>> CONTROL PLANE FOR MIKROTIK ROUTEROS
One dashboard for every router, line and proxy port you run
RyoProxy replaces WinBox sessions and hand-written scripts with a single control plane. Provision PPPoE lines in bulk, rotate IPs on a schedule, publish HTTP and SOCKS ports per WAN, hand out WireGuard access, and see drift on any router before it becomes an outage.
./features
What the platform does
Eleven capability domains, from provisioning a fresh router to proving an IP is still clean. Each one is a real, shipped surface — not a roadmap item.
Router fleet & agents
Every router runs a sidecar agent that dials out to the control plane, so a fleet of MikroTiks is managed from one screen without exposing a single management port.
8 capabilitiesDeclarative RouterOS config
Router state is described once and reconciled continuously: preview the diff, apply it, and let the platform clean up whatever drifted.
8 capabilitiesPPPoE & IP rotation
Provision PPPoE lines in bulk and give each one a rotation schedule, a redial policy and a MAC strategy that survives a picky ISP.
8 capabilitiesProxy provisioning
Turn each WAN into addressable HTTP and SOCKS endpoints, with credentials, NAT rules and exports handled by the platform.
8 capabilitiesUpstream forwarding
Route selected address ranges through external upstreams, with per-proxy DNS, pushed live state, and every change tracked as an operation.
8 capabilitiesWireGuard VPN
Hand out VPN access with per-client policy — expiry, LAN reach, and the exact WAN a client egresses through.
8 capabilitiesIP reputation & history
Know the reputation of every line before your customer does, and rotate a blocked IP automatically instead of at 3 a.m.
8 capabilitiesAutomation API
Rotation and status endpoints designed for scripts: one URL, no session, no SDK.
6 capabilities./architecture
How a change reaches your router
Nothing on your network needs a public management port. The agent dials out, the control plane sends intent, and the router only ever talks to a process sitting next to it.
- 01operators
Operator dashboard
fleet, lines, proxies, VPN
Automation clients
scripts and workers, scoped keys
authenticated HTTPS session - 02control plane
Control plane
policy, roles, audit trail
State store
configuration and history
outbound tunnel, opened by the agent - 03on-site agent
Router agent
one per router, holds the credentials
Proxy runtime
serves the per-WAN endpoints
Forwarding runtime
routes selected traffic upstream
local network only - 04your hardware
MikroTik RouterOS
PPPoE, WAN, firewall, WireGuard
- 01You act in the dashboardCreate PPPoE lines, add a rotation schedule, publish proxy ports or preview a config diff.
- 02The control plane records intentRoles are checked, the intent is recorded and an audit entry is written — before anything touches a router.
- 03The agent executes locallyThe instruction travels down the connection the agent opened, and the agent applies it from inside your network.
- 04Results stream backApply progress and live state are pushed back as they happen, so an idle dashboard costs your routers nothing.
./specs
Specifications, not adjectives
These are the platform's actual defaults and limits — the same numbers your operators will see in production.
platform & stack
- Deployment
- self-hosted, single tenant, containerised
- Router target
- MikroTik RouterOS 7
- Agent
- one container per router, on your network
- Operator access
- browser dashboard and scoped API keys
- Data at rest
- router and proxy credentials encrypted
- Tenancy
- routers scoped per user, roles enforced server-side
transport & liveness
- Inbound ports on your router
- none
- Agent link
- outbound only, opened by the agent
- Session
- short-lived tokens, CSRF protected
- Live updates
- streamed, not polled
- Idle cost
- no router calls while nobody is watching
- Recovery
- automatic reconnect with backoff
capacity & limits
- Proxy endpoints
- hundreds per node, one per WAN address
- Protocols
- HTTP and SOCKS, with upstream forwarding
- PPPoE lines
- bulk provisioning, per-line rotation schedule
- WireGuard
- 253 clients per agent, own subnet each
- VLAN
- allocated automatically from free ranges
- Managed config
- 22 RouterOS categories per router
automation defaults
- WAN watchdog
- sweeps every 2 minutes, redials a dead line
- IP checks
- every line re-checked on a 2-minute cycle
- IP history
- 90-day retention, cleaned up automatically
- Auto-rotate
- blocked lines rotate, then back off
- Alerts
- Telegram notifications and bulk IP checks
- Brute-force defence
- graduated blocking with a whitelist
./use-cases
Built for people who run the hardware
The platform assumes you own the routers and the lines. Everything is scoped, auditable and multi-tenant from the first agent.
Proxy sellers running their own hardware
You own routers and PPPoE lines and sell access to them. The platform turns each WAN into addressable HTTP and SOCKS endpoints, rotates credentials in bulk, and gives every customer a scoped key they can rotate themselves.
Small ISPs and multi-line operators
Dozens or hundreds of PPPoE lines behind one router need balancing, watchdogs and redial policy. PCC or plain ECMP, a 2-minute WAN watchdog and per-line rotation schedules are configuration, not scripts you maintain.
Network teams with a MikroTik fleet
Declarative config across 22 RouterOS categories, drift reported per item, guided bootstrap for new routers, and an audit log with CSV export covering who changed what.
Automation and bot developers
Rotation, status and IP lookup are plain GET endpoints. One key can cover a whole router, or exactly one line and nothing else.
Teams that live on IP quality
Continuous reputation checks score every line, blacklist lookups run through a residential pool, and a blocked line rotates automatically with a cooldown instead of burning attempts.
Remote access and site-to-site
WireGuard clients with QR codes, Apple profiles, expiry dates, LAN policy and a routing mark that pins a client to a chosen WAN — plus imported site-to-site tunnels.
./faq
Questions we actually get asked
Short answers about deployment, router safety, scale and what the platform does not do.
01Do I have to expose my routers to the internet?
No. Each router runs an agent that opens an outbound connection to the control plane. Nothing dials in, and the router's management interface is only ever reached from inside your own network, by that agent.
02Where are my router credentials stored?
On site, in the agent next to the router. The control plane sends intent, not credentials, and anything it does store is encrypted at rest.
03Will applying a config break rules I created manually?
Applying is preview-first. Every managed item is reported as ok, missing, wrong or stale before anything changes, rules are placed in an order that preserves existing chains, and only objects the platform manages are touched.
04How many routers and lines does it handle?
The design target is fleets in the hundreds of routers with thousands of routing rules, and checks run in parallel so a sweep of the whole fleet finishes in seconds rather than minutes.
05Can I automate rotation without using the dashboard?
Yes. Start, stop, restart and current-IP are GET endpoints authenticated by a key — one per router, or a narrower key scoped to a single PPPoE line.
06Does RyoProxy sell proxies or IP addresses?
No. It is management software for infrastructure you already own or are authorised to administer. You supply the routers, the lines and the connectivity; the platform supplies the control plane.
Bring your MikroTik fleet under one control plane
Tell us how many routers and PPPoE lines you run today. We will map them to a deployment and show you the migration path.