Installing a Mikrotik CHR virtual router

In Yandex Cloud, you can deploy a virtual Mikrotik Cloud Hosted Router on a ready-made VM image. To install the Mikrotik Cloud Hosted Router and check how it runs:

1. Get your cloud ready.
2. Create a security group.
3. Create a VM with the Mikrotik Cloud Hosted Router.
4. Log in to your VM and change your password.
5. Create a test VM.
6. Check the connection between the router and test VM.

If you no longer need the resources you created, delete them.

Get your cloud readyGet your cloud ready

Sign up for Yandex Cloud and create a billing account:

1. Navigate to the management console and log in to Yandex Cloud or create a new account.
2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one and link a cloud to it.

If you have an active billing account, you can create or select a folder for your infrastructure on the cloud page.

Learn more about clouds and folders here.

Required paid resourcesRequired paid resources

The cost of using a virtual router and a test VM includes:

• Fee for disks and continuously running VMs (see Yandex Compute Cloud pricing).
• Fee for using a public IP address (see Yandex Virtual Private Cloud pricing).

Create a security groupCreate a security group

To open the Mikrotik Cloud Hosted Router web UI from a browser in future, create a security group and allow inbound HTTP connections on port 80. For security, allow connecting only from your current public IP address. Also, allow the entire outbound traffic so that the router could access external resources, including the licensing server:

1. Get the public IP address of the computer or network to connect to the router from.

2. In the management console, select the folder where you need to create a security group.

3. Navigate to Virtual Private Cloud.

4. In the left-hand panel, select  Security groups.

5. Click Create security group.

6. Specify the security group name: mikrotik-router-group.

7. In the Network field, select the network to assign the security group to. If you do not have the required network yet, create it.

8. Click Add and specify the new rule settings in the window that opens:

   • Traffic direction: Incoming.
   • Port range: 80.
   • Protocol: TCP.
   • Source: Address range.
   • IPv4 CIDR: <your_public_IP_address>/32.
   • Description: Mikrotik Router.

9. Click Save.

10. Click Add again and specify the outgoing rule settings:

    • Traffic direction: Outgoing.
    • Port range: Select all.
    • Protocol: Any.
    • Destination name: Address range.
    • IPv4 CIDR: 0.0.0.0/0.
    • Description: Mikrotik Router Egress.

11. Click Save.

12. Click Create.

Create a VM with the Mikrotik Cloud Hosted RouterCreate a VM with the Mikrotik Cloud Hosted Router

1. In the management console, navigate to the folder dashboard, click Create resource, and select Virtual machine instance.

2. Under Boot disk image, in the Product search field, enter Cloud Hosted Router and select a public Cloud Hosted Router image.

3. Under Location, select an availability zone to create your VM in. If you do not know which availability zone you need, leave the default one.

4. Under Computing resources, navigate to the Custom tab and specify the platform, number of vCPUs, and amount of RAM:

   • Platform: Intel Ice Lake
   • vCPU: 2
   • Guaranteed vCPU performance: 100%
   • RAM: 2 GB

5. Under Network settings:

   • In the Subnet field, select the network the previously created mikrotik-router-group security group was assigned to and a subnet. If you do not have the required subnet yet, create it.
   • In the Public IP address field, select a static IP address from the list, or leave Auto to assign your VM a random external IP address from the Yandex Cloud pool.
   • In the Security groups field, select the mikrotik-router-group group.

6. Under Access, select SSH key and specify the VM access credentials:

   • In the Login field, enter a username. Do not use root or other reserved usernames.

   • In the SSH key field, select the SSH key saved in your organization user profile.

     If there are no SSH keys in your profile or you want to add a new key:

     1. Click Add key.

     2. Enter a name for the SSH key.

     3. Select one of the following:

        • Enter manually: Paste the contents of the public SSH key. You need to create an SSH key pair on your own.

        • Load from file: Upload the public part of the SSH key. You need to create an SSH key pair on your own.

        • Generate key: Automatically create an SSH key pair.

          When adding a new SSH key, an archive containing the key pair will be created and downloaded. In Linux or macOS-based operating systems, unpack the archive to the /home/<user_name>/.ssh directory. In Windows, unpack the archive to the C:\Users\<user_name>/.ssh directory. You do not need additionally enter the public key in the management console.

     4. Click Add.

     The system will add the SSH key to your organization user profile. If the organization has disabled the ability for users to add SSH keys to their profiles, the added public SSH key will only be saved in the user profile inside the newly created resource.

   Note that you only need this data for VM creation. You cannot use the data for router access.

7. Under General information, specify the VM name: mikrotik-router.

8. Click Create VM.

It may take a few minutes to create a VM. When the VM status changes to RUNNING, you can log in.

Change the administrator password on the routerChange the administrator password on the router

The router is created with a public IP address, so you need to change the default administrator password for security reasons.

1. In the management console, select the folder.
2. Navigate to Compute Cloud.
3. Copy the mikrotik-router VM public IP address and open it in your browser.
4. On the page that opens, enter the VM’s internal IP address in the IP Address field.
5. In the Password field, enter the new administrator password, confirm it in the Confirm Password field, and click Apply Configuration. You can apply other settings later.

Create a test VMCreate a test VM

Create a test VM in the subnet that hosts the router, to test connectivity between the router and VM.

1. In the management console, navigate to the folder dashboard, click Create resource, and select Virtual machine instance.

2. Under Boot disk image, in the Product search field, enter Ubuntu and select a public Ubuntu image.

3. Under Location, select the availability zone the mikrotik-router VM resides in.

4. Under Computing resources, navigate to the Custom tab and specify the platform, number of vCPUs, and amount of RAM:

   • Platform: Intel Ice Lake
   • vCPU: 2
   • Guaranteed vCPU performance: 20%
   • RAM: 1 GB

5. Under Network settings:

   • In the Subnet field, select the network and subnet hosting the mikrotik-router VM.
   • In the Public IP address field, select No address.

6. Under Access, select SSH key and specify the VM access credentials:

   • In the Login field, enter a username. Do not use root or other reserved usernames. To perform operations requiring superuser privileges, use the sudo command.

   • In the SSH key field, select the SSH key saved in your organization user profile.

     If there are no SSH keys in your profile or you want to add a new key:

     1. Click Add key.

     2. Enter a name for the SSH key.

     3. Select one of the following:

        • Enter manually: Paste the contents of the public SSH key. You need to create an SSH key pair on your own.

        • Load from file: Upload the public part of the SSH key. You need to create an SSH key pair on your own.

        • Generate key: Automatically create an SSH key pair.

          When adding a new SSH key, an archive containing the key pair will be created and downloaded. In Linux or macOS-based operating systems, unpack the archive to the /home/<user_name>/.ssh directory. In Windows, unpack the archive to the C:\Users\<user_name>/.ssh directory. You do not need additionally enter the public key in the management console.

     4. Click Add.

     The system will add the SSH key to your organization user profile. If the organization has disabled the ability for users to add SSH keys to their profiles, the added public SSH key will only be saved in the user profile inside the newly created resource.

7. Under General information, specify the VM name: test-vm.

8. Click Create VM.

Check the connection between the router and test VMCheck the connection between the router and test VM

Make sure that a network connection is established between the router and test VM:

1. Open the router's administrator interface in the browser.
2. Enter the username: admin.
3. Enter the previously specified administrator password.
4. Click Terminal.
5. In the terminal that opens, run the ping <test_VM_internal_IP_address> command.

If the packets reach the test VM, you can start configuring the router. You can find the router manual in the Mikrotik documentation.

Delete the resources you createdDelete the resources you created

To stop paying for the resources you created:

1. Delete the mikrotik-router and test-vm VMs.
2. Delete the mikrotik-router-group security group.
3. Delete the public static IP if you reserved one.