RouterOS initial setup and configuration management

Work in this order: find out what you have, secure access, get the WAN up, give the LAN addresses, harden, back up. Read the router before you change it (/system/resource/print, /system/default-configuration/print, /export). Rules for not losing the session are in routeros-fundamentals; they apply to every step here.

1. Know the starting point

• Most routers ship with a default configuration: a bridge for the LAN ports, 192.168.88.1/24 as the LAN address, a DHCP server, NAT on the WAN port, and a firewall that blocks management access from the WAN. /system/default-configuration/print shows the exact commands applied to this model. The families (CPE, AP, switch, CAP and so on) are in references/guides/getting-started/configuration-management/default-configurations.md.
• Some professional models (for example CCR) ship with little or no configuration. Then build the LAN by hand (section 4).
• Keep the default firewall. Remove it only if you will replace it with something you have designed.
• Login is admin. The password is empty, or printed on the device label on models that have one. Connect from a port other than ether1 (the WAN port in the defaults). WinBox finds routers by MAC address under Neighbors when there is no IP yet.

2. Secure access first