MikroTik Configuration

Settings for the MikroTik RouterOS API connection.

Connection

mikrotik.address Required

Env: MIKROTIK_HOST · Default: — (required)

RouterOS API address in host:port format. There is no built-in default: the bouncer exits with mikrotik.address is required if this value is empty. The 192.168.0.1:8728 used below is the sample value shipped in config/cs-routeros-bouncer.yaml, not a default.

• Port 8728 — plaintext API
• Port 8729 — TLS-encrypted API

mikrotik:
  address: "192.168.0.1:8728"

mikrotik.username Required

Env: MIKROTIK_USER · Default: — (required)

The RouterOS API username. There is no built-in default: the bouncer exits with mikrotik.username is required if this value is empty. The crowdsec name is the sample value shipped in config/cs-routeros-bouncer.yaml, not a default. Use a dedicated user with minimal permissions. See Router Setup for creating the user.

mikrotik.password Required

Env: MIKROTIK_PASS · Default: — (required)

The RouterOS API password.

Environment variables

For sensitive values like passwords, use environment variables instead of the config file:

export MIKROTIK_PASS="your-secure-password"

TLS

mikrotik.tls Optional

Env: MIKROTIK_TLS · Default: false

Enable TLS for the RouterOS API connection. Requires the api-ssl service on the router (port 8729).

mikrotik:
  address: "192.168.0.1:8729"
  tls: true

mikrotik.tls_insecure Optional

Env: MIKROTIK_TLS_INSECURE · Default: false

Skip TLS certificate verification. Only needed when the router uses a self-signed certificate.

Caution

Keep tls_insecure: false whenever possible: the recommended production setup is a certificate signed by a CA the bouncer host trusts, so the connection stays both encrypted and verified. Set tls_insecure: true only for self-signed certificates or temporary troubleshooting.

Timeouts

mikrotik.connection_timeout Optional

Env: MIKROTIK_CONN_TIMEOUT · Default: 10s

Maximum time to wait for the initial API connection. Uses Go duration format.

mikrotik.command_timeout Optional

Env: MIKROTIK_CMD_TIMEOUT · Default: 30s

Maximum time to wait for a single API command to complete. Increase if you have a slow router or large address lists.

Tip

The bound is per command, not per reconciliation pass, and the slowest single command is not a bulk chunk — those run in about 130 ms each. It is the address-list read at the start of every pass, which scales with how many entries the router holds. Measured on an RB5009 with 22,332 entries that read takes ~1.8 s, so the default 30s has roughly 17× of headroom and only becomes the binding constraint somewhere north of 350,000 entries.

Raise it if you see timeout errors on a slow device or a very large list. Both timeouts must be >= 0; 0 means no bound, and a negative value is rejected at startup.

Connection Pool

mikrotik.pool_size Optional

Env: MIKROTIK_POOL_SIZE · Default: 4

How many RouterOS API sessions the bouncer can use for parallel work such as reconciliation removals. A higher value increases throughput when reconciliation has many stale address-list entries to delete; adds and live decisions always use the main connection, so they are not affected.

• Valid range: 1–20
• Auto-capping: On startup the bouncer queries the router’s API service max-sessions limit and automatically reduces the effective pool size so it never exceeds max-sessions − 2 (reserving connections for the main client and external tools such as WinBox).

mikrotik:
  pool_size: 8 # Higher parallelism for reconciliation removals

Checking the router limit

The RouterOS API service has a max-sessions setting that limits simultaneous connections. The factory default is 20.

# Check current limit
/ip/service/print where name=api

# Increase it (maximum supported value is 1000)
/ip/service/set api max-sessions=1000

Performance tuning

For small to medium deployments (≤ 5,000 IPs) the default pool_size: 4 is optimal. For very large CAPI lists (20,000+ IPs) increasing to 6–8 can noticeably reduce reconciliation time. Always verify the router’s max-sessions first:

/ip/service/set api max-sessions=1000

Note

Each pool connection is a full RouterOS API session. On resource-constrained routers (e.g., hAP lite) keep pool_size low (1–2) to avoid memory pressure.