How to Build a Reliable ISP Backhaul Network in Uganda Using MikroTik Point-to-Point Links

Every ISP running MikroTik routers in Uganda, Kenya, Tanzania, or Rwanda depends on RouterOS configuration to keep subscribers connected. A single misconfigured firewall rule, a failed firmware upgrade, or hardware replacement without a configuration backup can take your entire network offline — affecting hundreds of paying subscribers and triggering a flood of support calls. Your ISP billing system can’t suspend or reactivate subscribers if your routers are down.

This guide covers everything you need for a robust MikroTik backup and recovery strategy: manual and automated backups, configuration exports, backup storage, firmware management, and disaster recovery procedures for African ISP deployments.

Two Types of MikroTik Backups

RouterOS has two distinct backup formats, each with a different purpose:

For production ISP routers, maintain both: binary backups for fast same-device recovery, and exports for hardware migration and documentation.

Hardware This Applies To

All MikroTik RouterOS devices require regular backups. Routers in your ISP stack available from NetEdge Supplies:

• MikroTik hEX S RB760iGS — core PoP router; most critical to back up; hosts PPPoE server, firewall, and billing system API config
• MikroTik hEX RB750Gr3 — zone distribution router; back up after any configuration change
• MikroTik hAP RouterBOARD with PoE — subscriber CPE; keep a template export for rapid re-provisioning
• MikroTik hAP lite Wireless Router — residential CPE; maintain a standard config template
• MikroTik hAP lite RB941-2nD — budget CPE; template export per device type
• MikroTik RouterBOARD Wireless Router — distribution and backhaul node; critical config backup

Connect infrastructure with Cat6 Flat Ethernet Cable and Cat6 Indoor/Outdoor UTP Cable. Browse the MikroTik Routers collection.

Step 1: Create a Manual Binary Backup

1. Open Winbox and connect to your router
2. Go to Files → click Backup
3. Set a filename (e.g., hex-s-pop1-20261011) and a strong encryption password
4. Click Backup — the .backup file appears in the Files list
5. Drag it to your desktop or click Download to save it off-router

Always download the backup file from the router. A backup that only exists on the router is lost if the router fails.

Step 2: Create a Configuration Export

1. Open a Winbox Terminal or SSH session
2. Run: /export file=pop1-config-20261011
3. The .rsc file appears in Files — download it
4. Open the file in a text editor and review it — redact any passwords before storing in shared documentation

Export specific sections for documentation: /ip firewall export, /ppp export, /ip pool export.

Step 3: Automate Backups with a RouterOS Script

Manual backups are forgotten. Automate them with a RouterOS scheduler:

1. Go to System → Scripts → click +
2. Name: auto-backup
3. Paste this script:

   :local date [/system clock get date]
   :local filename ("backup-" . $date)
   /system backup save name=$filename
   /export file=$filename

4. Click OK
5. Go to System → Scheduler → click +
6. Name: daily-backup | Start Time: 02:00:00 | Interval: 1d
7. On Event: auto-backup
8. Click OK — the router now backs up automatically every night at 2am

Step 4: Transfer Backups Off-Router Automatically (FTP/SFTP)

Files sitting on the router are not safe backups. Use a script to push backups to your backup server (same server running your ISP billing system works well):

:local date [/system clock get date]
:local filename ("backup-" . $date . ".backup")
/system backup save name=$filename
/tool fetch address=192.168.1.100 src-path=($filename) \
  dst-path=("/backups/" . $filename) \
  user=backupuser password=yourpassword upload=yes

Schedule this script to run nightly. Your backup server accumulates dated backup files from every router automatically.

Step 5: Firmware Upgrade Best Practices

Always back up before upgrading firmware. RouterOS firmware upgrades occasionally change default settings or break scripts.

1. Create a binary backup and export before upgrading
2. Download firmware from System → Packages → Check for Updates
3. Select stable channel only for production routers
4. Click Download & Install — router reboots automatically
5. Verify all services (PPPoE server, firewall, billing API) are working after reboot
6. If anything breaks, restore from your pre-upgrade backup immediately

Step 6: Restore from a Binary Backup

1. Open Winbox → Files — drag the .backup file onto the Files window to upload it
2. Go to System → Backup → Restore
3. Select the backup file and enter the encryption password
4. Click Restore — router reboots and comes back with the saved configuration
5. Verify PPPoE server, firewall, IP pools, and billing system API connection are all functional

Step 7: Restore from a Configuration Export

Use this when migrating to new hardware or recovering from a complete failure:

1. Reset the new router to factory defaults: System → Reset Configuration (check No Default Config)
2. Connect via Winbox using the router’s MAC address (no IP yet)
3. Upload the .rsc export file via Files
4. Open Terminal and run: /import file=pop1-config-20261011.rsc
5. Review the import log for any errors
6. Set the router’s IP and reconnect — configuration is restored

Backup Schedule Recommendation for Ugandan ISPs

• Core PoP router: daily automated backup + export; off-router storage
• Zone distribution routers: weekly automated backup; after every config change
• Subscriber CPE: maintain one template export per device model; re-apply on replacement
• Before any change: always create a manual backup immediately before making configuration changes

Conclusion

A MikroTik backup strategy is cheap insurance against the kind of network outage that costs you subscribers and damages your reputation as an ISP. Automate daily backups, store them off-router, and keep your ISP billing system server as your centralised backup destination. When — not if — you need to recover, you’ll be back online in minutes rather than hours.

Keep your ISP running with automated billing and network management →