./features
Everything RyoProxy manages for you
The complete capability surface of the control plane, grouped by domain. Every entry below is implemented today, with the defaults and limits the platform actually ships.
- [domains]
- 11
- [capabilities]
- 84
- [source]
- implemented surface, not roadmap
AGT · id·0x3B2F8 capabilities
Router fleet & agents
Every router runs a sidecar agent that dials out to the control plane, so a fleet of MikroTiks is managed from one screen without exposing a single management port.
01Sidecar agent per router — A small container runs next to each MikroTik and keeps one outbound connection to the control plane — no inbound port, no public RouterOS exposure.
02Credentials never leave the router — Router username and password stay in the agent environment. The control plane sends intent, the agent performs the RouterOS REST call locally.
03Guided onboarding — A guided wizard walks a fresh router through provisioning, step by step, with nothing to hand-write.
04One-click agent attach — Idempotent provisioning adds an agent to an already-configured router without disturbing existing rules.
05Presence and health tracking — Heartbeat and system metrics drive presence, offline grace windows and a warm state cache.
06Resilient reconnect — Reconnects back off with jitter and keep-alives ride over brief outages, so a flaky link recovers on its own.
07Capability flags per agent — Proxy, forwarding and WireGuard surfaces are gated per agent, so a router only exposes what it is licensed to run.
08Multi-tenant assignment — Many-to-many agent-to-user mapping scopes every dashboard, API key and action to the routers a user actually owns.
CFG · id·0x66C78 capabilities
Declarative RouterOS config
Router state is described once and reconciled continuously: preview the diff, apply it, and let the platform clean up whatever drifted.
01Declarative RouterOS state — 22 managed categories — routing tables, routes, interface lists, address lists, mangle, NAT, filter, RAW, conntrack, DNS, DDNS, watchdog, macvlan and more.
02Drift detection before apply — Every managed item is compared against the live router and reported as ok, missing, wrong or stale. You preview the diff, then apply.
03Streamed apply — Each step of an apply run streams back live, so long provisioning jobs stay observable instead of blocking.
04Order-safe rule placement — Filter and mangle rules are anchored by family and position, so re-applying never scrambles an existing firewall chain.
05Stale item cleanup — Objects the platform once created but no longer manages are detected and removed, including legacy routing tables from older releases.
06Multi-WAN load balancing — PCC by src-address, by both-addresses-and-ports, or none for plain ECMP with sticky per-connection marking.
07WAN watchdog — An on-router script and scheduler sweep every 2 minutes, probe public resolvers, redial after 5 s and respect a 5-minute minimum-uptime guard.
08Hardening toggles — Optional WebRTC blocking, input-chain router protection, FastTrack handling and DNS-server detection ship as switches, not manual rules.
PPP · id·0x05E78 capabilities
PPPoE & IP rotation
Provision PPPoE lines in bulk and give each one a rotation schedule, a redial policy and a MAC strategy that survives a picky ISP.
01Bulk PPPoE provisioning — Create, delete and toggle PPPoE clients in bulk; update credentials per connection or across a whole ether group.
02Ether group management — List ether interfaces and attach or detach bridges without opening WinBox.
03Scheduled IP rotation — A rotation is one managed resource per line: set the interval, pause it, resume it, and see immediately when a line has drifted out of the schedule.
04Bulk rotation control — Create, toggle and run-now across hundreds of lines, with inline interval editing and a next-run countdown in the dashboard.
05MAC randomisation — Optional macvlan MAC randomisation on redial, switchable per agent and per call, for lines where the ISP pins the lease to the MAC.
06Tunable redial delay — A per-agent restart delay (5 s default) is shared by manual restarts and automatic rotations so the two never fight each other.
07Default-route hygiene — PPPoE default routes and distances are managed by the platform, keeping the balancer's view of each WAN correct.
08Macvlan realignment — Name normalisation and orphan sweeps repair drifted macvlan interfaces in one call.
PRX · id·0x065B8 capabilities
Proxy provisioning
Turn each WAN into addressable HTTP and SOCKS endpoints, with credentials, NAT rules and exports handled by the platform.
01HTTP and SOCKS ports per WAN — Each WAN gets an HTTP and a SOCKS endpoint of its own, bound to that WAN's address.
02High port density — Hundreds of HTTP and SOCKS endpoints per node, allocated from a contiguous range you choose at deployment.
03Incremental apply — Preview reports ok, missing or stale per port and applies only the delta instead of rewriting the whole config.
04Atomic config swaps — Generated configs are written atomically and the process restarted, with interface addresses managed by the container itself.
05Bulk credential rotation — Rotate the username and password on every proxy port in one action, then export the new list.
06Export and search — Credential export dialogs and advanced WAN search make handing a customer their port list a single step.
07Built-in proxy checker — Verify reachability and real behaviour from inside the dashboard — including UDP, not just a TCP handshake.
08NAT rule generation — DSTNAT, SRCNAT, masquerade and hairpin rules are generated with the proxy config, not maintained by hand.
FWD · id·0xE2E68 capabilities
Upstream forwarding
Route selected address ranges through external upstreams, with per-proxy DNS, pushed live state, and every change tracked as an operation.
01Upstream proxy routing — Selected address ranges are routed through external HTTP, SOCKS5 or Shadowsocks upstreams.
02Bulk lifecycle — Create, update, bulk-create, bulk-delete, clear-all, refresh IPs and restart — all over the same agent connection.
03Per-proxy DNS — Each upstream can carry its own resolver, with the right transport detected automatically.
04Managed DNS presets — Administrators curate named resolvers and rescan them when a provider changes transport.
05Zero-poll live state — State is pushed, not polled: an idle dashboard makes no router calls at all.
06Ordering guarantees — Out-of-order updates are discarded after a reconnect, so the dashboard never shows stale state as current.
07Tracked async operations — Every change is tracked as an operation you can list and inspect, making long jobs auditable.
08Import and export — Bring an existing proxy list in, take the running list out, without touching the container.
WGD · id·0x3FCD8 capabilities
WireGuard VPN
Hand out VPN access with per-client policy — expiry, LAN reach, and the exact WAN a client egresses through.
01Client provisioning — Create, bulk-delete and bulk-toggle WireGuard clients on one shared interface per router.
02Config, QR and mobileconfig — Hand a user a downloadable config, a scannable QR code or an Apple .mobileconfig profile.
03Per-client WAN pinning — Pin a client to a chosen WAN so it always egresses there, and verify it with a live IP check.
04Expiry and LAN access — Set an expiry date per client and decide individually whether that client may reach the LAN.
05Address planning built in — Each agent gets its own subnet automatically — 253 clients per agent, tens of thousands of addressable subnets.
06Site-to-site tunnels — Import an existing tunnel configuration, toggle it, and check its egress IP and country.
07Health check with auto-fix — One scan validates tunnels, clients and egress rules, then repairs what it can in a single click.
08Dedicated WireGuard proxy — Proxy endpoints can be published over the VPN path as well as the public one.
NET · id·0x86C58 capabilities
Routing, NAT & VLAN
The everyday network plumbing — VLANs, per-IP routes, DHCP, NAT and dynamic DNS — driven from the same place as everything else.
01One-click VLAN provisioning — The allocator picks a free VLAN id and the first free private block, reading the router as source of truth — no shadow database.
02Per-IP route assignment — Assign, edit or remove the WAN a given LAN address egresses through, individually or in bulk, with per-IP status readback.
03DHCP lease control — List leases and promote them to static reservations without leaving the dashboard.
04NAT rule management — Create, list, delete or clear DSTNAT, SRCNAT, masquerade and hairpin rules from one screen.
05Cloudflare DDNS — Point a hostname at a line whose address keeps changing, and let the platform keep the record current.
06DDNS to NAT sync — Port-forward rules follow the dynamic address automatically, with a single toggle to enable the sync.
07Mangle and table introspection — Read mangle rules and routing tables straight from the router, so what you audit is what is running.
08Response caching — Short-TTL caching on hot RouterOS reads keeps large fleets responsive without hammering each router.
REP · id·0x78348 capabilities
IP reputation & history
Know the reputation of every line before your customer does, and rotate a blocked IP automatically instead of at 3 a.m.
01Continuous IP watcher — Every line is re-checked on a 2-minute cycle, in parallel, so a fleet of hundreds stays current without manual sweeps.
02Reputation scoring — Residential quality is scored into a clear pass, suspicious or fail verdict, combining several independent signals.
03Blacklist lookup — Reputation queries are issued from residential paths, so the check itself is not fingerprinted as datacenter traffic.
04Auto-rotate on block — A blocked line rotates automatically up to a configurable attempt limit, then backs off for four hours instead of burning the connection.
05Unified IP timeline — Observations and verdicts land in one 90-day history per agent, cleaned up every six hours, browsable with infinite scroll.
06Cross-agent history — Administrators query IP history across the whole fleet, not just one router at a time.
07Telegram bulk check — Send a batch of addresses in a message or a file; deduplication keeps the chat readable.
08Event detection — PPPoE offline and IP-changed events are raised per agent, so an operator learns about a dead line before a customer does.
SEC · id·0xC9BB8 capabilities
Access & hardening
Sessions, roles, scoped keys, encrypted credentials and graduated blocking, so a shared control plane stays a safe one.
01JWT sessions done properly — Short-lived sessions in HttpOnly cookies, with CSRF protection and an origin allowlist.
02Session management — Users list their active sessions and revoke one or all others.
03Telegram OIDC login — Sign in through Telegram, and link or unlink the account later.
04Role-gated administration — Admin, operator and viewer roles separate who can see a fleet from who can change it.
05Graduated IP blocking — Five escalation levels with tunable durations, plus a whitelist and full attempt history.
06Encrypted credential storage — Router and proxy credentials are encrypted at rest.
07Scoped API keys — Keys scoped to one line for customers and to one router for administrators, with generate, regenerate, extend, revoke and bulk actions.
08Automatic cleanup — Background services expire tokens and reconcile agent status so stale credentials do not linger.
API · id·0xB12A6 capabilities
Automation API
Rotation and status endpoints designed for scripts: one URL, no session, no SDK.
01Listen-key rotation API — Simple GET endpoints for start, stop, restart and current IP on a named PPPoE line.
02Per-interface key API — A scoped key in the URL path gives a single interface its own automation endpoint, safe to hand to one customer.
03Headless by design — The public automation routes skip JWT and CSRF entirely, so a shell script or a bot needs nothing but a URL.
04Public forwarding update — Update a forwarding configuration from a script, without a dashboard session.
05Copy-paste examples — The dashboard renders ready-to-run API examples next to every key it issues.
06Self-service key rotation — A leaked key is rotated by its owner from the dashboard, with no support ticket.
OBS · id·0x19866 capabilities
Monitoring & audit
Charts, audit trail and Telegram alerts that answer what changed and whether the fleet is still healthy, without an SSH session.
01Operational dashboard — Gauges, traffic charts, activity feed, system health and quick actions, on a dashboard that loads in one pass.
02Traffic accounting — A collector aggregates per-agent daily statistics for charts and reporting.
03Audit trail — A filterable admin activity log with CSV export records who changed what, and when.
04Fleet analytics — Cross-agent activity and traffic overviews for administrators managing more than a handful of routers.
05Telegram alerting — Notifications land in the chat your team already watches, rate-limited so an incident does not flood it.
06Structured logging — Structured logs throughout, so an incident is diagnosable with ordinary tooling.