RouterOS Upgrade Guide: Safe Update Procedures

Safely Upgrading RouterOS Firmware

Keeping RouterOS up to date is important for security patches, bug fixes, and new features. However, upgrades should be done carefully — a failed upgrade can leave a router unreachable. This guide walks you through a safe upgrade process for RouterOS v7.

Before You Upgrade

1. Check Current Version

TEXT

/system resource print

Look for the version field. Also check:

TEXT

/system routerboard print

This shows the RouterBOARD model and firmware version separately from the RouterOS software version.

2. Take a Full Backup

Always back up before upgrading:

TEXT

/system backup save name=pre-upgrade-backup

Download this backup to your computer. If the upgrade fails, you may need it.

3. Check Available Packages

TEXT

/system package print

This shows all installed packages and their current versions.

Checking for Updates

Method 1: Check via RouterOS

TEXT

/system package update check-for-updates channel=stable

Channels available:

stable: Recommended for production. Thoroughly tested releases.
long-term: Even more conservative. Bug fixes only for a specific major version.
testing: Beta releases. Do not use in production.
development: Nightly builds. Never use in production.

Method 2: Manual Download from MikroTik

Go to https://mikrotik.com/download and download the correct package for your router architecture. Common architectures:

arm: Most modern home/office routers (hEX, RB4011, etc.)
arm64: Newer high-end devices
mipsbe: Older/budget devices (RB750, hAP lite)
x86: CHR (Cloud Hosted Router) and PC-based routers
tile: CCR series (Cloud Core Router)

Check your architecture:

TEXT

/system resource print | grep architecture

Upgrading via RouterOS (Recommended for Most Users)

If your router has internet access, the easiest method is to upgrade directly:

TEXT

/system package update check-for-updates channel=stable
/system package update download

Wait for the download to complete, then:

TEXT

/system package update install

The router will reboot and install the new version.

Upgrading via Package Upload

If you downloaded packages manually:

Upload the .npk package file to the router (via Winbox Files, or SCP/FTP).
Verify it appears in the file list:

TEXT

/file print

Reboot to trigger the upgrade:

TEXT

/system reboot

RouterOS installs any .npk files found in the root directory during boot.

Upgrading the RouterBOARD Firmware

After upgrading RouterOS software, you should also upgrade the low-level RouterBOARD firmware:

TEXT

/system routerboard upgrade
/system reboot

This updates the bootloader and hardware-level firmware. It is separate from RouterOS and must be done after the RouterOS upgrade.

Rollback Plan

If the Router is Unreachable After Upgrade

RouterOS has a built-in rollback feature — if the router reboots three times without a successful connection within a configured time, it can revert to the previous version. However, this is not always reliable.

More reliable rollback steps:

Netinstall: MikroTik's utility to reinstall RouterOS over the network. Requires physical access (press the reset button while powering on).
Restore from backup: Use Netinstall to get a clean RouterOS, then restore your pre-upgrade backup.

Keeping the Old Version Available

Before upgrading, note the old version number. You can download older RouterOS versions from https://mikrotik.com/download (scroll down for older releases).

Safe Upgrade Checklist

[ ] Check current version with /system resource print
[ ] Take and download a full backup
[ ] Verify the correct architecture package
[ ] Read the RouterOS changelog for breaking changes
[ ] Schedule the upgrade during a maintenance window
[ ] Have console/out-of-band access ready in case the router is unreachable
[ ] Test after upgrade: ping, DNS, NAT, firewall

Summary

Always back up before upgrading.
Use the stable channel for production routers.
Upgrade RouterOS first, then upgrade the RouterBOARD firmware.
Know your rollback plan before starting.
Read the changelog for any breaking changes in the new version.

Routine upgrades on a planned maintenance window, with a backup ready, are low-risk and keep your network secure.