RouterOS can save your configuration in two ways, and people discover the difference at the worst possible moment: standing next to a replacement device, holding a file that will not go onto it. So, before anything else, the one sentence that matters. A backup puts this device back exactly as it was. An export is a readable list of commands you can read, edit and use somewhere else.
The backup
A backup is a binary file, made with /system backup save and put back with /system backup load. It contains the whole system: every setting, the users and their passwords, the certificates and keys, and the MAC addresses of the interfaces, which are restored along with the rest.
That completeness is the point, and it is also the catch. Because the file describes this device down to its interfaces and identities, it belongs to this device. MikroTik's advice is to restore it on the same device, and on the same RouterOS version it was made with. A backup from one model onto another model is not a plan, and neither is a backup from a much older version onto a fresh one.
Restoring reboots the router and replaces everything. There is no partial restore: you cannot take the firewall out of a backup and leave the rest.
A backup can be encrypted with a password, and it should be, because of what is inside it. Without a password the file is not encrypted at all, and anyone who has it has your router.
Two things a backup does not cover: if you run The Dude or User Manager, their databases are saved by their own tools, not by the system backup.
The export
An export is text. /export prints your configuration as the commands that would recreate it, and /export file=name writes it to a file you can download. Run it from the root menu for everything, or from a menu for that part alone:
/export file=before
/ip firewall export file=firewallBy default the output is compact: only what differs from the defaults, which is exactly what makes it readable. It is also what makes it portable. Because it is commands rather than a disk image, you can open it, read it, change the interface names, and paste the part you need into a different device. Moving a firewall from an old router to a new one is an export job, not a backup job.
The trade is that an export is not complete:
- User passwords are never in it. Not hidden, not hashed, not there. After importing an export onto a fresh device, you set the passwords again.
- Certificates and SSH keys are not in it either. Certificates have their own export command; a private key that was generated on the device and never exported is gone with the device.
- Files are not in it, and neither are the RouterBOARD boot settings.
- Other secrets are hidden by default. Wi-Fi passphrases, VPN keys and the like show as placeholders unless you ask for
show-sensitive. An export taken with that option is as sensitive as a backup; treat it that way.
Putting an export back is /import file-name=name.rsc. Import is not a transaction: it runs line by line and stops at the first error, leaving everything before that line applied. Run it with verbose=yes to see where it stopped.
Which one, when
| You want to | Use |
|---|---|
| Return this device to exactly how it was | Backup |
| Move a configuration to another model | Export, edited |
| Copy one part, for example the firewall | Export of that menu |
| Read what a device is actually doing | Export |
| Compare before and after a change | Export, both times |
| Hand something to a colleague or to us | Export with sensitive data hidden |
The honest answer is that you take both. They cost seconds and they fail in different ways.
A routine that works
- Before the change: take an export and a backup, both named with the date, and download them off the device. A file that lives only on the router is not a backup, because the thing you are protecting against is that router.
- Read the export. It takes a minute and it is the fastest way to find out what is really on a device you inherited.
- Make the change in safe mode, in steps. See Safe mode.
- Test before you leave: a second login, internet from a client, the Wi-Fi.
- After the change: a fresh export. Compare it with the one from step one and you have a record of what actually changed, which is worth more than your memory of it in six months.
- Store them with the handover sheet for that site, and keep the passwords somewhere that is not the same folder.
Both files contain things you do not want loose. A backup always does, and an export does as soon as you take it with sensitive data shown. Encrypt the backup, and when you post a configuration on a forum or send it to us, use a plain /export hide-sensitive.
How this fits the configurator
An export is also the way in. Paste the output of /export into the import button and the configurator reads your running configuration, so you can carry on from what is there instead of starting over. See Importing an existing configuration, and From RouterOS v6 to v7 if the export came from a v6 device. Comparing a new script with the export of the running device is also the cheapest way to change one thing on a device that is already in service. The rollback script next to every generated configuration is the small, targeted version of a restore.
Related: Importing an existing configuration, Using the script, Netinstall.