Minimum 128 MB RAM (256 MB+ recommended)
• At least 128 MB disk space
• Active internet connection
• Both boot modes supported: Legacy BIOS and UEFI

🚀 Quick Start

One-Line Installation

wget -qO- https://raw.githubusercontent.com/skurudo/mikrotik-chr-installer/main/chr-installer.sh | bash

Manual Installation

# Download the script
wget https://raw.githubusercontent.com/skurudo/mikrotik-chr-installer/main/chr-installer.sh

# Make it executable
chmod +x chr-installer.sh

# Run the installer
sudo ./chr-installer.sh

📖 Usage Examples

Basic Installation (Interactive)

sudo ./chr-installer.sh

The script will:

1. Download the latest CHR image
2. Detect your network configuration
3. Ask for confirmation before writing to disk
4. Prompt for reboot after installation

Fully Automated Installation

sudo ./chr-installer.sh --yes --reboot

No user interaction required — perfect for automation and scripts.

Custom Version and Password

sudo ./chr-installer.sh --version 7.14.3 --password MySecurePass123

Clean Installation (No Auto-Configuration)

sudo ./chr-installer.sh --clean

CHR will boot with default settings. Useful when you want to configure everything manually.

Automation Script Example

#!/bin/bash
# Deploy MikroTik CHR on multiple servers

SERVERS="192.168.1.10 192.168.1.11 192.168.1.12"
PASSWORD="StrongPassword123"

for server in $SERVERS; do
    ssh root@$server "curl -sL https://example.com/chr-installer.sh | bash -s -- --yes --reboot --password $PASSWORD"
done

⚙️ Command Line Options

Option	Description
--clean	Clean installation without autorun.scr (manual configuration required)
--force	Force re-download of the CHR image
--no-verify	Skip write verification
--yes, -y	Automatic mode, no confirmations
--reboot	Auto-reboot after installation (requires --yes)
--version VER	Specify CHR version (default: 7.16.1)
--password PASS	Set admin password (default: PASSWORD)
-h, --help	Show help message

🔧 What the Script Does

1. Checks dependencies — installs required tools if missing
2. Downloads CHR image — from official MikroTik servers
3. Validates the image — checks MBR signature and file integrity
4. Detects network settings — IP address, gateway, interface
5. Creates autorun.scr — configures CHR to boot with your network settings
6. Writes to disk — uses dd with direct I/O for reliability
7. Reboots — into your new MikroTik CHR

🌐 Post-Installation Access

After installation and reboot, access your CHR via:

• WinBox: Connect to your server's IP address (port 8291)
• SSH: ssh admin@YOUR_SERVER_IP

Note

: Web interface (WebFig) is disabled by default for security reasons. You can enable it if needed: /ip service set www disabled=no

Default credentials:

• Username: admin
• Password: as specified with --password (default: PASSWORD)

⚠️ Important Notes

• All data on the target disk will be erased!
• The script requires root privileges
• Ensure you have console/KVM access in case of issues
• Test in a non-production environment first
• Default CHR license is free (limited to 1 Mbps upload)

🔒 Security Recommendations

1. Change the default password immediately if you used the default
2. Disable unused services after first login
3. Configure firewall rules to protect management access
4. Update to latest RouterOS version regularly

📝 Default CHR Configuration

The autorun script configures:

/ip dns set servers=8.8.8.8,8.8.4.4
/ip service set telnet disabled=yes
/ip service set ftp disabled=yes
/ip service set www disabled=yes
/ip service set ssh disabled=no
/ip service set api disabled=yes
/ip service set api-ssl disabled=yes
/ip service set winbox disabled=no
/ip address add address=YOUR_IP interface=ether1
/ip route add gateway=YOUR_GATEWAY

🛠️ Customizing autorun.scr

You can edit the script and add your own configuration to autorun.scr. This allows CHR to boot with a fully prepared setup — firewall, VPN, users, etc.

Where to Edit

Find the autorun creation block in the installer script (search for autorun.scr):

cat > "$MOUNT_POINT/rw/autorun.scr" <<EOF
# Your configuration here
EOF

Custom Configuration Examples

Basic VPS Firewall

# SSH brute force protection
/ip firewall filter
add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop comment="Drop SSH brute force"
add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w
add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m
add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage1 action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m
add chain=input protocol=tcp dst-port=22 connection-state=new action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m

# Basic rules
add chain=input connection-state=established,related action=accept comment="Accept established"
add chain=input connection-state=invalid action=drop comment="Drop invalid"
add chain=input protocol=icmp action=accept comment="Accept ICMP"
add chain=input protocol=tcp dst-port=22 action=accept comment="Accept SSH"
add chain=input protocol=tcp dst-port=8291 action=accept comment="Accept WinBox"
add chain=input action=drop comment="Drop all other"

IP-Based Access Restriction

# Allow management only from specific IPs
/ip firewall address-list
add list=management address=YOUR_HOME_IP comment="Home IP"
add list=management address=YOUR_OFFICE_IP comment="Office IP"

/ip firewall filter
add chain=input src-address-list=management action=accept comment="Allow management IPs"
add chain=input protocol=tcp dst-port=22,8291,80,443 action=drop comment="Block management from others"

WireGuard VPN Setup

/interface wireguard
add name=wg0 listen-port=51820 private-key="YOUR_PRIVATE_KEY"

/interface wireguard peers
add interface=wg0 public-key="PEER_PUBLIC_KEY" allowed-address=10.0.0.2/32

/ip address
add address=10.0.0.1/24 interface=wg0

/ip firewall filter
add chain=input protocol=udp dst-port=51820 action=accept comment="Accept WireGuard"

Automatic Configuration Backup

# Create backup script
/system script
add name=backup-script source="/system backup save name=auto-backup"

# Scheduler runs the script daily at 03:00
/system scheduler
add name=daily-backup interval=1d on-event=backup-script start-time=03:00:00

NTP and Timezone Configuration

/system clock set time-zone-name=America/New_York
/system ntp client set enabled=yes
/system ntp client servers add address=pool.ntp.org

Full Custom autorun.scr Example

cat > "$MOUNT_POINT/rw/autorun.scr" <<EOF
# === Basic Setup ===
/ip dns set servers=${DNS_SERVERS}
/ip dhcp-client remove [find]
/ip address add address=${ADDRESS} interface=[/interface ethernet find where name=ether1]
/ip route add gateway=${GATEWAY}
/user set 0 name=admin password=${ADMIN_PASSWORD}

# === Services ===
/ip service set telnet disabled=yes
/ip service set ftp disabled=yes
/ip service set www disabled=no
/ip service set ssh disabled=no port=22
/ip service set api disabled=yes
/ip service set api-ssl disabled=yes
/ip service set winbox disabled=no

# === Firewall ===
/ip firewall filter
add chain=input connection-state=established,related action=accept
add chain=input connection-state=invalid action=drop
add chain=input protocol=icmp action=accept
add chain=input protocol=tcp dst-port=22 action=accept
add chain=input protocol=tcp dst-port=8291 action=accept
add chain=input action=drop

# === System ===
/system clock set time-zone-name=America/New_York
/system identity set name=MikroTik-CHR
EOF

🐛 Troubleshooting

CHR doesn't boot

• Check console output via VNC/KVM
• Verify the disk was written correctly
• Try --clean mode and configure manually

Network not working after boot

• Verify IP and gateway settings in CHR
• Check if the interface name is ether1
• Review firewall rules on the hosting provider

Can't connect via SSH/WinBox

• Wait 1-2 minutes for CHR to fully boot
• Verify the IP address is correct
• Check hosting provider's firewall/security groups

📦 Installation Variants

Several scripts are available for different scenarios:

Minimal Installation

Script	Language	Description
chr-installer.sh	RU	Basic installer with network auto-config
chr-installer-en.sh	EN	Basic installer with network auto-config

With Basic Security Configuration

Script	Language	Description
chr-installer-base-ru.sh	RU	+ Firewall, brute-force protection, NTP, auto-backup
chr-installer-base-en.sh	EN	+ Firewall, brute-force protection, NTP, auto-backup

Includes:

• SSH/WinBox brute-force protection
• DNS amplification attack protection
• Disable insecure services
• NTP and timezone configuration
• Daily auto-backup

VPN Server (All Protocols)

Script	Language	Description
chr-installer-adv-vpn-ru.sh	RU	Full-featured VPN server
chr-installer-adv-vpn-en.sh	EN	Full-featured VPN server

Includes all protocols:

• PPTP (port 1723)
• L2TP/IPsec (port 1701, UDP 500/4500) — auto-generated 12-char PSK
• SSTP (port 443) — auto-generated self-signed certificate
• OpenVPN (port 1194 UDP/TCP, 1195 TCP) — auto-generated certificate
• WireGuard (port 51820) — auto-generated server key

Additional VPN parameters:

--vpn-user USER      # VPN username (default: vpnuser)
--vpn-pass PASS      # VPN password (auto-generated)
--ipsec-secret KEY   # IPsec PSK (auto-generated)
--wg-port PORT       # WireGuard port (default: 51820)

🚀 One-Line Quick Installation

Basic setup with security (EN):

bash <(curl -sL https://raw.githubusercontent.com/skurudo/mikrotik-chr-installer/main/chr-installer-base-en.sh) --yes --reboot

Basic setup with security (RU):

bash <(curl -sL https://raw.githubusercontent.com/skurudo/mikrotik-chr-installer/main/chr-installer-base-ru.sh) --yes --reboot

VPN server with all protocols (EN):

bash <(curl -sL https://raw.githubusercontent.com/skurudo/mikrotik-chr-installer/main/chr-installer-adv-vpn-en.sh) --yes --reboot

VPN server with all protocols (RU):

bash <(curl -sL https://raw.githubusercontent.com/skurudo/mikrotik-chr-installer/main/chr-installer-adv-vpn-ru.sh) --yes --reboot

VPN server with custom parameters:

bash <(curl -sL https://raw.githubusercontent.com/skurudo/mikrotik-chr-installer/main/chr-installer-adv-vpn-en.sh) \
  --password MyAdminPass \
  --vpn-user myuser \
  --vpn-pass MyVPNPass123 \
  --ipsec-secret MyIPsecKey \
  --yes --reboot

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

📮 Support

If you encounter any issues or have questions, please open an issue on GitHub.

---

Disclaimer: This script is provided as-is. Always ensure you have backups and console access before running on production systems. MikroTik and RouterOS are trademarks of MikroTik SIA.