CHR (Cloud Hosted Router)

The CHR is RouterOS without a box. The same software as on an RB5009 or a CCR, except it runs as a virtual machine and its ports are the network adapters you give it. People use it as the router inside a virtual environment, as a test rig before anything touches real hardware, as a VPN endpoint in a datacentre, or as a lab where a configuration can be wrecked without anyone noticing.

Where it runs

The catalogue names VMware, Hyper-V, Proxmox and KVM, VirtualBox, and cloud providers. The architecture is x86-64. A CHR is therefore not a RouterBOARD: there is no RouterBOOT, no switch chip, no PoE and no reset button. Everything goes through the virtual CPU.

How the tool treats it

The CHR sits at the top of the device list with a tag marking it as virtual. Because a VM has no fixed port layout, the configurator asks you for one thing: the number of network adapters on the VM, between 1 and 64. After that it knows what it is working with.

• RouterOS names them ether1 through etherN, in the order the hypervisor presents them.
• The first one, ether1, is the WAN side in the generated script.
• Anything RouterBOARD-specific is left out: no PoE settings, no switch chip.
• There are no radios, so every wireless role is blocked with "No wifi radio".

Give the VM at least three network adapters if you want to work with VLANs. The Office router with VLANs, Router + CAPsMAN and Hotspot roles ask for at least three wired ports and are unavailable with two adapters. What remains with few adapters is Home router, VPN gateway, Core router and Harden only.

Licences, and what they limit

On a CHR the limit is not in the hardware but in the licence. The catalogue lists four levels: free, p1, p10 and p-unlimited. What they do:

• free — a fresh CHR runs on this without activating anything. Throughput is capped at 1 Mbit/s per interface. Enough to learn and test with, and also the explanation when you think your network is broken while your licence is still the free one.
• P1 — raises that ceiling to 1 Gbit/s per interface.
• P10 — to 10 Gbit/s per interface.
• P-Unlimited — without that speed cap.

So the limit is on throughput per interface, not on features: the free licence does tunnels, VLANs and a firewall perfectly well, only slowly. The current terms are MikroTik's to state; what licence levels limit in general is in RouterOS licences.

What to watch for in a hypervisor

• The order of the network adapters. ether1 is whatever your hypervisor presents as the first adapter. Add one later, or remove one, and the numbering can shift so your WAN is suddenly a LAN port. Write down which MAC belongs to which etherX, and check after a change with /interface ethernet print.
• The adapter type. Use your platform's paravirtual card: virtio on KVM and Proxmox, vmxnet3 on VMware. An emulated e1000 works, but it spends CPU for nothing.
• Security on the virtual switch. Bridging, VRRP and anything where the VM sends traffic with a different MAC address is blocked while promiscuous mode and MAC changes are closed on the virtual switch. That is a hypervisor setting, not something in your script: if a bridge looks perfect in RouterOS and still passes nothing, look there.
• The way back. There is no reset button and no Netinstall. Take a snapshot before you paste a script, and make sure you can reach the VM's console. The rollback script the tool ships alongside is your second way out, not your first.
• Time. A VM whose clock drifts gives odd certificate and log problems. The wizard sets NTP and the time zone in the system step; leave that on.
• At a cloud provider there is a second firewall around it. Security groups or network rules at your provider can block traffic your RouterOS firewall happily allows. Two firewalls means two places to look.

The quickest route to a working configuration

Pick CHR in the list, fill in the number of network adapters, and choose your role. For a router inside a virtual environment, Office router with VLANs is usually the right one, with three adapters or more. For a VPN endpoint in a datacentre, VPN gateway is the shortest route; see WireGuard. For a routed setup without a bridge, with OSPF or BGP, there is Core router.

After that you walk through the wizard as you would for any other device. If you want more than the wizard asks, go to advanced.

What trips people up

• Mistaking the free licence for a network problem. 1 Mbit/s per interface feels like a broken network. Check your licence first.
• Adding an adapter and forgetting the numbering. See above: ether1 can be something other than it was yesterday.
• A bridge that passes nothing. Nearly always the virtual switch, not RouterOS.
• Giving too few network adapters. With two adapters the VLAN roles drop out. Give it three if you want VLANs.
• No snapshot. A VM has that luxury; use it.