Border Gateway Protocol (BGP) is the routing protocol that connects separate networks on the Internet and lets them exchange routes in a controlled way. This guide provides BGP configuration on MikroTik VPS.
You will configure basic BGP peering on a MikroTik VPS, CHR, or any RouterOS v7 on a VPS, and add simple, safe route filters for beginners. You will have one eBGP peer, your upstream or IXP, and you will advertise only your own prefix while filtering what you accept.
Before starting BGP configuration on MikroTik VPS, ensure you have the following:
You can deploy this setup on any VPS provider that supports MikroTik CHR, such as PerLod Hosting.
Here are the example values that were used in this tutorial; you must replace them with your real data:
Once you are done with the prerequisites, proceed to the following steps to start BGP configuration on MikroTik VPS.
First, you need a working IP setup on your MikroTik VPS so it can reach the upstream router. You must set the router identity, assign the public IP address to the WAN interface, and make sure you have basic IP connectivity to your BGP peer.
To configure identity and IP address on the VPS, you can run:
Add a default route to reach the peer if needed for initial connectivity:
Verify the IP connectivity to your peer with the command below:
Note: If ping does not work, check and fix your IP settings, routes, or firewall first. BGP will not establish until basic IP connectivity is working.
Before you add any BGP peers, you must set the main BGP instance with your AS number and router ID.
On RouterOS v7, BGP is under /routing bgp. To set the AS number and router ID, you can run the command below:
To verify it, you can print the instance:
To make BGP configuration cleaner and easier to manage, RouterOS v7 uses templates that you can apply to multiple peers. You can create a basic BGP template that defines your main settings and address family for IPv4.
To create a simple IPv4 template, you can run:
To verify it, you can print the template:
At this point, you can create the actual BGP peer toward your upstream. You must define the remote IP and AS so your MikroTik VPS can establish an eBGP session with the provider.
Add the eBGP peer using that template with the command below:
To check the BGP connection, you can run the command below:
Once established, you should see established=yes or similar flags.
After the BGP session is up, you need to tell the router which prefixes it should advertise to the upstream. You can configure simple filters so only your own prefix is announced, and nothing else is sent by mistake.
You can create an address list for your prefix, which makes it easier to reuse your prefixes if you extend the setup later:
Then, create an outbound filter chain. We want to create a chain called bgp-out-upstream1 that:
Also, you can match by prefix directly without an address list:
This ensures you never accidentally advertise routes you learned from someone else or internal or private networks.
Finally, attach the outbound filter to the BGP connection so it applies to routes you send:
Verify it with the command below:
You must look for output.filter-chain=bgp-out-upstream1 in the output.
BGP peers can send many routes to your router, and you should not accept everything by default. In this step, you can create simple inbound filters that block private or unwanted prefixes and only keep the routes you actually need on your MikroTik VPS.
A simple and safe way is:
For example, create a chain named bgp-in-upstream1:
The line with 0.0.0.0/0-0.0.0.0/24 means accept any route whose prefix length is between /0 and /24. The final reject drops anything that didn’t match earlier rules.
Then, attach the inbound filter to the peer with the command below:
Check the configuration with the following command:
You should see both input.filter-chain and output.filter-chain set.
RouterOS v7 gives you fine control over which routes are advertised by using BGP filters. You can explicitly mark and export your own prefix through filter rules so you know exactly what your MikroTik VPS is sending to the upstream.
If your provider sends this whole prefix to your VPS, you must add a blackhole route so the prefix appears in the routing table:
This just ensures the router owns the prefix in its table, so BGP can advertise it.
A more detailed RouterOS v7 method is to tag routes with set-bgp-* or match them directly. For a simple setup, the previous outbound chain is enough, but here is a clearer alternative example:
As long as the route for 198.51.100.0/24 exists in the routing table and matches the filter, it will be advertised.
After you finish the BGP configuration on MikroTik VPS, you should verify that the session is up and that the router is sending and receiving the correct routes.
Check BGP sessions with the command below:
You must look for established=yes and check uptime and received prefixes.
Check BGP routes with the following command:
You should see:
Even with correct BGP settings, the session will not establish if the firewall blocks TCP port 179 between your VPS and the upstream. You must add a simple allow rule so BGP traffic can pass while keeping your other firewall rules in place.
To do this, you can run the command below:
That's it, you are done with BGP configuration on MikroTik VPS.
In this guide, you learned how to build a clean BGP configuration on MikroTik VPS by preparing the VPS network, creating a basic BGP session, and applying simple inbound and outbound filters. RouterOS v7 uses templates and filters to safely manage your routes. By advertising only your own prefix, your MikroTik VPS is now ready for basic BGP peering and future growth.
We hope you enjoy this BGP configuration on MikroTik VPS. Subscribe to our X and Facebook channels to get the latest updates.
For further reading:
This usually means a basic network or firewall issue. Make sure you can ping the peer, check the AS numbers, and allow TCP port 179 in your firewall.
You can check locally using the command /routing/route print where protocol=bgp. However, the best way is always to check your upstream provider's looking glass or routing table.
Yes. BGP only advertises prefixes that are active in your routing table. A blackhole route ensures your whole /24 prefix stays active and ready to be exported at all times.