VPN for MikroTik routers

The Bebra app runs in a container on a MikroTik router with RouterOS 7. Your whole home network reaches the internet through it, without an app on each device.

Get the install lines

Check your router against the table in step 1 first

RouterOS
7, long-term 7.23.8 or stable 7.24.3 and newer
CPU
ARM64, ARMv7 or x86, CHR included
RAM
256 MB or more
Page address
bebra.home:8790 or 192.168.88.1:8790

Step-by-step install

Step 3 asks you to press a button on the router, so keep it within reach, along with a computer on its network. The router needs an account that has an e-mail and an active subscription.

  1. Check RouterOS, the CPU and RAM

    You need RouterOS 7, long-term 7.23.8 or later, or stable 7.24.3 or later. The installer refuses 7.24.0 to 7.24.2 and beta builds, and on testing and rc it warns you. The CPU can be ARM64, ARM (armv7) or x86, a virtual CHR included. ARMv5 models aren’t supported yet and are marked in the table below. The minimum RAM is 256 MB.

    The /system/resource/print command in the Terminal shows all of it, in the version, architecture-name and total-memory fields, and free-hdd-space shows the free space in internal memory. To open the Terminal, click New Terminal in WinBox or WebFig, or connect over SSH.

    Models

    Does it fitModelsWhy
    Fit wellhAP ax³, hAP ax², cAP ax, Chateau ax, RB5009, CCR2004, hAP be³ MediaARM64, at least 1 GB of RAM
    FitRB4011, RB3011, L009ARMv7, at least 512 MB of RAM
    Only with an ext4 USB drivehAP ac³, hAP ax lite, wAP ax, Chateau LTE6, Chateau LTE12256 MB of RAM, little flash. Without a USB port they don’t fit
    Don’t fithAP ac lite, hAP lite, hAP ac, hEX (RB750Gr3), older hEX S, hEX lite, RB951, RB2011, CCR1xxxa MIPS CPU, and RouterOS has no containers for it
    Don’t fithAP ac², cAP aconly 128 MB of RAM
    Don’t fit yethEX refresh, hEX S (2025), hAP ax San ARMv5 CPU, which the first version of the app doesn’t support

    A router from the last rows of the table can still be set up by hand without the app, as the “Other routers” tab of your account describes.

  2. Update RouterOS

    In WinBox or WebFig open System → Packages and click Check For Updates. Pick the long-term or stable channel and click Download&Install. The router downloads the new version and reboots.

  3. Turn on containers with line 1

    Open the Terminal, paste line 1 and press Enter. You run it once. It only switches the device mode so that RouterOS allows containers, and line 2 installs the container package.

    Then, within 15 minutes, unplug the router’s power for 5 seconds and plug it back in, which is the most reliable way. A short press of the MODE button also works. Don’t hold RESET, because holding it at power-on resets the router’s settings. A normal reboot cancels the change.

    This step needs physical access to the router. Nobody can do it remotely, support included.

  4. Install the app with line 2

    Open the Terminal again, paste line 2 and press Enter.

    If the router has no container package, line 2 asks you to run /system/package/apply-changes. That command makes the router download the package from MikroTik and restart, which takes about a minute. Then run line 2 once more. Unplugging the power doesn’t install the package, only that command does.

    What you’ll seeInstall steps from 1/9 to 9/9, and the router page address on the last line.

    If something goes wrong, run line 2 again to repair the install.

    A sketch of the Terminal window. Circled are line 2 after the [admin@MikroTik] > prompt, the install steps from 1/9 to 9/9 and the router page address at the end
    The numbers mark line 2, the install progress and the page address.

  5. Log in to the router’s page

    The page opens only from devices on the home network. In the browser, type http://192.168.88.1:8790/ (the default MikroTik address) or bebra.home:8790. If the router has a different LAN address, put it in place of 192.168.88.1.

    Sign in with the MikroTik administrator login and password. The login is prefilled as admin and can be changed. The user must be in the full or write group.

    If you forgot the password or the page can’t check it through RouterOS, set a backup password for the page. Run /container/shell bebravpn in the Terminal, then bebravpn web password.

  6. Link the router to your account

    On the router page, pick “Sign in with code” to get the code field. Your account issues the code on the MikroTik tab of its “Router” section, under “Get code”. It has 8 digits and works for 3 minutes. Request it once the field is on screen.

  7. Choose devices, if needed

    By default Bebra covers your whole home network as soon as the router is signed in. To let some devices go online directly, switch the mode on the “Devices” tab to “Only selected devices” and tick the ones that should use the app.

    A failure, a reboot or an update leaves the network offline until the app is back, and traffic never goes around it. A pause, signing out and “Remove…” on the router page send the network online directly.

How to remove it

Removal starts with “Remove…” on the router page’s “More” tab, and the devices switch to a direct connection right away. The page removes everything it set up and shows a line for the Terminal, /system/script/run bebravpn-uninstall. Run it.

If the container was deleted by hand in WinBox rather than with that button, the devices routed through the app stay offline until you run that line.

Good to know

Without the app
if the container is stopped or deleted, the devices routed through Bebra, by default the entire home network, stay offline and never bypass it
IPv6
turned off for devices routed through the app
Load
FastTrack doesn’t work for these devices, so the router’s CPU works harder
USB drive
if the app lives on a USB drive, keep it plugged in, or the network goes offline
Where it’s installed
shown on the “More” tab, internal memory or a USB drive
Updates
installed by hand, on the “More” tab under “Update”

Common questions

I didn’t press the button within 15 minutes

Then containers stay off. Run line 1 again and within 15 minutes unplug the power for 5 seconds or briefly press MODE. A reboot from the menu or by command doesn’t count.

Line 2 asks me to run apply-changes

The router has no container package yet. Run /system/package/apply-changes, and the router downloads the package from MikroTik and restarts in about a minute. Then run line 2 again. Unplugging the power instead won’t install the package.

The router page won’t take my password

The MikroTik user must be in the full or write group, or the page won’t let it in. If the password is forgotten or RouterOS can’t check it, a backup password for the page helps. Step 5 has the lines that set it.

I can’t open the router page

It opens only from devices on the home network. If the name bebra.home doesn’t open, type http://192.168.88.1:8790/ or the router’s LAN address on port 8790. Make sure the install got to 9/9 as well.

The home network has no internet

During a failure, a reboot or an update the network waits for the app to come back and never goes around it. If the internet doesn’t come back, the container was probably stopped or deleted, or the USB drive with the app was pulled out. Put the drive back if it was removed, then run line 2 again, which repairs the install. To remove the app and give the devices direct internet again, run the line from “How to remove it” in the Terminal.

The code isn’t accepted

Each code is single-use and stops working after 3 minutes. Get a new one in your account once the code field is open. If the page mentions a missing e-mail, log in to the site with your e-mail and get a fresh code.

What the subscription costs

Plans and prices are on a separate page.

Choose a plan