GUIDE / UPGRADES

Upgrades.

Keeping RouterOS current is a security item, not just a feature one — most of the published CVEs are fixed in patch releases on the same minor. The catch is that downgrades are partly one-way (config schemas evolve) so you want to back up before every upgrade and read the channel descriptions before picking one.

Release channels

RouterOS publishes four parallel channels:

• stable — the recommended track for production. Bugfixes and security patches; new features only after they've baked in testing.
• long-term — older minor with extended security backports. For boards in environments where you'd rather pay nothing in feature churn but still get CVEs patched. v6.49.x lives here.
• testing — newer features, exposed-to-the-wild stability. Useful on a lab device; risky in production.
• development — pre-release. Don't.

Most homelab / SOHO setups want stable. Production WISP edges sometimes pin long-term for change-management reasons.

Setting the channel

/system package update set channel=stable
/system package update check-for-updates

/system/package/update set channel=stable
/system/package/update check-for-updates

check-for-updates queries MikroTik's update server and populates the installed-version / latest-versionfields. It doesn't install anything yet.

The upgrade flow

Three commands, in order:

# 1. take a backup BEFORE upgrading (always, no exceptions)
/system backup save name=pre-upgrade-$(date +%Y%m%d)
/export file=pre-upgrade-config-$(date +%Y%m%d)

# 2. download + reboot to apply
/system package update install

# 3. after reboot, verify the new version
/system resource print
# look for "version: 7.x.y" matching what you intended

# 1. take a backup BEFORE upgrading (always, no exceptions)
/system/backup save name=pre-upgrade-$(date +%Y%m%d)
/export file=pre-upgrade-config-$(date +%Y%m%d)

# 2. download + reboot to apply
/system/package/update install

# 3. after reboot, verify the new version
/system/resource print
# look for "version: 7.x.y" matching what you intended

Step 2 reboots automatically. The router is unreachable for ~30–60 seconds on most hardware; longer on RouterBOARD with slow flash. Plan for the interruption.

Don't forget the RouterBOARD firmware

The RouterOS install you just did is the OS. The RouterBOARD also has its own bootloader/firmware ("RouterBOOT") which can lag behind the OS after an upgrade — and the OS will frequently ship features or security fixes that depend on a newer RouterBOOT. Check for an available firmware update after the OS reboot finishes, then a second reboot applies it:

# show current firmware vs the version bundled with the new OS
/system routerboard print

# if "current-firmware" lags behind "upgrade-firmware", upgrade and reboot
/system routerboard upgrade
/system reboot

# show current firmware vs the version bundled with the new OS
/system/routerboard print

# if "current-firmware" lags behind "upgrade-firmware", upgrade and reboot
/system/routerboard upgrade
/system/reboot

On a healthy upgrade you'll see current-firmware equal toupgrade-firmware in the print output — that's the all-clear. Skipping this step often shows up later as an "unexplained" feature silently not working (e.g. SFP modules failing to negotiate, or a new POE behaviour not taking effect).

Downgrading

Downgrades are partly supported. RouterOS keeps the old image around as a fallback, but the config schema may have evolved during the upgrade — settings that didn't exist in the older version get silently dropped.

# downgrade to the previously-installed version
/system package downgrade

# downgrade to the previously-installed version
/system/package downgrade

v6 → v7 migration

The v6 → v7 jump is a major version transition. MikroTik's official guidance:

• Upgrade to the latest v6.49.x first (closest to v7 in feature parity).
• Export the config to text (/export) — not the binary backup, which is version-bound.
• Run the v7 installer.
• Most config carries over, but expect to manually fix anything that used /interface wireless (WiFi packaging changed) and anything bridge-VLAN-related.

See RouterOS v7 migrationon help.mikrotik.com for the full list of breaking changes.