Skip to content
ryoproxy
./features

Everything RyoProxy manages on your MikroTik fleet

11

domains

84

capabilities

Router fleet & agents

One outbound agent per router, zero open ports.
8 capabilities
  • Sidecar agent per router — A small container runs next to each MikroTik and keeps one outbound connection to the control plane — no inbound port, no public RouterOS exposure.
  • Credentials never leave the router — Router username and password stay in the agent environment. The control plane sends intent, the agent performs the RouterOS REST call locally.
  • Guided onboarding — A guided wizard walks a fresh router through provisioning, step by step, with nothing to hand-write.
  • One-click agent attach — Idempotent provisioning adds an agent to an already-configured router without disturbing existing rules.
  • Presence and health tracking — Heartbeat and system metrics drive presence, offline grace windows and a warm state cache.
  • Resilient reconnect — Reconnects back off with jitter and keep-alives ride over brief outages, so a flaky link recovers on its own.
  • Capability flags per agent — Proxy, forwarding and WireGuard surfaces are gated per agent, so a router only exposes what it is licensed to run.
  • Multi-tenant assignment — Many-to-many agent-to-user mapping scopes every dashboard, API key and action to the routers a user actually owns.

Declarative RouterOS config

Describe once, preview the diff, fix drift.
8 capabilities
  • Declarative RouterOS state — 22 managed categories — routing tables, routes, interface lists, address lists, mangle, NAT, filter, RAW, conntrack, DNS, DDNS, watchdog, macvlan and more.
  • Drift detection before apply — Every managed item is compared against the live router and reported as ok, missing, wrong or stale. You preview the diff, then apply.
  • Streamed apply — Each step of an apply run streams back live, so long provisioning jobs stay observable instead of blocking.
  • Order-safe rule placement — Filter and mangle rules are anchored by family and position, so re-applying never scrambles an existing firewall chain.
  • Stale item cleanup — Objects the platform once created but no longer manages are detected and removed, including legacy routing tables from older releases.
  • Multi-WAN load balancing — PCC by src-address, by both-addresses-and-ports, or none for plain ECMP with sticky per-connection marking.
  • WAN watchdog — An on-router script and scheduler sweep every 2 minutes, probe public resolvers, redial after 5 s and respect a 5-minute minimum-uptime guard.
  • Hardening toggles — Optional WebRTC blocking, input-chain router protection, FastTrack handling and DNS-server detection ship as switches, not manual rules.

PPPoE & IP rotation

Bulk PPPoE lines with scheduled IP rotation.
8 capabilities
  • Bulk PPPoE provisioning — Create, delete and toggle PPPoE clients in bulk; update credentials per connection or across a whole ether group.
  • Ether group management — List ether interfaces and attach or detach bridges without opening WinBox.
  • Scheduled IP rotation — A rotation is one managed resource per line: set the interval, pause it, resume it, and see immediately when a line has drifted out of the schedule.
  • Bulk rotation control — Create, toggle and run-now across hundreds of lines, with inline interval editing and a next-run countdown in the dashboard.
  • MAC randomisation — Optional macvlan MAC randomisation on redial, switchable per agent and per call, for lines where the ISP pins the lease to the MAC.
  • Tunable redial delay — A per-agent restart delay (5 s default) is shared by manual restarts and automatic rotations so the two never fight each other.
  • Default-route hygiene — PPPoE default routes and distances are managed by the platform, keeping the balancer's view of each WAN correct.
  • Macvlan realignment — Name normalisation and orphan sweeps repair drifted macvlan interfaces in one call.

Proxy provisioning

Every WAN becomes an HTTP and SOCKS5 port.
8 capabilities
  • HTTP and SOCKS5 ports per WAN — Each WAN gets an HTTP and a SOCKS5 endpoint of its own, bound to that WAN's address.
  • High port density — Hundreds of HTTP and SOCKS5 endpoints per node, allocated from a contiguous range you choose at deployment.
  • Incremental apply — Preview reports ok, missing or stale per port and applies only the delta instead of rewriting the whole config.
  • Atomic config swaps — Generated configs are written atomically and the process restarted, with interface addresses managed by the container itself.
  • Bulk credential rotation — Rotate the username and password on every proxy port in one action, then export the new list.
  • Export and search — Credential export dialogs and advanced WAN search make handing a customer their port list a single step.
  • Built-in proxy checker — Verify reachability and real behaviour from inside the dashboard — including UDP, not just a TCP handshake.
  • NAT rule generation — DSTNAT, SRCNAT, masquerade and hairpin rules are generated with the proxy config, not maintained by hand.

Upstream forwarding

Send chosen traffic through external upstreams.
8 capabilities
  • Upstream proxy routing — Selected address ranges are routed through external HTTP, SOCKS5 or Shadowsocks upstreams.
  • Bulk lifecycle — Create, update, bulk-create, bulk-delete, clear-all, refresh IPs and restart — all over the same agent connection.
  • Per-proxy DNS — Each upstream can carry its own resolver, with the right transport detected automatically.
  • Managed DNS presets — Administrators curate named resolvers and rescan them when a provider changes transport.
  • Zero-poll live state — State is pushed, not polled: an idle dashboard makes no router calls at all.
  • Ordering guarantees — Out-of-order updates are discarded after a reconnect, so the dashboard never shows stale state as current.
  • Tracked async operations — Every change is tracked as an operation you can list and inspect, making long jobs auditable.
  • Import and export — Bring an existing proxy list in, take the running list out, without touching the container.

WireGuard VPN

VPN clients with expiry, LAN policy, egress WAN.
8 capabilities
  • Client provisioning — Create, bulk-delete and bulk-toggle WireGuard clients on one shared interface per router.
  • Config, QR and mobileconfig — Hand a user a downloadable config, a scannable QR code or an Apple .mobileconfig profile.
  • Per-client WAN pinning — Pin a client to a chosen WAN so it always egresses there, and verify it with a live IP check.
  • Expiry and LAN access — Set an expiry date per client and decide individually whether that client may reach the LAN.
  • Address planning built in — Each agent gets its own subnet automatically — 253 clients per agent, tens of thousands of addressable subnets.
  • Site-to-site tunnels — Import an existing tunnel configuration, toggle it, and check its egress IP and country.
  • Health check with auto-fix — One scan validates tunnels, clients and egress rules, then repairs what it can in a single click.
  • Dedicated WireGuard proxy — Proxy endpoints can be published over the VPN path as well as the public one.

Routing, NAT & VLAN

VLAN, routes, DHCP, NAT and DDNS.
8 capabilities
  • One-click VLAN provisioning — The allocator picks a free VLAN id and the first free private block, reading the router as source of truth — no shadow database.
  • Per-IP route assignment — Assign, edit or remove the WAN a given LAN address egresses through, individually or in bulk, with per-IP status readback.
  • DHCP lease control — List leases and promote them to static reservations without leaving the dashboard.
  • NAT rule management — Create, list, delete or clear DSTNAT, SRCNAT, masquerade and hairpin rules from one screen.
  • Cloudflare DDNS — Point a hostname at a line whose address keeps changing, and let the platform keep the record current.
  • DDNS to NAT sync — Port-forward rules follow the dynamic address automatically, with a single toggle to enable the sync.
  • Mangle and table introspection — Read mangle rules and routing tables straight from the router, so what you audit is what is running.
  • Response caching — Short-TTL caching on hot RouterOS reads keeps large fleets responsive without hammering each router.

IP reputation & history

Score every IP, rotate the blocked ones.
8 capabilities
  • Continuous IP watcher — Every line is re-checked on a 2-minute cycle, in parallel, so a fleet of hundreds stays current without manual sweeps.
  • Reputation scoring — Residential quality is scored into a clear pass, suspicious or fail verdict, combining several independent signals.
  • Blacklist lookup — Reputation queries are issued from residential paths, so the check itself is not fingerprinted as datacenter traffic.
  • Auto-rotate on block — A blocked line rotates automatically up to a configurable attempt limit, then backs off for four hours instead of burning the connection.
  • Unified IP timeline — Observations and verdicts land in one 90-day history per agent, cleaned up every six hours, browsable with infinite scroll.
  • Cross-agent history — Administrators query IP history across the whole fleet, not just one router at a time.
  • Telegram bulk check — Send a batch of addresses in a message or a file; deduplication keeps the chat readable.
  • Event detection — PPPoE offline and IP-changed events are raised per agent, so an operator learns about a dead line before a customer does.

Access & hardening

Roles, scoped keys, encrypted credentials.
8 capabilities
  • JWT sessions done properly — Short-lived sessions in HttpOnly cookies, with CSRF protection and an origin allowlist.
  • Session management — Users list their active sessions and revoke one or all others.
  • Telegram OIDC login — Sign in through Telegram, and link or unlink the account later.
  • Role-gated administration — Admin, operator and viewer roles separate who can see a fleet from who can change it.
  • Graduated IP blocking — Five escalation levels with tunable durations, plus a whitelist and full attempt history.
  • Encrypted credential storage — Router and proxy credentials are encrypted at rest.
  • Scoped API keys — Keys scoped to one line for customers and to one router for administrators, with generate, regenerate, extend, revoke and bulk actions.
  • Automatic cleanup — Background services expire tokens and reconcile agent status so stale credentials do not linger.

Automation API

Rotate an IP with one URL.
6 capabilities
  • Listen-key rotation API — Simple GET endpoints for start, stop, restart and current IP on a named PPPoE line.
  • Per-interface key API — A scoped key in the URL path gives a single interface its own automation endpoint, safe to hand to one customer.
  • Headless by design — The public automation routes skip JWT and CSRF entirely, so a shell script or a bot needs nothing but a URL.
  • Public forwarding update — Update a forwarding configuration from a script, without a dashboard session.
  • Copy-paste examples — The dashboard renders ready-to-run API examples next to every key it issues.
  • Self-service key rotation — A leaked key is rotated by its owner from the dashboard, with no support ticket.

Monitoring & audit

Charts, audit trail and Telegram alerts.
6 capabilities
  • Operational dashboard — Gauges, traffic charts, activity feed, system health and quick actions, on a dashboard that loads in one pass.
  • Traffic accounting — A collector aggregates per-agent daily statistics for charts and reporting.
  • Audit trail — A filterable admin activity log with CSV export records who changed what, and when.
  • Fleet analytics — Cross-agent activity and traffic overviews for administrators managing more than a handful of routers.
  • Telegram alerting — Notifications land in the chat your team already watches, rate-limited so an incident does not flood it.
  • Structured logging — Structured logs throughout, so an incident is diagnosable with ordinary tooling.