What this script actually does
Three things, in order: connects your router to the internet the way your ISP expects, groups the rest of your ports into one local network so your devices can reach each other and get addresses automatically, and shares that one internet connection with everything on the LAN. Every block in the generated script is commented in plain language, so you can read it afterward and start recognizing what each RouterOS command actually does — not just paste it blindly.
Running it
Open WinBox, connect to your router, go to New Terminal, and paste the whole script in. It runs top to bottom as a sequence of commands. If you're setting up a brand-new or freshly reset router, this is normally the very first thing you'd configure.
Keep a local connection to the router open while you apply this — a direct cable or the same LAN, not a connection routed through the internet — in case a mistake somewhere needs to be corrected. This is standard practice for any router configuration change, not specific to this tool.
VLAN IDs for worldwide ISPs
Select a country to see commonly reported VLAN IDs for its major ISPs. Always double-check against your own account or ONT/modem documentation, since these can vary by plan, region, or access network — even within the same ISP.
The PPPoE detail that trips people up
If your connection type is PPPoE, the script's internet-sharing rule points at a virtual interface called pppoe-out1, not the physical port your cable plugs into. This is correct and intentional — PPPoE creates its own virtual connection on top of the physical port, and that virtual connection is what actually carries your internet traffic. Pointing the internet-sharing rule at the physical port instead is a common manual-configuration mistake that leaves the PPPoE link connected while every device on the LAN still has no internet access, with no obvious error to explain why.
Frequently asked questions
How do I actually run this script on my MikroTik router?
Open WinBox, connect to your router, go to New Terminal, paste the script, and press Enter. Keep a local connection open in case anything needs undoing.
Will this lock me out of my own router?
The optional safety rules are ordered to allow LAN-side access first, so your own network keeps full access — they only block management access attempted from the internet.
What if my ISP uses PPPoE but I don't know my WAN port?
ether1 is the default on most MikroTik routers. Check your specific model if unsure — plugging into the wrong port just won't get an internet connection, it won't cause damage.