NuajProtect · MikroTik

NuajProtect on MikroTik RouterOS

NuajProtect turns a MikroTik router you already own into a protected edge without installing anything on it. There is no binary and no package: a script generated for your router maintains managed firewall chains and IPv4 and IPv6 address lists, filled from the same global threat-intelligence feed that drives every other NuajProtect deployment, and kept current on its own. Enforcement is RouterOS' own firewall — so the router keeps its limits, and its strengths.

In one sentence

Rules and address lists,
generated and kept current.

NuajProtect on MikroTik RouterOS at a glance
What it is NuajProtect enforcement on a router you already own, with nothing installed on the board
Form A generated RouterOS script that maintains firewall chains, address lists and scheduler entries — all named and commented as NuajProtect's
RouterOS 7.13 or later
Hardware Any board that runs RouterOS 7.13+. Capacity and matching speed are the board's own
Enforcement RouterOS firewall filter rules matching against NuajProtect address lists, IPv4 and IPv6
Placement Sentry or bridge — the router protects itself and the network behind it. Relay is not offered on RouterOS
Onboarding A script generated for that endpoint, pasted into the router's terminal once
Network Outbound HTTPS from the router to the control plane. No inbound access to the router is required
Clock Must be accurate — enable an NTP client on any board without a battery-backed clock
Managed with The same account and dashboard as your Linux agents and NuajBridge appliances
Price Free through the beta and for a full year after general availability

How it stays current

A small heartbeat often.
The heavy work only when needed.

A router is not a server, and a sync loop written as if it were is how a board ends up at 100% CPU with its queues backing up. The exchange is deliberately lopsided.

1

The heartbeat

A tiny call every thirty seconds: the router says it is alive and states which configuration version it is holding. It costs almost nothing, which is why it can be that frequent — and why a site going quiet is noticed promptly rather than at the next heavy sync.

2

The sync

When the control plane answers that something has changed — a new blocklist cursor, an edited profile, a new allowlist entry — the router pulls the delta and applies it. When nothing has changed, nothing is transferred and no table is rebuilt.

3

The detection

Detection work on the router runs on its own slower cadence, and the expensive queries are throttled against uptime rather than run every pass. A board spends its cycles forwarding packets, not counting them.

All the router needs outbound is HTTPS to the control plane. Nothing has to reach the router from outside and no port is opened for us — and none of your passwords go onto the board: what the script holds identifies that endpoint to us, and nothing else.

The most common cause of "offline"

A router with the wrong clock
cannot be online.

Many MikroTik boards have no battery-backed clock. After a power cut they come up believing it is 1970, and every connection they make is over TLS — which means validating a certificate against a date. A certificate that is perfectly valid today is not valid in 1970, so the connection fails, the heartbeat never lands, and the dashboard shows the site as offline while the router is in fact routing traffic perfectly.

The fix is one setting, and it is worth doing before you enrol anything: enable the NTP client and set the time zone. A board that keeps its time keeps its connection across reboots, and the same setting makes the router's own logs worth reading.

# RouterOS 7 — set the clock before enrolling the router
/system/ntp/client/set enabled=yes servers=pool.ntp.org
/system/clock/set time-zone-autodetect=yes

If a site ever reports offline while its traffic is clearly still flowing, check the clock first. It is the answer far more often than the network is.

Small boards

Written for the hardware
it actually runs on.

Everything on this platform is shaped by one constraint: a router's CPU belongs to forwarding. Three decisions follow from it, and each of them came from watching a real board suffer the alternative.

  • No logging on the drop rules. Logging every drop is the fastest way to pin a small board at 100%: the log write costs more than the drop itself. NuajProtect's rules carry no log=yes, and the counts come from the rule counters RouterOS already keeps.
  • Counted, not enumerated. Asking a router to walk an address list to find out how big it is costs more than the answer is worth once the list is large. The script asks for counts, not contents.
  • Throttled against uptime. Script variables do not survive a reboot on RouterOS, so a counter-based throttle silently never fires. The heavy passes are gated on the router's own uptime clock instead — something the board cannot forget.

The result is that the same protection runs on a small branch-office board and on a border router, and the small board stays a router.

Scope

What RouterOS does,
and what it doesn't.

A capability that only half works on a platform is worse than one that is honestly missing, so the boundaries are stated rather than discovered.

Supported

Global threat-intelligence blocking, IPv4 and IPv6 address lists, allowlists, geographic controls, profile-driven policy, and connection-tracking exemptions for the VPN and UDP ports you nominate — so a WireGuard or IPsec endpoint on the router is not tracked or mistaken for a flood.

Not supported

Relay placement and port forwarding to protected services elsewhere. Line-rate in-kernel filtering of the kind XDP does — enforcement here is RouterOS' firewall, and it inherits that board's performance. For either of those, use the Linux agent or a NuajBridge appliance.

Questions

Before you enrol a router.

What does NuajProtect install on a MikroTik router?
No binary and no package. A script generated for your router creates managed firewall chains, IPv4 and IPv6 address lists and its own scheduler entries, all named and commented so you can see exactly what belongs to NuajProtect. Enforcement is RouterOS' own firewall, which is why nothing has to be trusted to run on the board beyond RouterOS itself.
Which RouterOS version does NuajProtect need?
RouterOS 7.13 or later, on any board that runs it — a hEX at a branch office and a CCR at a border both work. The board's own capacity is the limit that matters: enforcement is RouterOS' firewall, so how many addresses it can hold and how fast it matches them is a property of that hardware, not of NuajProtect.
My MikroTik keeps showing as offline. What is wrong?
Check the router's clock before anything else. Boards without a battery-backed clock come up in 1970 after a power cut, and a certificate cannot be validated against a date that far wrong — so the router's connection to the control plane fails and it reports as offline while it is in fact routing perfectly. Enable an NTP client and set the time zone; that fixes it, and it is by far the most common cause.
Will NuajProtect raise CPU on a small MikroTik board?
The rules are written for the hardware they run on. Blocking is a handful of rules matching a source address list, with your allowlist accepted ahead of them, rather than a long chain for the board to walk — and the rules deliberately do not log, because logging every drop is the single fastest way to peg a small board's CPU and we learned that on ours. Sync work is throttled the same way: a small heartbeat runs often, and the heavy table work only runs when something has actually changed.
Will it break my VPN or my UDP services?
Ports you nominate are exempted from connection tracking in the raw prerouting chain, in both IPv4 and IPv6, so VPN endpoints and high-rate UDP services pass without being tracked or judged as a flood. That is a setting, not a discovery — you tell it which ports carry that traffic.
Can a MikroTik router act as a NuajProtect relay for other machines?
No. On RouterOS, NuajProtect protects the router and the network it fronts; forwarding cleaned traffic to services elsewhere is the Linux agent's relay mode or a NuajBridge appliance. The capability table says not supported rather than pretending a router will do it, because the difference shows up in production and not at setup.

Get started

Start with the router
you already own.

The service is free through the beta and for a full year after general availability. Add Linux servers and NuajBridge appliances to the same account when you want the full-speed engine.

Join the beta All of NuajProtect