Skip to main content

​
Provision a MikroTik router

The provisioning wizard links a router to the current ISP account, detects the created NAS, and then applies selected service configuration. Use a router you are authorized to manage and schedule production changes appropriately.

​
Prerequisites

  • The router can reach the internet and resolve required service hostnames.
  • RouterOS and hardware are compatible with the generated script shown by this application version.
  • You can open the MikroTik terminal with sufficient privileges.
  • The router clock, DNS, firewall, and outbound HTTPS are not intentionally blocking provisioning.
  • You know which physical ports/bridge should serve Hotspot and PPPoE users.

​
Complete the wizard

1

Create the NAS record

Open Network → Devices → Routers, choose to add a router, and enter a recognizable identity such as the site and device role. Avoid generic names that become ambiguous in alerts.
2

Copy the generated command

Copy the entire provisioning command from the wizard. Do not edit embedded tokens, URLs, quoting, or arguments unless the product explicitly asks for a value.
3

Run it once in the MikroTik terminal

Paste the command, watch for RouterOS syntax/network errors, and let it finish. Do not publish the command or screenshot its secrets.
4

Wait for detection

Return to the wizard and wait for the connection-status step to detect the NAS. The wizard polls current state; leaving and returning to an already created NAS should reuse its progress rather than create another device.
5

Choose services and ports

Select PPPoE, Hotspot, or both as appropriate. Choose bridge/interface ports deliberately and enable anti-sharing only when it matches the Hotspot policy.
6

Configure and watch progress

Start service configuration and keep the progress/log view open. Configuration runs in the background. A completed NAS should report the enabled services and appear in the router inventory.
7

Verify end to end

Check status, router time, services, captive portal, RADIUS authentication/accounting, and one test subscriber. Do not rely on the wizard’s final screen alone.

​
Why the script creates a centipid_user account

The provisioning command adds a RouterOS user named centipid_user (group full, comment “Centipid User. Do not delete this user.”). Everything the platform does on the router after the initial paste goes through that account over the RouterOS API:
  • Service configuration. The wizard’s PPPoE and Hotspot setup, captive-portal file downloads, and later reprovision actions are applied through the API, not by more terminal commands.
  • Health, audits, and repair. Router health readings, the configuration audit, and its one-click fixes read and write the router through the same login.
  • Backups. Scheduled configuration backups are pulled from the router with it.
The account is safe to leave in place:
  • It has its own random password, generated per router and separate from the RADIUS secret. A leaked RADIUS secret does not grant router access, and the password is never shown or reused elsewhere.
  • The script restricts the API service to the Centipid management hub address, so the login is only reachable through the router’s management tunnel (WireGuard or SSTP), never from the internet or the LAN.
If the user is removed or disabled, service configuration, health checks, and audit fixes stop working for that router. The configuration audit reports this as a critical finding, Centipid management user exists, and offers the command to restore it. Rerunning the provisioning command also recreates the account.

​
If detection fails

  1. Inspect the router terminal output for download, certificate, DNS, permission, or syntax errors.
  2. Confirm the router was not already registered under another identity or ISP.
  3. Check outbound access and WireGuard transport state.
  4. Use the wizard’s current status/log rather than rerunning the command repeatedly.
  5. If a NAS record exists, open it and run diagnostics.
  6. Capture sanitized error text, router identity, RouterOS version, and approximate time for support.

​
If service configuration fails

Do not delete the NAS immediately. Review the configuration log and existing router services/bridges. Correct port selection or conflicting local configuration, then use the targeted setup/reprovision action indicated by the UI.

​
After provisioning

  • Set the router-specific support number and captive theme if needed.
  • Confirm walled-garden access for the selected payment gateway.
  • Add fallback RADIUS where offered and intended.
  • Enable monitoring and review alert destinations.
  • Create packages with deliberate NAS restrictions.
  • Test reconnect behavior after a controlled router reboot only during an approved window.