mikrotik-toolbox
RouterOS, plus a tiny Linux sidecar for everything MikroTik refuses to implement.
The problem
RouterOS is an excellent router operating system with a frustrating gap: no iperf3, no tcpdump, no dig, no proper diagnostic shell. When you need to measure throughput to the router or capture packets on it, you end up dragging a laptop around instead.
RouterOS 7 has container mode, which makes the fix simple: a small Alpine-based toolbox container that lives on the router itself. It runs an iperf3 server on boot, so the router doubles as a permanent throughput target, and gives you a shell with the usual network diagnostic tools. Built and tested for a RB5009UG+S+ and a hAP ax3 running RouterOS 7.23.1.
What it does
- iperf3 server on boot - port 5201, supervised by the container's init so a crashed iperf3 cannot take the container (and your shell access) down
- The missing tools - tcpdump, mtr, nmap, socat, netcat, curl, and the bind-tools suite (dig, host, nslookup), with nmap's NSE scripts as an opt-in extra
- Small enough for router flash - 15 MB tarball, 43 MB extracted; fits the RB5009's internal flash trivially and a USB drive on the hAP ax3
- Self-test command - toolbox-selftest verifies capabilities, DNS, and packet capture from inside the container on the real hardware
- Log-friendly defaults - iperf3 output is discarded rather than streamed to the RouterOS log, whose ring buffer a single busy test run would otherwise evict; opt in to a server-side log file with an environment variable
- Runtime configuration - port, server enable/disable, logging, and fallback DNS set via RouterOS container environment variables
Technical details
Alpine Linux on ARM64, built with Docker buildx under qemu user-mode emulation on an x86 host. The build deliberately produces a single-platform OCI archive with no provenance or SBOM attestations, because RouterOS cannot resolve a multi-arch image index or attestation manifests. A minimal init runs as PID 1, supervises iperf3, and exits promptly on SIGTERM so /container/stop is clean.
Verified on both routers: on the hAP ax3 with the container on an ext4 USB drive and a veth bridged onto the LAN VLAN, and on the RB5009 on internal flash with the container behind its own routed bridge and a default-drop forward chain. RouterOS runs containers fully privileged, so tcpdump, mtr, and SYN scans all work on the real hardware. The repo includes a full RouterOS setup walkthrough covering USB preparation, veth, bridging, and NAT for both shapes.