A Safer Way to Upgrade Your MikroTik and Prove Everyone Stays Online

Updating a router is the Matatu equivalent of servicing. Skipping it for too long results in something eventually failing at the worst possible time. Doing it poorly, in the middle of the busiest day, is just as bad.

The update itself takes a few minutes. The preparation and testing around it is a backup, an hour's peace, and a short checklist. Get these right, and the update is unexciting, which is the point of a router.

Choose the version before the hour

RouterOS is the operating system in your MikroTik, your equivalent of Android. MikroTik releases new versions through channels.

Long-term channel rarely updates with only the most impactful changes, meaning it changes the least. 

Stable channel has a new release every few months, including new features and fixes. Testing channels gets a release every few weeks with minimal testing, and it is warned against on routers that make money.

The development channel is for the adventurous. A hotspot with paying customers should use long-term or stable channel. 

Long-term is safer for the quiet life. Stable is safer if you need features that long-term does not have yet.

Before touching anything, ask the router what it is running and what is available:

/system package update set channel=long-term
/system package update check-for-updates

The result will show you your installed version, the latest version for the channel selected, and a status line. Read MikroTik's changelog for every single version between yours and the one you are updating to. You do not need to read it all. Look for words relevant to a hotspot, such as "hotspot," "radius," "PPP," "queue," "firewall," "DHCP," and "wireless," as something in any of these areas changing could affect your hotspot in some way.

A few minutes of reading now saves you a few hours of puzzling later.

How far you are behind is also important. A few months is a few months. A few years, or a jump from version 6 to version 7, is a major effort. 

MikroTik's documentation warns that an old version may need an intermediate version before the newest ones show, so you may need to update in rounds, checking for updates after each, and a version 7 changes enough settings that returning from it to 6 is not a smooth road. It is a one-way update, but you can practice it first on a spare router.

The day before

Backups come first, and there are two types. 

Binary backup is a snapshot that installs quickly on the same router. 

Export is a readable text file of your settings to open, read, and use on a different model:

/system backup save name=before-update
/export file=before-update

In RouterOS 7, an export by default will hide your passwords and secrets. Add show-sensitive if you want them, but keep this file as cash. Copy both files to your computer, because a backup that lives only on the router disappears if the router dies. 

In Winbox, drag them out of the Files window. While there, copy your branded hotspot login folder to your computer too, and write your RADIUS server address, your shared secret, and your VPN settings somewhere safe, like a password manager.

Next, ensure that the router can reach MikroTik's update server. The check will run from the router, not the computer, so the router will need working DNS and a way to get out via HTTPS. A quick test is:

:put [:resolve upgrade.mikrotik.com]

If this fails, fix DNS first, or plan to upload the update file manually, which is discussed next. If you own a spare router of the same model, load your exported settings onto it, and update it first. If you have no spare, update the least important router first and the main one last.

Choose the hour. Opt for the quietest time you can find, often early morning, and avoid your evening rush. Know that you will have two reboots, one for RouterOS and one for the firmware, and during each, nobody is online. Time a normal restart on your router, and plan a window with plenty of air around that, as every model is different. 

Tell customers the day before in one short message: "Wi-Fi will be off for 15 minutes at 6am tomorrow for an update." 

If you sell passes by the hour or day, add time to the passes that were running, the same fair rule you would use after a power cut.

Last, consider power and access. A firmware update will write directly to the router's hardware. MikroTik warns that a power failure at this time can leave a device unable to start. Run on a UPS or battery. If you manage the router over a VPN or at a distance, have someone near it, or know how to reach it by cable with Winbox, in case an update locks you out.

Doing the update

With everything backed up, run the update:

/system package update install

The router will download the new packages and restart itself. If you prefer to choose the moment of the restart, run download instead, then /system reboot when you are ready. If the router cannot see the update server, download the right file for your router's type from MikroTik's download page, drag it into the Files window in Winbox, and reboot. The file must match your router's architecture, such as arm or mipsbe, or it will not install.

When the router is back, check that the installation looked healthy, then update the firmware, which is the small starter program that runs before RouterOS and is stored separately:

/system check-installation
/system routerboard print
/system routerboard upgrade
/system reboot

The print line will show you two entries, current-firmware and upgrade-firmware. If they are different, the upgrade command will bring them in line, and the second reboot will finish the job.

MikroTik strongly recommends doing this step after every RouterOS update. Run the routerboard print once more at the end to confirm that they match, and do not break the power off while the firmware is being written. If an update goes so badly that the router will not start at all, a recovery tool called Netinstall can reinstall RouterOS from a computer. Know it exists, but do not count on it.

A word on automatic updates. MikroTik allows you to schedule them, which is good for a router where a surprise reboot is not a problem. For a hotspot that sells by the hour, update by hand, at a time you chose, with a backup in your hand.

Check the hotspot afterwards

A router that starts and shows internet is not an update. Walk through the parts that customers depend on, in this order:

- Check that Winbox shows the new version and that the CPU and memory look normal.

- Ping an outside address and a website name from the router to test the internet and DNS.

- Plug in a phone that has never joined your network, and check that the login page appears with your branding.

- Log in with a test voucher, and check that the speed limit and time limit apply.

- Look at the RADIUS side: a test login should work, and the active session should show up with usage updates reaching the server.

- Run a real test payment from your own phone, and watch the internet switch on.

- Check the walled garden, the DHCP pool, and your queues. Confirm the VPN to your billing server is up and that a disconnect message from the server still reaches the router.

- Read the log for errors, and check that the clock is right.

Since the router has rebooted, any voucher that was online may look busy on the server until old sessions clear. 

Watch the router closely through the first evening: problems that come under real load often hide in a calm morning. 

Keep your old backup for a couple of weeks, and write the date and version in a small notebook so you know when you last updated.

Then set a rhythm. Look for updates every month or two, read the notes, and update your schedule so you are never forced to do it in a hurry after something breaks.