TFTP on MikroTik: Setup and Usage Examples

1. Diagnosis

You set up TFTP on MikroTik. Netinstall doesn’t see the router. Or the other way around, the router can’t pull a config from the server. Sound familiar?

TFTP on MikroTik covers two different scenarios under one acronym. First: RouterOS as a client, pulling a file from an external TFTP server via tool fetch. Second: RouterOS as a server, distributing files over TFTP to other devices, most commonly used to recover bricked routers via Netinstall or to boot diskless devices over the network.

What you’ll get from this article:

• A working TFTP server on MikroTik serving a file to a specific device
• A configured TFTP client for downloading firmware and configs
• An understanding of why Netinstall times out and how to fix it
• A list of common errors and how to close them without extra hassle

Setup time: 10-15 minutes if the network has no surprises. If you’re three layers deep behind a firewall, budget an hour.

You’ll need: a MikroTik with RouterOS 7.x, access to Winbox or SSH, and a file to distribute (an npk package, a backup, an image). At the time of writing, RouterOS 7.23.2 is current. Check the official site for the latest release before installing.

2. Why it breaks

• Firewall blocks UDP/69, TFTP uses a nonstandard port scheme, and the INPUT chain drops packets if the rule doesn’t account for TFTP
• File isn’t bound to the client’s MAC or IP, the MikroTik server only serves a file to the address it’s explicitly mapped to
• Server and client are on different VLANs, Netinstall broadcast doesn’t pass through routing without a helper
• Antivirus or Windows Firewall on the Netinstall PC blocks inbound TFTP traffic from the router
• Outdated Netinstall doesn’t support newer models or ARM64 architecture
• Wrong filename on the TFTP server, letter case and extension must match exactly
• The router’s bootloader is waiting for DHCP that isn’t there, network boot often needs DHCP plus TFTP together, not TFTP alone

3. The recipe

Preparation

Dependencies: RouterOS 7.x, physical access to the router’s port or an unisolated management VLAN. Check your environment before you start.

/system resource print
/interface print
/ip firewall filter print

Look at the output: RouterOS version, list of active interfaces, and whether there are drop rules on inbound traffic that would catch UDP/69 before it reaches TFTP.

Step 1. Enable the TFTP server

Go to IP → TFTP. This isn’t quite a classic TFTP daemon. MikroTik requires you to explicitly specify which file goes to which client.

/ip tftp settings set enabled=yes
/ip tftp add real-filename=disk1/routeros-arm64.npk req-filename=routeros-arm64.npk allow-clients=10.10.10.0/24

Result: /ip tftp print should show an active entry with status enabled and the correct file path.

Step 2. Verify the file path

/file print where name~"routeros"

The file must physically exist on the router’s filesystem. If it’s not there, upload it via FTP, SFTP, or copy it from a flash drive.

Step 3. Configure the firewall for TFTP

Port 69/UDP needs to be open for inbound traffic from the trusted subnet. Don’t expose it to the world, TFTP without authentication is a gift to anyone who ends up on the network.

/ip firewall filter add chain=input protocol=udp dst-port=69 src-address=10.10.10.0/24 action=accept comment="TFTP allow trusted"
/ip firewall filter add chain=input protocol=udp dst-port=69 action=drop comment="TFTP drop others"

Rule order matters. Put accept above drop, RouterOS reads the filter table top to bottom.

Step 4. Configure the TFTP client to download a file

If the router needs to pull a file from an external TFTP server itself, for example a config or firmware from a central management server, use tool fetch.

/tool fetch address=192.168.88.1 src-path=config-backup.rsc mode=tftp dst-path=config-backup.rsc

Result: the file shows up in /file print. Check its size, if it’s 0 bytes, the server responded but the file wasn’t found or the path is wrong.

Step 5. Automate with scheduler (optional)

For regular config synchronization over TFTP, for example across a fleet of identical branch routers.

/system scheduler add name=tftp-sync interval=1d start-time=03:00:00 on-event="/tool fetch address=10.10.10.5 src-path=configs/branch.rsc mode=tftp dst-path=branch.rsc; /import branch.rsc"

Interaction diagram

%%{init: {
  'theme': 'base',
  'themeVariables': {
    'primaryColor': '#ffffff',
    'primaryTextColor': '#1e293b',
    'primaryBorderColor': '#94a3b8',
    'lineColor': '#64748b',
    'fontSize': '15px',
    'fontFamily': 'ui-sans-serif, system-ui, sans-serif'
  },
  'flowchart': {'curve': 'linear', 'nodeSpacing': 50, 'rankSpacing': 50}
}}%%
flowchart TD
    A["TFTP client"] --> B["RRQ request port 69"]
    B --> C["MikroTik TFTP server"]
    C --> D["Check allow-clients"]
    D --> E["Serve file in blocks"]
    E --> F["Client assembles file"]
    style A fill:#f8fafc,stroke:#3b82f6,stroke-width:2px,color:#1e40af
    style C fill:#f8fafc,stroke:#3b82f6,stroke-width:2px,color:#1e40af
    style D fill:#f8fafc,stroke:#f97316,stroke-width:2px,color:#9a3412
    style F fill:#f8fafc,stroke:#22c55e,stroke-width:2px,color:#15803d

Port table

4. Verification

Check right after setup, don’t wait for someone to write “it’s not loading for me.”

/ip tftp print detail
/log print where topics~"tftp"
/ip firewall connection print where protocol=udp

Watch the connection counter in firewall connection. If an entry with port 69 shows up after you run Netinstall or fetch, the packet reached the router. If there’s no entry, the problem is at the network level, not MikroTik.

To test a transfer from an external Linux machine:

tftp 10.10.10.1
get routeros-arm64.npk

5. Complications

6. Alternatives

TFTP isn’t the only way to move a file to or from a MikroTik. Here are the options and why TFTP wins for the recovery scenario.

• FTP, has authentication and reliable transfer, but requires a running RouterOS. Won’t work for Netinstall, the router isn’t booted yet
• SCP/SFTP, encrypted and secure, a great choice for regular config sync between working routers. Won’t help you recover a dead device
• Netinstall without TFTP (USB/serial), doesn’t work on all models, requires physical access to the console port
• WinBox drag-and-drop, convenient for manual transfers, but can’t be automated via scheduler

TFTP is used for Netinstall because it’s the only protocol the router’s bootloader supports at the stage before RouterOS has even started. For regular file exchange between live devices, use SFTP instead, it’s more secure.

7. Prevention

Monitoring: add a check for TFTP server availability to your existing monitoring setup with a simple port-ping script.

/tool netwatch add host=10.10.10.1 interval=5m

Backup: export the config before any firmware manipulation over TFTP.

/export file=before-tftp-backup
/system backup save name=before-tftp-backup

The TFTP server starts automatically on reboot if enabled=yes is saved in the config, no extra steps needed, RouterOS keeps it in the permanent config.

Security

• Restrict allow-clients to a specific subnet, never leave it at 0.0.0.0/0
• Disable the TFTP server right after the recovery task is done, /ip tftp settings set enabled=no
• Use a fail2ban-style approach with an address-list for repeated failed requests if TFTP faces an untrusted segment
• SSH hardening on the MikroTik itself, a separate user without full access for scheduler automation tasks
• Never forward UDP/69 through NAT to the internet

8. FAQ

Why doesn’t TFTP work after setting it up on MikroTik?

Most often it’s the firewall, a drop rule sits above the accept rule for UDP/69, or allow-clients is set incorrectly. Check the rule order with /ip firewall filter print and make sure accept comes before drop.

How do I verify the TFTP server on MikroTik is working correctly?

Run /ip tftp print detail and check the enabled status. Also check /log print where topics~”tftp” for errors, and try a test transfer with the tftp command from another device on the network.

What do I do if Netinstall doesn’t see the router over TFTP?

Make sure the router is physically in network boot mode, reset held during power-up until the indicator starts blinking a certain way. Confirm the Netinstall PC and the router are on the same broadcast domain without any managed switches filtering broadcast traffic in between.

What’s the difference between TFTP and FTP on MikroTik?

TFTP runs over UDP with no authentication and is mainly used for Netinstall and firmware loading at the stage before RouterOS has started. FTP runs over TCP, requires a login and password, and works well for regular file exchange between already running devices.

Can I use TFTP on MikroTik for regular config backups?

Technically yes, via tool fetch and scheduler, but TFTP doesn’t encrypt traffic or verify file integrity natively. For regular backup tasks, SFTP is the better choice, it’s more secure and handles connection drops more reliably.

9. Outlook

You’ve set up a TFTP server on MikroTik, bound the file to a trusted subnet, and closed off unnecessary access via the firewall. Now the router can both serve files for Netinstall and other devices’ network boot, and pull its own configs and firmware from a central server on a schedule.

From here it’s just practice. The first Netinstall recovery takes about twenty minutes and a fair amount of nerves. The tenth takes three minutes, on autopilot. If something still doesn’t work, drop a comment and we’ll sort it out.