MikroTik Scripting for ISP Automation: Practical Examples

RouterOS scripting is the difference between an ISP that manually provisions every subscriber and one that provisions hundreds without touching the router. The scripting language built into RouterOS is capable enough for most ISP automation tasks: subscriber account management, address list updates, bandwidth policy changes, scheduled backups, and alert-driven responses to network events.

This article covers practical scripting examples for common ISP automation tasks, written for RouterOS v7.

The RouterOS Scripting Language

RouterOS scripts run in the /system/scripts environment and can be triggered manually, on a schedule, by an event (such as an interface going down), or by the DHCP server or RADIUS accounting events. The language supports variables, conditional logic, loops, and functions, and can execute any command available in the RouterOS CLI.

Scripts can also be executed remotely via the RouterOS API, which is how billing systems and external provisioning tools interact with RouterOS programmatically. Understanding the scripting language makes API integration more intuitive since the API executes the same commands.

Subscriber Provisioning Script

The most impactful automation for most ISPs is subscriber provisioning: creating the queue entry, the DHCP lease or static IP assignment, the firewall address list membership, and the RADIUS account in a single operation rather than across multiple manual steps.

A basic subscriber provisioning script that creates a queue entry and adds the subscriber to an address list:

:local subscriberIP "100.64.1.50"
:local subscriberName "sub-00145"
:local downloadRate "10M"
:local uploadRate "5M"
:local tierList "subscribers-10mbps"

# Add to address list for QoS marking
/ip firewall address-list add list=$tierList address=$subscriberIP \
    comment=$subscriberName

# Create queue entry
/queue simple add name=$subscriberName target=$subscriberIP \
    max-limit=($uploadRate . "/" . $downloadRate) \
    comment=("Subscriber " . $subscriberName)

:log info ("Provisioned subscriber: " . $subscriberName . " at " . $subscriberIP)

This script is the foundation for integration with a billing system: the billing system generates the provisioning parameters and either calls the script via the RouterOS API or triggers it through a RADIUS attribute.

Address List Management from External Source

Address lists used for QoS, firewall, or routing policy need to stay synchronized with your subscriber management system. A script that reads a simple text file from a web server and populates an address list:

:local tierName "subscribers-20mbps"
:local sourceURL "http://your-provisioning-server/address-lists/20mbps.txt"

# Clear existing list
/ip firewall address-list remove [find list=$tierName]

# Fetch updated list and populate
:local content [/tool fetch url=$sourceURL as-value output=user]
:local lines [:toarray ($content->"data")]
:foreach line in=$lines do={
    :if ([:len $line] > 0) do={
        /ip firewall address-list add list=$tierName address=$line
    }
}

:log info ("Updated address list: " . $tierName . " with " . \
    [:len $lines] . " entries")

Schedule this script to run every 5-10 minutes to keep the address list current with subscriber plan changes processed by your billing system.

Scheduled Backup and Configuration Export

Losing a router's configuration without a recent backup is a recovery nightmare. A scheduled script that exports the configuration and copies it to a remote server:

:local hostname [/system identity get name]
:local datestamp [/system clock get date]
:local filename ($hostname . "-" . $datestamp . ".rsc")

# Export full configuration
/export file=$filename

# Copy to backup server via FTP or SMB
/tool fetch upload=yes address=<backup-server-ip> \
    src-path=($filename . ".rsc") \
    dst-path=("/backups/" . $hostname . "/" . $filename . ".rsc") \
    user=<backup-user> password=<backup-password> \
    mode=ftp

:log info ("Configuration backup completed: " . $filename)

Schedule this with /system scheduler to run nightly. Combined with the backup server retaining 30 days of configurations, this gives you point-in-time recovery for any configuration state within the past month.

Interface Down Alert Script

RouterOS event-driven scripting can trigger a script when an interface status changes. Create an alert script and bind it to an interface event:

:local alertEmail "noc@yourcompany.com"
:local interfaceName "ether1-uplink"

/tool e-mail send to=$alertEmail \
    subject=("ALERT: " . $interfaceName . " is DOWN on " . \
        [/system identity get name]) \
    body=("Interface " . $interfaceName . " went down at " . \
        [/system clock get time] . " on " . [/system clock get date])

:log warning ("Alert sent: " . $interfaceName . " DOWN")

Bind this script to the interface in /interface:

/interface set <interface-name> running-script=<script-name>

For more sophisticated alerting that integrates with your NOC tooling rather than just sending email, NOC Intelligence sits above the script layer and provides AI-assisted triage of alerts from your MikroTik estate. For operators who want full automation workflows designed and implemented across RouterOS, RADIUS, and billing system integration, Automation & Integrations covers the end-to-end automation architecture. For documenting your automation scripts as operational runbooks that your team can reference and maintain, RunBook AI generates structured documentation from descriptions of what each script does and when it runs.