NuajProtect · MikroTik

NuajProtect on MikroTik.

One generated script, pasted into the router’s terminal, turns the MikroTik you already own into a protected edge, with address lists that follow the global threat feed automatically.

At a glance

One script, pasted once.
Lists that follow the server.

NuajProtect on MikroTik RouterOS at a glance
What it is NuajProtect enforcement on a router you already own, installed by pasting one generated script
Form A generated RouterOS script that maintains firewall chains, address lists and scheduler entries — all named and commented as NuajProtect’s
RouterOS 7.13 or later
Hardware Any board that runs RouterOS 7.13+. Capacity and matching speed are the board’s own
Enforcement RouterOS firewall filter rules matching against NuajProtect address lists, IPv4 and IPv6
Placement Sentry or bridge — the router protects itself and the network behind it. Relay is not offered on RouterOS
Onboarding A script generated for that endpoint, pasted into the router’s terminal once
Updates Address lists follow the server automatically. The script changes only when you update it from the dashboard
Network Outbound HTTPS from the router to the control plane. No inbound access to the router is required
Clock Must be accurate — enable an NTP client on any board without a battery-backed clock
Managed with The same account and dashboard as your Linux agents and NuajBridge appliances
Price Free through the beta

How it stays current

A light heartbeat, often.
Heavy work only on change.

A router is not a server. The sync is built so the board’s CPU stays on forwarding.

1

The heartbeat

A tiny call every thirty seconds: the router reports that it is alive and which configuration version it holds. It costs almost nothing, so a site going quiet is noticed promptly.

2

The sync

When the control plane reports a change — new blocklist entries, an edited profile, a new allowlist entry — the router pulls only the difference and applies it. When nothing has changed, nothing is transferred and no table is rebuilt.

3

The detection

Detection runs on its own slower cadence, and the expensive queries are throttled against uptime. The board spends its cycles forwarding packets, not counting them.

All the router needs is outbound HTTPS to the control plane. Nothing reaches in, no port is opened for us, and none of your passwords go onto the board — the script holds only what identifies that endpoint to us.

The most common cause of “offline”

A router with the wrong clock
cannot be online.

Many MikroTik boards have no battery-backed clock. After a power cut they come up believing it is 1970, and every connection they make is over TLS, which validates a certificate against the date. The connection fails, the heartbeat never lands, and the dashboard shows the site offline while the router keeps routing traffic.

The fix is one setting, best made before you enrol: enable the NTP client and set the time zone. The board then keeps its connection across reboots, and its own logs carry the right time.

# RouterOS 7 — set the clock before enrolling the router
/system/ntp/client/set enabled=yes servers=pool.ntp.org
/system/clock/set time-zone-autodetect=yes

If a site reports offline while its traffic is clearly flowing, check the clock first. It is the answer far more often than the network is.

Small boards

Built for small boards.
The same on border routers.

A router’s CPU belongs to forwarding. Three decisions follow, each learned by watching a real board suffer the alternative.

  • No logging on the drop rules. The log write costs more than the drop, so logging every drop is the fastest way to pin a small board. NuajProtect’s rules carry no log=yes; the counts come from the rule counters RouterOS already keeps.
  • Counted, not enumerated. Walking a large address list to learn its size costs more than the answer is worth. The script asks for counts, not contents.
  • Throttled against uptime. Script variables do not survive a reboot on RouterOS, so a counter-based throttle would never fire. The heavy passes are gated on the router’s uptime clock instead, which the board cannot forget.

The same protection runs on a branch-office board and a border router, and the small board stays a router.

Scope

What RouterOS does,
and what it doesn’t.

The boundaries, stated up front, so you never find them in production.

Supported

Global threat-intelligence blocking, IPv4 and IPv6 address lists, allowlists, geographic controls, profile-driven policy, and VPN and UDP passthrough for the ports you nominate — so a WireGuard or IPsec endpoint on the router is not tracked or mistaken for a flood.

Not supported

Relay placement and port forwarding to protected services elsewhere. Line-rate filtering of the kind the appliance does — enforcement here is RouterOS’ firewall, at that board’s speed. For either, use the Linux agent or a NuajBridge appliance (coming soon).

Questions

Before you enrol a router.

What does NuajProtect install on a MikroTik router?
One script, generated for your router and pasted into its terminal. It adds no binary and no package: it creates managed firewall chains, IPv4 and IPv6 address lists and its own scheduler entries, all named and commented as NuajProtect’s. Enforcement is RouterOS’ own firewall, so nothing runs on the board beyond RouterOS itself.
Which RouterOS version does NuajProtect need?
RouterOS 7.13 or later, on any board that runs it — a hEX at a branch office and a CCR at a border both work. The board’s own capacity is the limit that matters: enforcement is RouterOS’ firewall, so how many addresses it can hold and how fast it matches them is a property of that hardware, not of NuajProtect.
My MikroTik keeps showing as offline. What is wrong?
Check the router’s clock first. Boards without a battery-backed clock come up in 1970 after a power cut, and a certificate cannot be validated against a date that far wrong — so the connection to the control plane fails and the router shows offline while it keeps routing. Enable an NTP client and set the time zone. It is by far the most common cause.
Will NuajProtect raise CPU on a small MikroTik board?
The rules are written for the hardware they run on. Blocking is a handful of rules matching a source address list, with your allowlist accepted ahead of them, rather than a long chain for the board to walk — and the rules deliberately do not log, because logging every drop is the single fastest way to peg a small board’s CPU and we learned that on ours. Sync work is throttled the same way: a small heartbeat runs often, and the heavy table work only runs when something has actually changed.
Will it break my VPN or my UDP services?
Ports you nominate, in both IPv4 and IPv6, pass straight through without being tracked or judged as a flood, so VPN endpoints and high-rate UDP services keep working. That is a setting, not a discovery — you tell it which ports carry that traffic.
Can a MikroTik router act as a NuajProtect relay for other machines?
No. On RouterOS, NuajProtect protects the router and the network behind it. To forward cleaned traffic to services elsewhere, use the Linux agent’s relay mode or a NuajBridge appliance.
How do I block malicious IPs on a MikroTik router?
Paste one generated script into the router’s terminal. It creates firewall rules and IPv4 and IPv6 address lists that NuajProtect keeps filled from live threat feeds, so known-hostile sources are dropped in the router’s own firewall before they reach anything behind it. RouterOS 7.13 or later.

Get started

Start with the router
you already own.

Free during the beta. Your Linux servers join the same account, and NuajBridge appliances will too.

Join the beta