How to install and license MikroTik CHR on a VPS

What is MikroTik CHR and when to use it

MikroTik CHR (Cloud Hosted Router) is a version of RouterOS built to run as a virtual machine. On a VPS it gives you the same firewall, VPN, routing and queueing tools you get on a physical MikroTik, but hosted in a data centre with a static public IP. Typical uses are a cloud VPN concentrator, a hub for site-to-site tunnels between offices, a BGP speaker, or a management gateway in front of other servers. At CloudHosting the CHR runs on our KVM VPS platform in Riga, the Netherlands or Dubai, so you keep EU data sovereignty and 24/7 human support.

Before you start

• A VPS with KVM virtualisation (not OpenVZ) and at least 1 vCPU, 512 MB RAM and a few GB of disk.
• Console or VNC access to the VPS, so you can recover if a firewall rule locks you out.
• The public IPv4 address, gateway and netmask assigned to the VPS.

Option A: deploy the ready CHR image

The cleanest method is to write the official CHR raw disk image directly onto the VPS boot disk. Boot the VPS into a rescue or live Linux environment from your control panel, then run:

wget https://download.mikrotik.com/routeros/7.15/chr-7.15.img.zip
unzip chr-7.15.img.zip
# writes the image over the whole system disk, usually /dev/vda
dd if=chr-7.15.img of=/dev/vda bs=4M oflag=sync

Reboot out of rescue mode. The VPS now boots RouterOS. Check the current stable version number on MikroTik's download page and adjust the URL accordingly.

Option B: install by ISO

If your panel lets you attach an ISO, mount the RouterOS install ISO, boot from it, press a to select all packages, then i to install, and reboot into the fresh system.

First login and network setup

Log in over the console with user admin and a blank password, then set an address so you can reach it over the network:

/ip address add address=203.0.113.10/24 interface=ether1
/ip route add gateway=203.0.113.1
/ip dns set servers=1.1.1.1,9.9.9.9
/user set admin password=YourStrongPassword

Confirm you can reach it with Winbox or SSH on the public IP. Before adding strict Firewall rules, keep the console session open so a mistake does not lock you out.

Licensing CHR

CHR uses its own licensing model, separate from hardware RouterOS. It runs in a free, unlimited-time mode capped at 1 Mbit/s per interface, which is fine for testing and light management traffic. For production throughput you buy a paid level (p1, p10, p-unlimited) that raises or removes the speed cap. To license:

• Create a MikroTik account at mikrotik.com and note your account credentials.
• In the router, link it to your account and request a key:

/system license print
/system license renew account=you@example.com password=YourAccountPassword level=p1

The router contacts MikroTik's licensing servers and installs the key. Verify with /system license print. Because CHR licences are tied to the system ID, take a backup of the licence and note the system ID before rebuilding the VM.

Harden and verify

• Disable unused services: /ip service disable telnet,ftp,www,api.
• Restrict Winbox and SSH to your admin IP ranges with address lists.
• Enable a basic input firewall that permits established/related traffic and drops the rest.
• Run /system package update check-for-updates and keep RouterOS patched.

Takeaway

Write the CHR image to your KVM VPS, set an address and gateway from the console, then renew a licence tied to your MikroTik account. Keep a console session open while you build firewall rules, and back up both the configuration and the licence so you can rebuild the VM without losing either.