¶ MikroTik API
- Overview
- API
- Live bandwidth usage
- Accounting
- Router accounting options
- Simple shaping
- PCQ shaping
- PPP secrets
- IP firewall filter and DHCP
- Force API configuration
¶ Overview
The MikroTik API settings control how Splynx connects to MikroTik routers and what it does over that connection — traffic accounting, shaping, PPP secrets, firewall and DHCP entries. The values you set here apply to every MikroTik router added in Splynx.
To configure MikroTik API navigate to Config → Networking → MikroTik API.
The bytes per KB (1000 / 1024) setting moved to Config → Main → Localization (Networking settings), where it now applies system-wide.
¶ API
General connection settings for the API session between Splynx and the router. They define how persistently Splynx retries a failed connection and how long it waits for a response.
-
Debug - enables/disables API debug log (under /var/www/splynx/logs/cron/mikrotik.log). Recommended only for testing/debug purposes. The Mikrotik API debug mode will automatically turn off in 60 minutes;
-
Attempts - select connection attempts (1-10);
-
Timeout - select timeout in seconds.
¶ Live bandwidth usage
Settings for the real-time traffic chart Splynx draws for a customer's service. They define how many times Splynx polls the router for live data and which source the PPPoE speed is read from.
- Attempts - the number of times Splynx tries to read live bandwidth usage from a router before giving up. The counter resets after 5 minutes with no attempts. Select Never to stop reading live bandwidth usage from the router altogether;
- Live bandwidth for PPPoE customers - the source the Live bandwidth usage chart reads the PPPoE speed from:
- Automatically (queue in priority) - default. Splynx takes the speed from the customer's simple queue and falls back to the PPPoE interface when the router has no queue for that customer;
- From the interface - the chart is always built from the PPPoE interface data, even when a simple queue exists for the customer on the router;
- From the queue - the chart is always built from the simple queue data, with no fallback to the interface. If no queue is found for the customer, the chart shows no data.
Live bandwidth for PPPoE customers affects PPPoE customers only. For DHCP and IPoE customers the Live bandwidth usage chart is not affected.
For details on how the chart works and what it requires, see MikroTik Live bandwidth.
¶ Accounting
Settings for collecting traffic statistics from routers. They define when a session is counted, when it is closed or split, and whether the data is written to RRD files for graphs.
-
Write log file for accounting - enables/disables accounting log (under /var/www/splynx/logs/cron/accounting.log). Recommended only for testing/debug purposes (the mode will automatically turn off in 60 minutes);
-
Min bytes for accounting - gather stats if "in + out" traffic is larger than (bytes);
-
Max timeout - stops the accounting session after this time if no traffic is recorded during the specified period of time (in seconds);
-
Max session time - divides large sessions into smaller sessions every (hours);
-
RRD enable - enables/disables writing to RRD files (for graphs);
-
RRD cached enable - enables/disables RRD cache (speeds up RRD writing).
¶ Router accounting options
Accounting parameters that are applied on the router itself. They define whether traffic to and from the router is counted and how large the router's accounting table may grow.
-
Account local traffic - enables/disables accounting of the traffic to/from the router itself;
-
Threshold - maximum number of IP pairs in the accounting table (allowed value is 1024-256000).
¶ Simple shaping
Settings for speed limits built with simple queues. They define which queue types Splynx assigns for download and upload, and let you swap the two directions.
- Reverse in/out - enable this if you want to change upload by download and vice versa;
- Queue type for download - set the queue download type;
- Queue type for upload - set the queue upload type.
¶ PCQ shaping
Settings for speed limits built with PCQ queues and mangle rules. They define the chains and routing types Splynx uses when it creates the rules on the router.
- Shaping in - chain where the rules are created;
- Shaping out - chain where the rules are created;
- Routing in - set the type of routing in;
- Routing out - set the type of routing out;
- For radius - if yes, rules will be created for all plans (but without address-list, and without aggregation in plans);
- Connection mark - enables a connection mark.
¶ PPP secrets
Settings for the PPP secrets Splynx creates on the router for PPP customers.
- Add caller ID - enables/disables adding the MAC address to the restriction (PPP) via API;
¶ IP firewall filter and DHCP
Settings for the firewall and DHCP entries Splynx uploads to the router. They define the blocking rules used for restricted customers, where the rules are placed, and which resources stay reachable while a customer is blocked.
-
Add framed route - enables/disables adding routes to the service's additional network field if IP-MAC filter or DHCP is enabled;
-
Include inactive customers - enable this toggle to include inactive customers when adding 'Disabled customers to address list';
-
Blocking rules - select blocking rules that will be uploaded to a router: Filter rules or DNS blocking rules.
Only IP/IPv6 firewall blocking rules without comments are allowed; firewall address list entries are not supported in this field.
- Filter rules - List of firewall filter rules that will be uploaded to the MikroTik router.
Use{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}}for allowed resources' address list name and{{SPLYNX_IP_ADDRESS}}for the Splynx IP address:
/ip firewall filter add chain=forward action=jump jump-target=splynx-blocked dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} src-address-list=SpLBL_blocked
/ip firewall filter add chain=forward action=jump jump-target=splynx-blocked dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} src-address-list=SpLBL_new
/ip firewall filter add chain=forward action=jump jump-target=splynx-blocked dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} src-address-list=SpLBL_disabled
/ip firewall filter add chain=forward action=jump jump-target=splynx-blocked dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} src-address-list=Reject_0
/ip firewall filter add chain=forward action=jump jump-target=splynx-blocked dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} src-address-list=Reject_1
/ip firewall filter add chain=forward action=jump jump-target=splynx-blocked dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} src-address-list=Reject_2
/ip firewall filter add chain=forward action=jump jump-target=splynx-blocked dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} src-address-list=Reject_3
/ip firewall filter add chain=forward action=jump jump-target=splynx-blocked dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} src-address-list=Reject_4
/ip firewall filter add chain=splynx-blocked action=accept protocol=udp dst-port=53 dst-limit=2,0,src-address/1m40s
/ip firewall filter add chain=splynx-blocked action=accept protocol=tcp dst-port=80,443,8101,8102,8103,8104 dst-address={{SPLYNX_IP_ADDRESS}}
/ip firewall filter add chain=splynx-blocked action=reject reject-with=icmp-admin-prohibited dst-limit=10,0,src-address/1m40s
/ip firewall filter add chain=splynx-blocked action=drop
- DNS blocking rules - List of firewall filter and NAT rules that will be uploaded to a router. Use
{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}}for allowed resources Address list name and{{SPLYNX_IP_ADDRESS}}for Splynx IP address:
NAT rules are required for DNS blocking.
/ip firewall filter add chain=forward action=reject reject-with=icmp-admin-prohibited src-address=10.250.64.0/20 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}}
/ip firewall filter add chain=forward action=reject reject-with=icmp-admin-prohibited src-address=10.250.96.0/20 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}}
/ip firewall filter add chain=forward action=reject reject-with=icmp-admin-prohibited src-address=10.250.128.0/20 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}}
/ip firewall filter add chain=forward action=reject reject-with=icmp-admin-prohibited src-address=10.250.160.0/20 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}}
/ip firewall filter add chain=forward action=reject reject-with=icmp-admin-prohibited src-address=10.250.192.0/20 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}}
/ip firewall filter add chain=forward action=reject reject-with=icmp-admin-prohibited src-address-list=Reject_0 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}}
/ip firewall filter add chain=forward action=reject reject-with=icmp-admin-prohibited src-address-list=Reject_1 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}}
/ip firewall filter add chain=forward action=reject reject-with=icmp-admin-prohibited src-address-list=Reject_2 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}}
/ip firewall filter add chain=forward action=reject reject-with=icmp-admin-prohibited src-address-list=Reject_3 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}}
/ip firewall filter add chain=forward action=reject reject-with=icmp-admin-prohibited src-address-list=Reject_4 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}}
/ip firewall filter add chain=forward action=reject reject-with=icmp-admin-prohibited src-address-list=SpLBL_blocked dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}}
/ip firewall filter add chain=forward action=reject reject-with=icmp-admin-prohibited src-address-list=SpLBL_disabled dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}}
/ip firewall filter add chain=forward action=reject reject-with=icmp-admin-prohibited src-address-list=SpLBL_new dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}}
/ip firewall nat add action=dst-nat chain=dstnat to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=443 protocol=tcp src-address-list=Reject_0 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} dst-port=80
/ip firewall nat add action=dst-nat chain=dstnat to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=443 protocol=tcp src-address-list=Reject_0 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} dst-port=443
/ip firewall nat add action=dst-nat chain=dstnat to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=443 protocol=tcp src-address-list=Reject_1 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} dst-port=80
/ip firewall nat add action=dst-nat chain=dstnat to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=443 protocol=tcp src-address-list=Reject_1 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} dst-port=443
/ip firewall nat add action=dst-nat chain=dstnat to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=443 protocol=tcp src-address-list=Reject_2 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} dst-port=80
/ip firewall nat add action=dst-nat chain=dstnat to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=443 protocol=tcp src-address-list=Reject_2 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} dst-port=443
/ip firewall nat add action=dst-nat chain=dstnat to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=443 protocol=tcp src-address-list=Reject_3 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} dst-port=80
/ip firewall nat add action=dst-nat chain=dstnat to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=443 protocol=tcp src-address-list=Reject_3 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} dst-port=443
/ip firewall nat add action=dst-nat chain=dstnat to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=443 protocol=tcp src-address-list=Reject_4 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} dst-port=80
/ip firewall nat add action=dst-nat chain=dstnat to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=443 protocol=tcp src-address-list=Reject_4 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} dst-port=443
/ip firewall nat add action=dst-nat chain=dstnat to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=443 protocol=tcp src-address-list=SpLBL_blocked dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} dst-port=80
/ip firewall nat add action=dst-nat chain=dstnat to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=443 protocol=tcp src-address-list=SpLBL_blocked dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} dst-port=443
/ip firewall nat add action=dst-nat chain=dstnat to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=443 protocol=tcp src-address-list=SpLBL_disabled dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} dst-port=80
/ip firewall nat add action=dst-nat chain=dstnat to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=443 protocol=tcp src-address-list=SpLBL_disabled dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} dst-port=443
/ip firewall nat add action=dst-nat chain=dstnat to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=443 protocol=tcp src-address-list=SpLBL_new dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} dst-port=80
/ip firewall nat add action=dst-nat chain=dstnat to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=443 protocol=tcp src-address-list=SpLBL_new dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} dst-port=443
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=tcp src-address=10.250.64.0/20 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}}
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=udp src-address=10.250.64.0/20 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}}
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=tcp src-address=10.250.96.0/20 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}}
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=udp src-address=10.250.96.0/20 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}}
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=tcp src-address=10.250.128.0/20 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}}
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=udp src-address=10.250.128.0/20 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}}
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=tcp src-address=10.250.160.0/20 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}}
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=udp src-address=10.250.160.0/20 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}}
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=tcp src-address=10.250.192.0/20 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}}
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=udp src-address=10.250.192.0/20 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}}
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=tcp src-address-list=Reject_0 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=53
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=udp src-address-list=Reject_0 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=53
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=tcp src-address-list=Reject_1 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=53
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=udp src-address-list=Reject_1 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=53
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=tcp src-address-list=Reject_2 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=53
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=udp src-address-list=Reject_2 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=53
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=tcp src-address-list=Reject_3 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=53
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=udp src-address-list=Reject_3 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=53
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=tcp src-address-list=Reject_4 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=53
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=udp src-address-list=Reject_4 dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=53
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=tcp src-address-list=SpLBL_blocked dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=53
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=udp src-address-list=SpLBL_blocked dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=53
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=tcp src-address-list=SpLBL_disabled dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=53
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=udp src-address-list=SpLBL_disabled dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=53
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=tcp src-address-list=SpLBL_new dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=53
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 protocol=udp src-address-list=SpLBL_new dst-address-list=!{{SPLYNX_ALLOWED_RESOURCES_ADDRESS_LIST}} to-addresses={{SPLYNX_IP_ADDRESS}} to-ports=53
-
Filter rules position - select the position for firewall filter rules. Available options are: keeps current, top, bottom;
-
Splynx IP/Hostname - set Splynx IP/Hostname if customers should be able to reach the Splynx customer portal & blocking pages;
-
Allowed resources address list name - name for the address list for allowed resources;
-
Allowed resources addresses - allowed resources addresses (IP or Hostname).
¶ Force API configuration
Applies the current MikroTik API settings to all routers at once, without waiting for the next scheduled update.
Click on Mass update all routers if you want to apply new Mikrotik API configurations.