Provision a Router

Learn how to provision a MikroTik router in Nukta using our automated onboarding wizard and secure management tunnel.

Provisioning a MikroTik router

The Nukta provisioning wizard links a physical or virtual MikroTik router to your ISP account, automatically configures customer access services, and establishes a secure management connection.

Because Nukta manages the setup automatically, you never need a static public IP address or port forwarding. Your router connects securely from behind any standard internet connection (fiber, wireless backhaul, or mobile data).

Prerequisites

Before starting the provisioning wizard, confirm:

• Internet Connectivity: The router has an active internet connection on its WAN interface.
• DNS Resolution: The router can resolve domain names (e.g., standard DNS servers like 8.8.8.8 and 1.1.1.1 are active).
• RouterOS Version: The device runs RouterOS v7 (v7.12 or newer is recommended).
• Terminal Access: You have administrative access to the router via WinBox, WebFig, or SSH.
• System Clock: The router's date and time are synchronized to network time (SNTP) so secure handshakes succeed.
• Firewall Access: Outbound traffic on Port 443 (TCP for script download and UDP for the secure management tunnel) is not blocked by upstream network firewalls.

Complete the provisioning wizard

1. Create the router record

In your Nukta dashboard, navigate to Devices → Mikrotiks and click Add Router:

• Router Name: Enter a clear, recognizable identity reflecting the site location and role (e.g., Site 1 Gateway - hEX or Hostel Main ax3). Avoid vague labels like Router 1 that become confusing as your network grows.
• Location / Site: The physical building, estate, or tower site where the router is installed.
• Click Generate Provisioning Script.

2. Copy the generated command

Nukta generates a single, secure terminal command containing your router's unique provisioning token:

/tool fetch url="https://{your-prefix}.nukta.one/provisioning/eyJwaWQiOiJ..." dst-path=nukta-setup.rsc; /import nukta-setup.rsc; /file remove nukta-setup.rsc;

Click Copy Command.

CAUTION

Do not edit the embedded token, URL, quotes, or arguments in the generated script. The token contains cryptographically signed configuration unique to your ISP workspace.

3. Run once in the MikroTik terminal

1. Open WinBox or WebFig and connect to your router.
2. Open Terminal from the menu.
3. Paste the copied command and press Enter.
4. The router downloads the configuration, applies your network settings, and removes the temporary setup file.

4. Wait for live detection

Return to your Nukta dashboard. Within 10 to 15 seconds, the dashboard automatically detects the router's connection:

• The status badge changes from Pending Setup to Online.
• Live system telemetry (CPU usage, RAM capacity, and uptime) begins streaming immediately.
• Direct remote WinBox and WebFig access links become available in your dashboard.

5. Verify end-to-end access

After the router comes online:

• Review the router details in Devices → Mikrotiks.
• Connect a test smartphone or laptop to verify that the captive portal opens (for hotspots) or that client credentials dial in (for PPPoE).
• Confirm that your test device receives internet access with the correct package speed limits.

Why the script creates the nukta_admin account

During provisioning, the script adds a dedicated RouterOS administrative user named nukta_admin.

Everything the Nukta platform manages on the router after the initial script operates through this account:

• Service Configuration: Uploading captive portal assets, synchronizing walled garden domains, and applying package speed limits.
• Health & Diagnostics: Reading live CPU load, memory utilization, disk capacity, and interface uptime.
• Remote Actions: Executing one-click tasks from your dashboard, such as syncing router time, refreshing portal files, or performing graceful reboots.

Security of the nukta_admin account

• Unique Password: The account is assigned an isolated, random password generated uniquely per router. It is never reused or displayed.
• Tunnel-Only Access: Access is restricted strictly to the private management tunnel address. It is completely inaccessible from the public internet or local customer Wi-Fi.
• Safe to Leave in Place: If nukta_admin is removed or disabled, live telemetry and automated management will stop working. Re-running the provisioning command restores the account.

If detection fails

If your router does not appear Online within 30 seconds of running the script:

1. Check Terminal Output: Review the MikroTik terminal for any syntax, DNS, or download errors during the /tool fetch step.
2. Test Internet Reachability: Run /ping 8.8.8.8 in the terminal to verify the router can reach external internet hosts.
3. Verify DNS: Run /put [:resolve nukta.one] to confirm the router can resolve domain names. If this fails, add DNS servers under IP → DNS (8.8.8.8, 1.1.1.1).
4. Inspect the System Clock: Verify that the router's clock is set to current time. If the year reads 1970, enable network time under /system ntp client set enabled=yes servers=pool.ntp.org.
5. Check Outbound Port 443: Ensure your upstream provider is not blocking outbound TCP 443 or UDP 443.
6. Existing Registrations: If you are moving an existing router between locations or workspaces, use the Re-provision action in Devices → Mikrotiks to generate a fresh token rather than re-using an old command.

Next steps after provisioning

With your router online and healthy:

1. Sync Walled Garden: In Devices → Mikrotiks, open the router action menu and click Sync Walled Garden to push enabled payment gateway endpoints.
2. Review Packages: Ensure your internet packages in Finance → Packages have the correct speed limits and pricing in your selected currency.
3. Customize Your Captive Portal: Upload your logo and brand theme under Customer Portals → Captive Portal.