Safe mode | MikroTik Configurator

The dangerous changes on a router are the ones you make through the connection you are changing. You move a port into a VLAN, you switch on VLAN filtering, you rename an interface, and the answer never comes back. The device is fine. You are no longer on the other side of it.

Safe mode is RouterOS's answer to that. While it is on, everything you change is recorded. If your session ends the wrong way, the router undoes all of it and goes back to the state it was in when you switched safe mode on. It costs two keystrokes and it has saved more evenings than any other feature in RouterOS.

How to switch it on

In the terminal, over SSH or in the terminal window of WinBox, press Ctrl+X. RouterOS answers [Safe Mode taken] and your prompt changes: it now says <SAFE>. In WinBox and WebFig there is a Safe Mode button at the top left, which does exactly the same thing and stays pressed in while it is on.

From that moment there are three ways out, and the difference matters:

Ctrl+X again, or the button again: you keep your changes and leave safe mode. This is what you do once you have checked that you can still reach the device.
Ctrl+D: everything you changed since taking safe mode is undone, immediately.
The session dies, because you locked yourself out or the cable fell out: the same undo happens by itself once the connection times out. That takes a few minutes, so do not start pulling cables out of the device while you wait.

While safe mode is on, you can see exactly what is queued for undoing with /system history print. The entries are flagged as floating undo. It is a good way to check that what you think you changed is what you actually changed.

What it does not protect you from

Safe mode is a helpful colleague, not a safety net under everything. Worth knowing:

Anything that needs a reboot is outside it. Resetting the configuration, restoring a backup, installing packages: those go their own way, and safe mode is not consulted.
It has a limit of about a hundred recorded actions. Go past it and RouterOS quietly takes you out of safe mode, and nothing is undone afterwards. This is the one that bites when you paste a long configuration. Work in small steps.
Exiting the session cleanly is not the same as dropping it. If you type /quit, your changes stay.
It is one session at a time. If someone else takes safe mode, they are asked whether to undo your changes, keep them, or leave things alone. And changes made from other sessions while safe mode is held are recorded as well, so two people working at once can surprise each other.
It does not know what you meant. A change that keeps your session alive but breaks the internet for everyone else is, as far as safe mode is concerned, a success.
It does not survive power loss in the sense you would hope: a device that reboots comes up with whatever was in the configuration, and the undo list is gone.

Safe mode protects your session. It does not protect the device from a change you deliberately confirm. Keep a way in that does not depend on your configuration being right: an offbridge port, a second cable, or physical access.

The same idea for a script you paste

A generated configuration is a long list of changes in one go, which is exactly the case where the hundred-action limit gets in the way. So do not rely on safe mode alone for it. What does work:

Paste onto a device at factory defaults, over a port the script leaves alone. That is what our scripts are written for, and it removes most of the risk. See Using the script.
Export first. On a device that already runs something, take /export file=before and download it before you touch anything. See Backup and export.
Keep the rollback script. Next to every configuration we generate sits a script that removes exactly what the first one added, in reverse order.
Paste in pieces on a live device. Take safe mode, paste one section, check, leave safe mode, take it again for the next section. Slower, and much harder to end up stranded.
Check before you leave safe mode. Open a second session from another machine and log in. If that works, the change is safe to keep. Only then press Ctrl+X.

There is one more trick for changes you really do not trust: save a backup first and schedule a task that restores it in five minutes, then cancel that task once you are sure. It is blunt, it reboots the device, and it works when nothing else does.

Undo without safe mode

Every action, from the terminal and from WinBox alike, lands in /system history. The /undo and /redo commands, and the Undo and Redo buttons in WinBox, walk back through that list. Handy right after a typo. It is not a substitute for safe mode, because you have to still be connected in order to use it.