RouterOS Netinstall Recovery Guide: Unbrick a MikroTik

In short: put the PC on a static IP (192.168.88.2/24) with every other NIC disabled, cable it straight to ether1 or the BOOT port, run Netinstall as administrator or root, then hold the reset button through power-on until the router appears (about 15 seconds, LED off). Select the .npk for its architecture and click Install.

That reformats the flash: MikroTik’s Netinstall documentation warns “all configuration and user files will be lost,” though license keys and RouterBOOT settings survive. The install itself is the easy part; getting the router to appear in Netinstall at all is where the PC-side setup matters.

When do you need Netinstall instead of a reset?

Use Netinstall when RouterOS itself is broken: the board boot-loops, an upgrade died mid-write, a package is corrupt, or you want a clean install of a specific version. A forgotten password or a bad firewall rule only needs a reset-button configuration reset, which leaves RouterOS installed and takes about five seconds.

The timings come from MikroTik’s configuration reset page. For the last row, see our RouterOS v6 to v7 upgrade guide. If bridge VLAN filtering caused the lockout, read VLAN filtering without locking yourself out before rebuilding.

What to download first

• Netinstall. The RouterOS download page ships netinstall64-<version>.zip (64-bit Windows), netinstall-<version>.zip (32-bit Windows) and netinstall-<version>.tar.gz (Linux netinstall-cli). MikroTik’s Problems with Netinstall page says to use the latest stable or testing build.
• The main RouterOS package for the CPU: arm64, arm, mipsbe, mmips, ppc, smips, tile or x86. /system resource print shows architecture-name if the box still boots; otherwise the Netinstall docs say to download every architecture and let Netinstall pick.
• Extra packages you run (wifi-qcom, wireless, container), same version as the main package.
• A wired NIC on the PC. Not Wi-Fi, and preferably not a USB dongle.

If the router still boots, pull a text export and an encrypted backup off it before you wipe anything. Configuration Management notes that an export omits system user passwords, installed certificates, SSH keys, and the Dude and User Manager databases, so copy those separately.

Step 1: Prepare the PC

On Windows, disable every adapter except the one cabled to the router, give it 192.168.88.2 with mask 255.255.255.0 and no gateway, and launch netinstall.exe as administrator. MikroTik’s checklist says to disable firewall and antivirus software on the PC. If you do, switch both back on as soon as the router reboots into its new install, before that laptop touches another network.

On Linux, netinstall-cli runs as root:

wget https://download.mikrotik.com/routeros/<version>/netinstall-<version>.tar.gz
tar -xzf netinstall-<version>.tar.gz
sudo ip addr add 192.168.88.2/24 dev enp3s0
sudo ip link set enp3s0 up

Rather than drop the host firewall entirely, open the three UDP ports involved. Warren Young’s NetInstall notes give the firewalld version: BOOTP on UDP 67, TFTP on UDP 69, and UDP 5000.

sudo firewall-cmd --permanent --add-port bootps/udp
sudo firewall-cmd --permanent --add-port tftp/udp
sudo firewall-cmd --permanent --add-port 5000/udp
sudo firewall-cmd --reload

Remove them with --remove-port when you are done. A workstation has no business answering BOOTP on a café network.

Cable directly to ether1 or the port marked BOOT. USB Ethernet adapters can “link flap” as the router enters Etherboot; MikroTik’s fix is a switch between PC and router. If that switch does DHCP snooping, mark the ports trusted: Young’s verdict is that snooping “will (not might, will) break NetInstall.”

Step 2: Put the router into Etherboot mode

There are three documented ways in.

1. Reset button. Power off, hold reset, apply power, keep holding. The LED flashes at about 5 s (configuration reset), goes solid at about 10 s (CAPs mode), and turns off at about 15 s (Netinstall). MikroTik’s simpler rule: keep holding until the device shows up in Netinstall. Release at 10 s by accident and the box goes looking for a CAPsMAN controller instead.
2. Serial console. MikroTik’s Serial Console page gives the default as 115200 bit/s, 8 data bits, 1 stop bit, no parity, with hardware (RTS/CTS) flow control; x86 defaults to 9600 bit/s. Press Ctrl+E during boot, per the RouterBOOT manual.
3. From RouterOS, if you can still log in: /system routerboard settings set boot-device=try-ethernet-once-then-nand, then /system reboot. The board tries Ethernet once and falls back to NAND, so a missed window costs you nothing.

Holding reset before power also loads the backup RouterBOOT, which is harmless here. If the device never appears, the knowledge base’s alternative is pressing reset one to two seconds after power-on.

Step 3a: Install from the Windows GUI

1. Open Net booting, tick Boot Server enabled, and set Client IP address to an unused address in the same /24, such as 192.168.88.3. MikroTik insists it must not be the PC’s address or any address already in use.
2. Trigger Etherboot. Select the router when it appears.
3. Browse to the folder holding the .npk files and tick the packages.
4. Choose Apply default config, Keep old configuration, or a Configure script.
5. Click Install, then Reboot. The docs note that devices without a serial console have to be rebooted manually.

Step 3b: Install from Linux with netinstall-cli

sudo ./netinstall-cli -e -i enp3s0 -a 192.168.88.3 routeros-<version>-arm64.npk wifi-qcom-<version>-arm64.npk

The system package must be listed first. The flags that matter:

Which configuration option should you pick?

For a recovery, pick empty (-e) or default (-r). Keep old configuration only when you are certain the config is not what broke the router, because it restores the same configuration database, bad rules included. MikroTik also notes it does not carry files such as the User Manager or Dude databases, or containers.

With the default config, the docs warn that “some devices are not accessible through ether1 port with the default configuration for security reasons”; on a typical SOHO default ether1 is the WAN, so use ether2. An empty config has no IP address at all, so you connect over MAC with WinBox; our WinBox vs WebFig comparison explains the difference.

A Configure script (-s) replaces the factory default and, per MikroTik, “will be kept during RouterOS updates”, which makes it the right choice for a fleet of identical CAPs. Add a delay at the top of the script so interfaces are up before it runs.

Netinstall does not see the router: what to check?

Check the link first, then the PC firewall, then the port, then the package architecture. MikroTik’s troubleshooting page and field notes from netinstall-cli users point at these long before a hardware fault, so rule them out in this order:

1. Link drops during reboot. Usually a USB NIC; add a dumb switch.
2. Firewall or antivirus blocking UDP 67, 69 or 5000.
3. Wrong port. Only ether1 or BOOT, never an SFP cage.
4. Live LAN in the path. Use an isolated cable, not your production switch.
5. Wrong architecture package for the board.
6. Old Netinstall build. Update to the latest stable or testing.
7. Bad cable. MikroTik lists swapping it as a real step.
8. Prove the PC. The knowledge base suggests Netinstalling a different router to confirm the setup works.

What if protected RouterBOOT is enabled?

The reset button can no longer change the boot mode, so Netinstall is disabled until you trigger a full reformat. The RouterBOARD documentation describes protected-routerboot as disabling console access to RouterBOOT and the reset button’s boot-mode function: “Netinstall will be disabled.”

The escape hatch is to hold reset at power-on for longer than reformat-hold-button (5 to 300 s, default 20 s) but shorter than reformat-hold-button-max (15 to 600 s, default 10 minutes). The board then erases RouterOS and every file by NAND reformat, resets RouterBOOT settings, reboots, and “as boot from NAND fails, it goes to etherboot automatically.” Run Netinstall from there. If you enable protected RouterBOOT, record the hold window; without it you are guessing.

After the reinstall

Bring RouterBOOT level with the new RouterOS: /system routerboard upgrade, /system reboot, then confirm current-firmware matches upgrade-firmware in /system routerboard print.

If you have the pre-failure .rsc, import it with verbose=yes and the dry-run option first; MikroTik says dry-run “simulates the import without making any configuration changes” and works only in verbose mode. Recreate users and passwords by hand, since the export never held them. Then run our first-hour hardening checklist before the WAN cable goes back in, and test from a LAN client:

ping -c 4 192.168.88.1
dig @192.168.88.1 mikrotik.com
mtr -n -c 20 1.1.1.1

FAQ

Does Netinstall delete the license key?

No. Netinstall reformats the system drive and erases configuration and user files, but MikroTik documents that it preserves existing RouterOS license keys and RouterBOOT settings. If you need to apply a different key, Netinstall can install one during the reinstall; with netinstall-cli you pass the .key file with the -k flag.

Can Netinstall fix a MikroTik with a forgotten password?

Yes, but it is overkill. With an empty or default configuration selected, Netinstall wipes users along with everything else, so the old password is gone. A reset-button configuration reset does that in about five seconds without reinstalling. Netinstall becomes necessary when protected RouterBOOT has disabled the button and you have to reformat.

Which port do I plug into for MikroTik Netinstall?

Use ether1 or the port labelled BOOT. MikroTik’s Netinstall documentation says devices netboot from the first Ethernet port or the BOOT-marked port, so SFP cages and other copper ports will not answer. Cable it directly to the PC, or through an unmanaged switch with no DHCP snooping in the path.

Why is Netinstall stuck on sendFile?

Usually it is the wrong architecture package or a blocked UDP 5000. Warren Young’s netinstall-cli notes tie a stall at the sendFile step to packages built for the wrong CPU, such as 64-bit packages sent to a 32-bit ARM board, and to host firewalls blocking UDP 5000. Re-download the matching .npk and open the port.

Related across the network

• UniFi Adoption Failed: How to Fix Stuck Devices — ubiquitiguide.com
• How to Adopt UniFi AP Manually: SSH, Option 43 or DNS — unifiguide.com