Sign inSign up

afsharidevops/mikrotik

By afsharidevops

•Updated about 1 month ago

Mikrotik 7.21.4 Long-term Over Docker - License Level 6

Image
Networking
10

10K+

afsharidevops/mikrotik repository overview

⁠afsharidevops/mikrotik repository overview

⁠MikroTik RouterOS 7.21.4 Long-term in Docker (License Level 6)

This Docker image is intended only for laboratory and testing purposes. We are not responsible if it is used commercially or in production environments.

This is not an official MikroTik Docker image. MikroTik and RouterOS are trademarks of MikroTik.

⁠Get Started
⁠Pull Image from Docker Hub
docker pull afsharidevops/mikrotik

Or specify a version:

docker pull afsharidevops/mikrotik:7.21.4
⁠Quick Start
docker run -it --name mikrotik --cap-add=NET_ADMIN --device=/dev/net/tun \
  -d -p 8291:8291 afsharidevops/mikrotik:7.21.4

Or use the latest tag:

docker run -it --name mikrotik --cap-add=NET_ADMIN --device=/dev/net/tun \
  -d -p 8291:8291 afsharidevops/mikrotik:latest

WinBox Login:

  • User: admin
  • Pass: admin
⁠Docker Compose Example
services:
  routeros:
    container_name: "mikrotik"
    image: afsharidevops/mikrotik:7.21.4
    privileged: true
    ports:
      - "21:21"       # ftp
      - "22:22"       # ssh
      - "23:23"       # telnet
      - "80:80"       # www
      - "443:443"     # www-ssl
      - "1194:1194"   # OVPN
      - "1450:1450"   # L2TP
      - "8291:8291"   # WinBox
      - "8728:8728"   # API
      - "8729:8729"   # API-SSL
      - "13231:13231" # WireGuard
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
⁠Available Tags
  • latest – latest published RouterOS image
  • 7.21.4 – RouterOS 7.21.4 Long-term
  • 7.20.4 – RouterOS 7.20.4
  • 7.20.2 – RouterOS 7.20.2
  • 7.19.3 – RouterOS 7.19.3
  • 7.17.2 – RouterOS 7.17.2
⁠Requirements
  • Docker Engine
  • NET_ADMIN capability
  • /dev/net/tun for VPN/tunnel features
⁠6to4 Tunnel iptables Config
PUBLIC_IP="$(hostname -I | awk '{print $1}')"
CONTAINER_IP="$(docker inspect -f '{{ .NetworkSettings.Networks.bridge.IPAddress }}' mikrotik)"

iptables -t nat -A PREROUTING -d "$PUBLIC_IP" -p 41 -j DNAT --to-destination "$CONTAINER_IP"
iptables -t nat -A POSTROUTING -s "$CONTAINER_IP" -p 41 -j SNAT --to-source "$PUBLIC_IP"
iptables -A FORWARD -p 41 -d "$CONTAINER_IP" -j ACCEPT
iptables -A FORWARD -p 41 -s "$CONTAINER_IP" -j ACCEPT
iptables-save > /etc/iptables-save

⁠RouterOS Long-term Changelog

Source: MikroTik official changelog.

⁠7.21.4 Long-term — 2026-04-21

What's new in 7.21.4 (2026-Apr-21 09:49):

  • bgp - fixed stability issue when non-existent output select-chain was specified;
  • bgp-vpn - allow modifying scopes with routing filters;
  • bgp-vpn - fixed non-working import filter after reboot;
  • bgp-vpn - use target scope for imported route;
  • bridge - fixed missing dynamic "switch-cpu" VLAN entry in WiFi setup;
  • bridge - fixed performance regression in complex setups with vlan-filtering (introduced in v7.20);
  • console - removed the "reset" command from shared settings menus (IP/IPv6/Bridge/L3HW/Neighbor-Discovery/Connection-Tracking);
  • container - fixed issue where the container might not start after upgrading if root-dir was not set;
  • container - improved error message if a container fails to start;
  • defconf - fixed L009 configuration (introduced in v7.21);
  • ethernet - fixed false excessive broadcast warning (introduced in v7.20);
  • firewall - improved system stability;
  • ipsec - improved aes256-ctr stability on L009;
  • ipsec - removed modp8192 proposal on MIPS architectures;
  • ipv6,ra - use received prefix when RA on-link flag is 0;
  • isis - improved stability with fragmented CSNP;
  • l2tp - improved system stability on TILE architecture;
  • l3hw - fixed missing VLAN counters after reboot (introduced in v7.21);
  • l3hw - fixed stability issue (introduced in v7.21);
  • leds - fixed default LED configuration for CCR2004-1G-12S+2XS;
  • log - do not provide non-existent logging topics for configuration;
  • lte - fixed framed route support for the first APN;
  • lte - fixed missing automatic redial when cellular connectivity is lost for R11e-LTE;
  • lte - fixed user set MTU not applied to LTE interface;
  • lte - override the "auto" or 0 MTU in "interface" menu to 1500;
  • ospf - fixed typos in log messages;
  • ospf - improved stability on configuration change;
  • ovpn - fixed OVPN push routes;
  • poe-out - firmware update for CRS354-48P-4S+2Q+ (the update will cause a brief power interruption to poe-out interfaces);
  • poe-out - fixed rare PoE-Out firmware upgrade failure on CRS354-48P-4S+2Q+;
  • ptp - allow manual domain configuration for 802.1AS profile;
  • ptp - set DSCP (EF) for the default profile when using IPv4;
  • qos-hw - display queue0 limits for CPU port;
  • qos-hw - fixed "offline" tx-manager ability to queue at least one packet (introduced in v7.21);
  • qos-hw - prohibit setting CPU port with "offline" tx-manager;
  • route - added SLAAC route redistribution for IPv6 capable routing protocols;
  • route - do not set blackhole flag for synthetic routes;
  • route - improved service stability when removing routes;
  • routerboard - fixed applying settings via WinBox on devices with fixed CPU frequency;
  • routing-filter - added possibility to match SLAAC and bgp-mpls-vpn route types;
  • ssh - make login process asynchronous;
  • switch - fixed stability issue when changing bridge multicast-router property on CRS1xx/2xx (introduced in v7.19);
  • system - added FCC Part 15 Compliance label to "System/Regulatory" menu;
  • system - improved stability for internal RouterOS service communication;
  • system - improved system stability;
  • system - improved upgrade service stability when the server is unreachable;
  • system - included full certificate chain to Windows executables;
  • user - properly apply login delay (introduced in v7.20);
  • wifi-mediatek - fixed communication issues on 802.11ax access points with Intel clients;
  • wifi-mediatek - fixed HE capabilities IE on 2GHz band;
  • winbox - fixed "Remote AS" setting under the "Routing/BGP/Connections" menu;
  • winbox - fixed "Src/Dst Address Type" under the "IP/Firewall/NAT" menu;
  • winbox - fixed L3HW default value for VLAN interface (introduced in v7.21);
  • winbox - properly display multiple bands for multi-link interface clients under registration table;
  • winbox - rearrange filter wizard parameters in tabs;
  • www - improved service stability when cancelling REST API sessions;
⁠7.20.8 Long-term — 2026-02-02

What's new in 7.20.8 (2026-Jan-30 11:17):

  • bgp - fixed route refresh subcode 0 warning;
  • bgp - implement revised input error handling per RFC 7606;
  • bridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.20.7);
  • container - fixed nftables/iptables not working with "Message too long" error;
  • health - fixed fan and PSU state logging for MIPSBE devices;
  • poe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces);
  • poe-out - fixed PSU state recovery upon unplug/replug on CRS320;
  • ppp - added initial support for BG770A-GL modem firmware update;
  • route - prevent creating routing tables with the same name;
  • routing-filter - fixed num-set matcher;
  • sfp - fixed sfp-ignore-rx-loss parameter for RB760iGS;
  • snmp - fixed handling of the script "dont-require-permissions" parameter when executing scripts using MIKROTIK-MIB::mtxrScriptRunOutput;
  • snmp - fixed permission error reporting when executing scripts using MIKROTIK-MIB::mtxrScriptRunOutput (introduced in v7.20.7);
  • snmp - fixed script "run-count" update after execution;
  • system - fixed rare partial loss of RouterOS configuration;
  • user-manager - properly release database backup file after backup creation;
  • w60g - fixed possible memory leak when an interface is disabled;
  • zerotier - improved route removal;
⁠7.20.7 Long-term — 2026-01-08

What's new in 7.20.7 (2026-Jan-08 11:40):

  • bgp - fixed l2vpn-cisco decoding (introduced in v7.20);
  • bgp - fixed occasional corruption of MPLS labels in BGP VPN update messages;
  • bridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.20);
  • bridge - improved system stability when forwarding traffic with fast-path and bridged interface gets removed or disabled (introduced in v7.20);
  • bth - make user private-key sensitive;
  • console - fixed empty output in route menus when using "print where gateway";
  • console - updated copyright notice;
  • firewall - clear relevant masqueraded connection tracking entries on IP address change;
  • ipv6 - initialize RA receiving when enabled and without any other IPv6 configuration;
  • log - fixed memory leak;
  • lte - fixed LTE interface IPv6 address generation to use EUI-64 (introduced in v7.20);
  • lte - fixed no re-connection after cellular network requested APN deactivation on Chateau 5G ax R17;
  • ovpn - fixed OVPN server handling on reboot (introduced in v7.20);
  • ovpn - improved system stability when using cipher=blowfish128;
  • sfp - fixed "sfp-tx-fault" state indication for CRS520-4XS-16XQ;
  • sfp - fixed missing link up/down notifies;
  • switch - fixed non-IP multicast packet receive on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches;
  • system - detect policy mismatch sooner if script is executed internally by some other service;
  • ups - fixed board hibernation shutdown;
  • wifi-mediatek - added Superchannel regulatory profile;

Tag summary

Content type

Image

Digest

sha256:950d5210b…

Size

1.1 GB

Last updated

about 1 month ago

docker pull afsharidevops/mikrotik