Install MikroTik RouterOS CHR on a KVM VPS

MikroTik Cloud Hosted Router (CHR) is the virtual edition of RouterOS, ideal for a VPN gateway, a lab router or a firewall in front of other machines. It is not installed with an ISO: you write the raw disk image over the VPS disk. This guide walks you through that procedure on a VPS Linux Infrawire, with the precautions that keep you from locking yourself out.

Destructive operation. Everything on the VPS disk (system, data, SSH keys) is erased and cannot be recovered. Back up anything you need first, and only continue on a VPS you can afford to rebuild.

📋 Prerequisites

A KVM VPS running Ubuntu 24.04 or Debian 12 with root SSH access (from your customer area you will find the VPS IP and the root password).
At least 1 GB of RAM, because the image is unpacked in memory.
A way to open the VPS console (VNC) as a safety net, since CHR will not accept your old SSH keys.
A backup of your data stored away from the VPS.

📝 Note your network settings first

CHR starts with a blank configuration. Write down the values you will need if DHCP is not offered:

Bash
1ip -4 addr show scope global
2ip -4 route show default
3ip -6 addr show scope global
4lsblk

Keep VPS_IP/PREFIX, the default gateway (GATEWAY), the interface name and the disk name (usually /dev/vda, sometimes /dev/sda).

💾 Download the image and write it to disk

Work from memory (/dev/shm) so the download survives the overwrite. Get the version number (CHR_VERSION) from the download page of mikrotik.com, using the long-term or stable channel.

Bash
1apt update && apt install -y unzip wget
2cd /dev/shm
3wget https://download.mikrotik.com/routeros/CHR_VERSION/chr-CHR_VERSION.img.zip
4unzip chr-CHR_VERSION.img.zip
5lsblk

Check the disk name once more, then write the image. This command destroys the target disk:

Bash
1dd if=chr-CHR_VERSION.img of=/dev/vda bs=1M oflag=sync status=progress
2sync

The old system is now gone, so a plain reboot may fail. Force a clean restart through the kernel instead:

Bash
1echo 1 > /proc/sys/kernel/sysrq
2echo s > /proc/sysrq-trigger
3echo b > /proc/sysrq-trigger

Open the VPS VNC console. Log in as admin with an empty password; RouterOS may ask you to set a new one immediately. If no address was received by DHCP, set it by hand:

Bash
1/ip address add address=VPS_IP/PREFIX interface=ether1
2/ip route add dst-address=0.0.0.0/0 gateway=GATEWAY
3/ip dns set servers=1.1.1.1,9.9.9.9
4/ping 1.1.1.1 count=3

Then create your own administrator, and remove the default one once you have logged in with the new account:

Bash
1/user add name=USER password=STRONG_PASSWORD group=full
2/user remove admin

🔒 Disable unused services

A public router should expose as little as possible. Keep SSH, and restrict it to your own address:

Bash
1/ip service disable telnet,ftp,www,api,api-ssl
2/ip service set ssh address=ADMIN_IP/32
3/ip service set winbox address=ADMIN_IP/32
4/tool mac-server set allowed-interface-list=none
5/ip neighbor discovery-settings set discover-interface-list=none
6/ip service print

Replace ADMIN_IP with the public IP you administer from. If your address changes, use the VNC console to correct it.

🎫 CHR licence

CHR runs without a licence key, but the free mode limits upload speed per interface to 1 Mbps. Licence levels (P1, P10, P-Unlimited) remove or raise that limit and are bought from MikroTik, with a trial available. Check the current state and apply a licence tied to your MikroTik account:

Bash
1/system license print
2/system license renew account=MIKROTIK_ACCOUNT level=p1

✅ Verification

From your own computer, confirm that the router answers and that only SSH is reachable:

Bash
1ssh USER@VPS_IP
2nmap -Pn -p 21,22,23,80,8291,8728 VPS_IP

Inside RouterOS, /system resource print should show the CHR version and /ip address print your public address.

🛠️ Troubleshooting

No ping or SSH after the reboot. Open the VNC console. If /ip address print is empty, DHCP is not offered on this network: apply the manual address and route from the notes you took.

The VPS reboots into the old Linux. The image was written to the wrong disk. Reinstall Linux or use a rescue system, check lsblk, and repeat with the correct target.

Upload is stuck near 1 Mbps. That is the free CHR limit, not a network fault. Apply a licence as shown above.

🚀 Your VPS now runs RouterOS CHR: keep a backup of its configuration with /export file=backup.