DOCSEARCHbyAlgolia
Submit Docs

Terraform Provider RouterOS

repository·main·Indexed 18 days ago

https://github.com/terraform-routeros/terraform-provider-routeros

Terraform Provider RouterOS enables the management of MikroTik routers via the RouterOS API or REST API, specifically designed for RouterOS version 7.x. It provides various data sources for inspecting device configurations, including interfaces, IP addresses, ARP entries, DHCP server leases, bridge filter rules, and files.

Tokens
219K
Snippets
600
Records
815
Agent score
62%

What's inside terraform-provider-routeros

  2. Configure WDS (Wireless Distribution System) settings

    main

    WDS allows wireless devices to act as bridges. Use the following arguments to control WDS behavior:

    • wds_mode (String):
      • disabled: No WDS links.
      • static: Only allows manually configured WDS entries.
      • dynamic: Automatically creates WDS entries for compatible devices.
      • -mesh: Uses mesh-specific methods for establishing links.
    • wds_default_bridge (String): Automatically adds the WDS interface to this bridge when the link becomes active.
    • wds_ignore_ssid (Boolean): If true, the remote AP's SSID is not checked (useful for certain WDS setups).
    • wds_default_cost (Number): The initial bridge port cost for WDS links.

  5. Optimize BGP input processing with the input block

    main

    The input block (max 1) allows you to configure how BGP updates are processed when received from a peer. A key feature is the ability to filter updates before they are parsed and stored in memory, which significantly reduces memory usage.

    Memory-Efficient Filtering

    Use these parameters to drop unwanted updates early in the process:

    • accept_comunities / filter_communities: Filter by BGP communities.
    • accept_ext_communities / filter_ext_communities: Filter by extended communities.
    • accept_large_comunities / filter_large_communities: Filter by large communities.
    • accept_nlri / filter_nlri: Filter by specific NLRIs (requires session restart).
    • accept_unknown / filter_unknown: Filter by unknown attributes.

    Note: Using accept_* parameters reduces memory usage by discarding updates before they reach the routing table. Using standard filter chains will still consume memory as prefixes are marked as not active, filtered in the routing table.

    Input Performance and Limits

    • affinity: Configures multi-core processing for input. Options include alone (best for many cores/peers), afi, instance, vrf, remote-as, main, or input (runs output in the same process as input).
    • limit_process_routes_ipv4 / limit_process_routes_ipv6: Limits the number of received routes to prevent memory exhaustion. If the limit is reached, a BGP session clear command is required to reset the flag.

  6. Use the routeros_ipv6_firewall data source

    main

    The routeros_ipv6_firewall data source allows you to retrieve existing IPv6 firewall configurations from a RouterOS device. It provides access to three main categories of firewall resources: rules (filter rules), mangle rules, and nat rules.

    Each category can be filtered using the optional filter argument (a Map of String) to refine the results returned by the provider.

  7. Configure wireless protocols (Nv2, Nstreme, 802.11)

    main

    The wireless_protocol argument specifies the protocol used by the interface. This is critical for performance in point-to-point or point-to-multipoint links.

    • unspecified: Uses legacy protocol modes (v3.x, v4.x).
    • any: On AP, uses regular 802.11; on station, selects an AP based on connect-list rules.
    • nstreme: Enables the Nstreme proprietary protocol.
    • nv2: Enables the Nv2 proprietary protocol (Note: Nv2 does not support Virtual AP).
    • nv2 nstreme: On AP, always uses Nv2; on station, searches for Nv2, then Nstreme.
    • nv2 nstreme 802.11: On AP, always uses Nv2; on station, searches for Nv2, then Nstreme, then regular 802.11.

  8. Use routeros_certificate_scep_server for SCEP server configuration

    main

    The routeros_certificate_scep_server resource is an alias maintained for backwards compatibility between plugin versions. When configuring a SCEP (Simple Certificate Enrollment Protocol) server, you should use the current resource name: routeros_system_certificate_scep_server.

    To ensure your configuration is up to date and follows current provider standards, migrate any existing routeros_certificate_scep_server blocks to routeros_system_certificate_scep_server.

  9. Use variables in HotSpot on_login and on_logout scripts

    main

    When defining on_login or on_logout scripts, you can use internal variables to access session data.

    Available variables:

    • $user or $username: The username of the user.
    • $address: The IP address of the user.
    • $mac-address: The MAC address of the user.
    • $interface: The interface the user is connected to.

    Additional variables (v6.34rc11+):

    • $uptime-secs: Final session time in seconds.
    • $bytes-in: Bytes uploaded.
    • $bytes-out: Bytes downloaded.
    • $bytes-total: Total bytes (up + down).
    • $packets-in: Packets uploaded.
    • $packets-out: Packets downloaded.
    • $packets-total: Total packets (up + down).
    • $cause: The reason for logout.