Skip to content

Lab 01-06 · Backup, reset and restore

MTCNA

Module 1 · Introduction. Official course slides 78–87 and 90–91: configuration backup (.backup) and export (.rsc), reset configuration, the backup LAB (slide 90) and the export LAB (slide 91, optional).

You have spent three evenings in a video game. Then the console crashes and your save file is corrupted. Everything gone. Since that day you probably save in two places.

A router's configuration is the same: hours of work in a file nobody sees. Today you will save it two different ways, copy it to your laptop, wipe the router completely, and bring it back. Network technicians call this a restore drill, and the ones who never did one find out the hard way that their backup did not work.

What you will learn

  • The difference between a binary backup (.backup) and an export (.rsc), and when to use each
  • Save both, and copy them off the router (never keep them only on the router)
  • Reset the configuration and understand what survives a reset
  • Reach a router with no IP address through its serial console
  • Restore from a .backup and from an .rsc with /import, and fix an import that stops halfway

Two ways to save: the save file and the walkthrough

One analogy for the whole lab: a video game.

  • A .backup is your save file. One click, everything is in it, and loading it puts you back exactly where you were. But it only works in the same game on the same console: it is binary, you cannot read or edit it.
  • An .rsc export is a written walkthrough: "go to the castle, take the key, open the door". Anybody can read it, edit it, and follow it on another console. But it only contains what you wrote down.
Binary backup .backup Export .rsc
Made with Files → Backup, /system backup save /export file=...
Format binary (unreadable) plain text, a script of commands
Contains the whole configuration: users, passwords, keys, certificates... only what differs from the default configuration
User passwords yes never (users are not exported)
Other secrets (WiFi keys, PPP passwords) yes only with show-sensitive (RouterOS 7)
Encryption with a password you choose none: protect the file yourself
Restore with Files → Restore, /system backup load /import file-name
Use it to restore the same router move a configuration to another router, read it, edit it, keep it in Git

RouterOS 7 vs the course slides

Slide 79 says the .backup is encrypted by default with the user's password. That was only true before RouterOS 6.43: since then, a backup saved without a password is not encrypted, and RouterOS 7.23.8 behaves the same (we checked the file header). If the file will leave the router, give it a password.

flowchart LR
    R["<b>Router</b><br>configuration"] -- "/system backup save" --> B["<b>.backup</b><br>save file<br>(same router)"]
    R -- "/export file=" --> E["<b>.rsc</b><br>walkthrough<br>(any router, editable)"]
    B -- "copy off the router" --> L["<b>Your laptop</b><br>(and a second place!)"]
    E -- "copy off the router" --> L

Resetting a router

Reset configuration erases the configuration and reboots the router.

In WinBox: System → Reset Configuration. Its options:

Option Meaning
No Default Configuration (no-defaults=yes) come back completely blank, not with MikroTik's home default
Keep User Configuration (keep-users=yes) keep the users and their passwords
Do Not Backup (skip-backup=yes) do not save an automatic backup before resetting
Run After Reset (run-after-reset=file.rsc) run a script right after the reset (a quick way to apply an export)

Files (your backups) survive a configuration reset: only the configuration is wiped. A router can also be reset with the physical reset button (slides 66 and 87; more in lab 01-07).

A blank router has no IP address

After no-defaults=yes the router has no address at all. You can still reach it by MAC WinBox (lab 01-01) or by the serial console. In this virtual lab the management port also loses its address, so you will use the console.

The scenario

flowchart LR
    R1["<b>r1</b> · 13_JohnDoe<br>bridge1 192.168.88.1/24<br>DHCP server, user john"] -- "ether3 — eth1" --- PC1["<b>pc1</b><br>your laptop<br>192.168.88.10<br>/root/backups"]
    CON["<b>Serial console</b><br>docker exec ... telnet 127.0.0.1 5000"] -. "no network needed" .-> R1
Node Role Address
r1 your configured router (identity, LAN, DHCP server, user john) bridge1 192.168.88.1/24
pc1 your laptop: keeps the copies in /root/backups 192.168.88.10 (static)

Port names in the virtual lab

On a real hAP the Internet port is ether1; in the virtual lab ether1 is reserved for the lab itself, so the Internet port is ether2 and the LAN ports start at ether3. Never touch ether1.

Start the lab

Download the lab files and unzip them: 01-06-backup-and-restore.zip. Open a terminal inside the 01-06-backup-and-restore folder.

sudo containerlab deploy -t topology.clab.yml
ssh admin@clab-mtcna-01-06-r1                 # password: admin
docker exec -it clab-mtcna-01-06-pc1 bash      # your laptop

Keep a third terminal ready for the serial console (you will need it after the reset):

docker exec -it clab-mtcna-01-06-r1 telnet 127.0.0.1 5000

This is the virtual version of the console cable of slide 18. To leave it: press Ctrl + ], then type quit. Only one console session can be open at a time.

Step 1 · Look at what you are about to lose

Why: you should know what a good restore looks like before you need one.

On r1:

/export

Read it. You will find the identity 13_JohnDoe, bridge1, the address 192.168.88.1/24, the DHCP server lan-dhcp... but no user john: users are never exported. The first lines (ether1, 172.31.255.30/30, dhcp-client on ether1) are the virtual lab's management port.

Check yourself

List four things that the export contains and one thing that it does not.

Done when: you can say what a restored router must have.

Step 2 · Save a binary backup

Why: the save file. In WinBox: Files → Backup, Name before-reset, Password, Backup. On r1:

/system backup save name=before-reset password=Lab-Pass-13
/file print

Expected: Configuration backup saved and a file before-reset.backup of about 20 KiB. Write the password in your report: without it, the file is useless.

Try it without a name too:

/system backup save
/file print

The file is called something like 13_JohnDoe-20261023-0906.backup: identity + date + time. Another reason to set the identity!

Done when: before-reset.backup is listed in /file print.

Step 3 · Save an export

Why: the walkthrough. On r1:

/export file=before-reset
/file print

Expected: before-reset.rsc, about 1 KiB. It is a text file: you could open it in any editor.

Secrets in exports

In RouterOS 7 an export hides secrets such as WiFi passphrases. To include them: /export file=name show-sensitive. Then treat the file like a password.

Check yourself

Why is the .backup about 20 times bigger than the .rsc?

Done when: before-reset.rsc is listed.

Step 4 · Copy both files to your laptop

Why: slide 85, in capitals: a backup that lives only on the router is not a backup. If the router dies, the backup dies with it.

In WinBox you would drag the files from Files to your desktop. Here pc1 downloads them by FTP (File Transfer Protocol; port 21, enabled by default, unencrypted). On pc1:

cd /root/backups
curl -u admin:admin ftp://192.168.88.1/before-reset.backup -o before-reset.backup
curl -u admin:admin ftp://192.168.88.1/before-reset.rsc -o before-reset.rsc
ls -l
cat before-reset.rsc

Expected: two files, and the .rsc is readable text. Try cat before-reset.backup: unreadable.

Done when: both files are in pc1:/root/backups.

Step 5 · Delete them from the router and reset

Why: the course LAB deletes the files so that you must use your laptop's copy, like after a real disaster.

On r1:

/file remove [find where name~"before-reset"]
/file print

Now the point of no return. In WinBox: System → Reset Configuration, tick No Default Configuration, Keep User Configuration, Do Not Backup, then Reset Configuration. On r1:

/system reset-configuration no-defaults=yes keep-users=yes skip-backup=yes

RouterOS asks you to confirm: answer y. Your SSH session dies. The router reboots completely blank.

Check yourself

We used keep-users=yes. What would you need to log in afterwards if we had not?

Done when: the SSH session to r1 is closed.

Step 6 · Get in through the serial console

Why: the router has no address now, not even on the management port. The console needs none.

Wait about one minute, then open the console:

docker exec -it clab-mtcna-01-06-r1 telnet 127.0.0.1 5000

Press Enter, log in as admin / admin (the users were kept), answer n to the license question. The prompt says [admin@CHR] >: the identity is gone too (a real hAP would say MikroTik).

/ip address print
/file print

Expected: no addresses; no before-reset files (you deleted them).

To bring the backup back, the laptop needs to reach the router. Give the router a temporary address on the port where the laptop is:

/ip address add address=192.168.88.1/24 interface=ether3

Done when: the console shows the empty router and the temporary address is added.

Step 7 · Upload the backup and restore it

On pc1, upload the save file:

cd /root/backups
curl -T before-reset.backup -u admin:admin ftp://192.168.88.1/

In WinBox: Files → Restore. In the console:

/file print
/system backup load name=before-reset.backup password=Lab-Pass-13

Answer y to Restore and reboot? [y/N]. The router reboots with the old configuration, including the management port, so after a minute this works again from your PC:

ssh admin@clab-mtcna-01-06-r1

/system identity print
/ip address print
/user print

Expected: 13_JohnDoe, 192.168.88.1/24 on bridge1 (the temporary address on ether3 is gone: the backup replaced everything), and user john.

Check yourself

The temporary address on ether3 disappeared by itself. What does that tell you about how a .backup restore works?

Done when: identity, LAN and DHCP server are back.

Step 8 · (Optional, LAB 91) Restore from the export instead

Why: an export is how you move a configuration to another router, and it teaches you that a script can fail halfway.

  1. Save a fresh export and copy it to pc1 (steps 3 and 4), delete it from the router, and reset again (step 5).
  2. In the console, add the temporary address (step 6) and upload the .rsc from pc1 with curl -T before-reset.rsc ....

  3. In the console, remove the temporary address (the export will create its own on bridge1):

    /ip address remove [find interface=ether3]
/import before-reset.rsc

You will probably see:

Script Error: failure: client with such name already exists (/ip/dhcp-client/add; line 19)

An import stops at the first error

An export is a script: commands run one after another, and the first error stops it. Here the CHR recreates its DHCP client on ether1 at every blank start, and the export tries to create it again. Everything after line 19 (DHCP server, DNS, identity...) was not applied. On a real router the same happens whenever the target is not blank, or is a different model.

The fix: reset again, and before importing remove what clashes (or edit the .rsc: it is just text):

/ip dhcp-client remove [find]
/import before-reset.rsc

Expected: Script file loaded and executed successfully and the prompt changes to [admin@13_JohnDoe] >.

Note that john survived only because of keep-users=yes: an export never contains users.

Check your work

CLAB_EXEC="docker exec" ./check.sh

All lines PASS, last line Lab 01-06 SOLVED. The check expects a .backup and an .rsc on the router and copies in pc1:/root/backups: if you deleted them, upload them again.

If something goes wrong

Symptom Likely cause Fix
ssh: No route to host after the reset the reset removed every address, including the management port use the serial console (step 6)
Console shows nothing another console session is open, or the router is still booting close other telnet windows, wait, press Enter
curl: Failed to connect ... port 21 no address on ether3 yet, or the router is still booting add the temporary address in the console, wait a few seconds
backup load fails with a password error wrong password use the one you wrote down in step 2
Script Error ... already exists the import collides with something already configured reset, remove the clashing item (or edit the .rsc), import again
Users missing after import exports do not contain users reset with keep-users=yes, or recreate them

Clean up

sudo containerlab destroy -t topology.clab.yml --cleanup

Key takeaways

  • A .backup is a binary snapshot of the whole configuration (users and passwords included), for restoring the same router; protect it with a password.
  • An .rsc export is a readable, editable script with only the non-default configuration, for another router; it has no users, and secrets only with show-sensitive.
  • Copy backups off the router: a backup that only lives on the router dies with it.
  • Reset configuration wipes the configuration, not the files; no-defaults leaves the router blank, keep-users keeps the logins.
  • A blank router is still reachable by serial console or MAC WinBox.
  • /import runs the script line by line and stops at the first error.

Quick check

1. You want to copy the configuration of an hAP to a new, different router. Which file do you use?
  • An export .rsc
  • A binary .backup
  • A .npk package
  • The router's log file

An export is a text script of commands that you can read, edit and /import on another router. A .backup is meant to restore the same router.

2. Which file contains the RouterOS user passwords?
  • The .backup
  • The .rsc made with export
  • The .rsc made with export show-sensitive
  • Neither of them

The binary .backup contains the whole configuration, users and passwords included. Exports never contain users, not even with show-sensitive (that only adds secrets such as WiFi keys).

3. Why is a backup stored only on the router not a good backup?
  • If the router breaks or is stolen, the backup is lost with it
  • RouterOS deletes backups automatically after every reboot
  • A configuration reset always deletes every file
  • Backups on the router are always unencrypted

A backup must survive the disaster it protects you from. Copy it off the router (WinBox drag and drop, FTP, SFTP) and ideally keep a second copy elsewhere.

4. After /system reset-configuration no-defaults=yes, how can you still configure the router?
  • Through the serial console or MAC WinBox
  • Through WebFig at http://192.168.88.1
  • Through SSH to 192.168.88.1
  • It cannot be configured until you press the reset button

With no-defaults the router has no IP address, so WebFig and SSH cannot work. The serial console needs no network and MAC WinBox needs no IP.

5. Your import stops with failure: ... already exists (line 19). What happened to the commands after line 19?
  • They were not run, because the import stops at the first error
  • They were all run, and only line 19 was skipped
  • They were run twice to compensate for the error
  • They were saved to a file to be run after the next reboot

An export is a script: /import runs it line by line and stops at the first error. Reset, remove what clashes (or edit the .rsc), and import again.

6. You saved a backup without giving it a name. What is the file called?
  • The identity followed by the date and time
  • backup.backup
  • The MAC address of ether1
  • The name of the user who saved it

RouterOS names it identity-date-time, for example 13_JohnDoe-20261023-0906.backup. One more reason to set a meaningful identity.

7. You want to keep the router's configuration in a Git repository and see what changed each week. Which two statements are true?
  • An export is plain text, so Git can show the changed lines
  • You still need a .backup to restore the users and their passwords
  • A .backup is the better choice because Git can show its changes
  • An export contains the user passwords, so it replaces the .backup

An export is a text script: tools like Git show exactly which lines changed. But exports contain no users, so for a complete restore of the same router you also keep a password-protected .backup.

Your configuration is now safe in two places. Next lab: what to do when RouterOS itself is broken: Netinstall.