Identity, RouterOS version, model, uptime, CPU and memory for the device.

Read any RouterOS configuration path.

The escape hatch for everything without a dedicated tool. Read-only: it lists items at a path and cannot modify the device.

List every interface with its type, MAC, MTU and running state.

Bring an interface up or down.

Disabling the interface you are reaching the router through will cut this connection, and nothing here can undo that remotely.

List configured IPv4 addresses and the interfaces they sit on.

List firewall filter rules in evaluation order.

Each rule carries both an id and a position. Use id for any later change: position is only where the rule currently sits, and it shifts as soon as anything is added, removed or moved.

Every field of one firewall rule, including counters.

Add a firewall filter rule.

Order decides everything in a RouterOS firewall: the first matching rule wins. A new rule appended after a final drop is dead code, so set place_before unless the end of the chain is genuinely what you want.

Change fields on an existing firewall rule.

Only the arguments you pass are modified; omitted ones are left alone. Returns the rule as it stands afterwards.

Enable or disable one firewall rule, leaving its position intact.

Disabling is the reversible way to test whether a rule is responsible for something — prefer it over removing the rule.

Delete a firewall rule permanently.

There is no undo. Disabling a rule (set_firewall_rule_enabled) is almost always the better first move, and the returned copy of the deleted rule is the only record you will have afterwards.

Reorder a firewall rule relative to another rule.

Both ends are given by id rather than position, so the move means the same thing even if the list shifted since you last read it.

List NAT rules, including port forwards, in evaluation order.

Add a NAT rule, such as a port forward.

A port forward also needs the forward chain to permit the traffic; check list_firewall_rules(chain='forward') for a rule accepting connection-nat-state=dstnat before concluding it is broken.

Enable or disable one NAT rule.

Delete a NAT rule permanently. Returns the rule that was removed.

List DHCP leases — effectively the inventory of what is on the network.

Pin a dynamic DHCP lease so the device keeps its address.

List static DNS entries and regex overrides.

Add a static DNS entry.

Delete a static DNS entry.

List the IPv4 routing table.

Read the device log, most recent last.

Confirm the hub can reach and authenticate to this device.