Docs

How to connect a router, what each button does and how to get your configuration back. Not here? Write to us.

01

Quick start

Setup takes about 10 minutes. EdgeOwl never asks for your admin password.

  1. Create an account. Sign up with Google or email. The 10-day free trial starts when you add a card; nothing is charged during the 10 days.
  2. Add a router. Give it a name in the dashboard and choose how we reach it: directly if it has a public IP, through Relay if it does not.
  3. Paste the setup script from the dashboard into the router's terminal.
  4. Press Check. If the router answers, you are done: the recommended schedule is already on.
RouterOS terminalexample, shortened
# EdgeOwl setup — RouterOS 7
/user add name=edgeowl group=edgeowl password="…"
/ip service set www-ssl port=20443
/ip service set ssh disabled=no
/ip firewall address-list add list=edgeowl address=egress.edgeowl.org comment="EdgeOwl"
# REST and SSH are also closed in /ipv6 firewall, if the package is enabled
What has to be open on RouterOS
User
edgeowl, in its own group: read, write, rest-api, test, sensitive, ftp, reboot, ssh
Services
www-ssl on TCP 20443 (REST API), ssh on its current port (backup files)
Allowed from
egress.edgeowl.org (it currently resolves to 208.77.244.240, 152.55.184.241 and 152.55.185.189), or the Relay tunnel

The script closes these ports over IPv6 too, if the IPv6 package is enabled.

02

Relay

Router behind NAT or CGNAT? EdgeOwl Relay connects it through an outbound tunnel. Included in every plan.

The router opens the tunnel itself: no port forwarding, nothing to open on the firewall.

  1. Choose Relay when you add the router, or enable it later in the device settings. Turn it off there and the tunnel is gone.
  2. Paste the script from the dashboard into the router's terminal. It sets up the tunnel and the restricted user.
  3. Press Check. The result shows the router answering via Relay.
Direct or tunnel: how to choose →
The tunnel
RouterOS 7
SSTP, TCP 443 out
Inbound ports
none

03

Check, Backup now, Update now

Check

Reads reachability, version, available update, last backup age and free flash, then runs five security checks. Also runs on its own after every job and every 6 hours.

Backup now

Connects, runs /export and /system backup save, then collects the two files of the run, .rsc and .backup, and removes them from the router. Each file is encrypted with your key before upload and stored in Amazon S3 in Frankfurt.

You can press it once a minute at most. Backups are kept for 90 days, and each router always keeps at least its last 10 runs.

Update now

Backup first, always. You watch every step live.

  1. Backup: export and binary, encrypted and stored.
  2. Check the channel: we install only the version RouterOS itself offers in the device's own channel.
  3. Install and reboot.
  4. Wait for the router, then run Check: it must answer, and the version must match.
If this failsThis happens
Check: no answerMarked unreachable, you get an alert.
Backup now: any stepMarked failed, you get an alert.
Update now: the backupThe update does not run.
Update now: install or versionMarked failed, you get an alert.
Update now: no answer after rebootYou get an alert with the pre-update backup ready to restore.

04

Schedules

We switch the schedule on for every new router after its first good Check, with our recommended settings; you change it in the dashboard whenever you like.

  • Backups: we recommend 2–3 a week, up to once a day. Pick the days and the hour in the router's own time zone.
  • Updates: we recommend once a week. A new release waits for your update day; you get a notification first, then it installs, backup first.
  • Time zone: days and hours follow the router's own time zone, read at Check or set under Advanced. When the clocks change, a time that does not exist runs after the change and a time that happens twice runs once.
  • Turn a schedule off per router if you prefer to press the buttons yourself.
  • A run missed while EdgeOwl was down is not made up; the next one runs on schedule.

[TODO: critical security updates — same-day policy to confirm]

Schedule · office-gwtime zone Europe/Chisinau
BackupsMon · Wed · Fri at 02:00
recommended
UpdatesSunday at 03:00 · notify the day before
recommended

05

Restore from backup

Every copy can be downloaded from the dashboard as the encrypted file, and decrypted on any computer with age and your key.

  1. Download the backup you want. To open it you need your private key, the recovery code shown at signup.
  2. Decrypt the file on your computer.
  3. Copy it to the router, for example through the Files list in Winbox.
  4. Load it on the router.

The binary backup brings back the whole router, MAC addresses included, so use it on the same device and RouterOS version. The export is readable and also works on replacement hardware; import it into a reset router, because a clash with existing settings stops the import.

[TODO: is there a restore button in the dashboard?]

On any computerage 1.1+
# decrypt the export with your key
age -d -i key.txt backup.rsc.age > backup.rsc
# the binary backup works the same way
age -d -i key.txt backup.backup.age > backup.backup
# then on the router, the export
/import backup.rsc
# or the binary; the router reboots
/system backup load name=backup.backup

06

RouterOS FAQ

Which RouterOS versions do you support?

RouterOS 7. RouterOS 6 coming soon; until then we can help you move: migration to v7 is a separate assisted service.

Which update channels do you follow?

The device's own channel. Stable stays stable, long-term stays long-term. We install only the version RouterOS itself offers in that channel, and never jump across major versions automatically. [TODO: what we do with routers on testing or development]

What do you check on a router?

Reachability, version, available update, last backup age and free flash, plus five security checks: Winbox open to the internet, default admin user still active, unused services left on, a known vulnerability in this version, no firewall drop from WAN. [TODO: confirm the five checks with engineering]

What if the router does not come back after the reboot?

You get an alert with the pre-update backup ready to restore. Someone then has to reach the router; Restore from backup explains what to do with the file. [TODO: how long we wait before the alert]

07

Encryption key

Your key pair is created in your browser when you sign up, with age (X25519). We keep only the public half: every backup is encrypted with it before it is written to storage, and from then on we cannot read it.

The private half never leaves you. It is shown once as a recovery code and is never sent to our servers. You decrypt on your own computer with age -d, see Restore from backup.

If you lose the private key, you lose only the old backups: nobody can open them, not you, not us. Create a new key pair in the Encryption key tab and the next backups are encrypted with it.

Encryption key tab in your account
Fingerprint
identifies the key in use
Created
the date of this key pair
Rotate
creates a new key pair for backups made from then on; older ones stay locked with the old key

08

Connecting a router behind NAT

You choose the mode when you add a router. Either way, the dashboard gives you a ready-made script to paste into the router's terminal.

Not sure which you have? Compare the WAN address in /ip address with what an IP check site shows. If they differ, the router is behind NAT.

With a public IP: directNo public IP: tunnel
We connect to the router directlyThe router opens an SSTP tunnel to our hub, TCP 443 out, on RouterOS 7
The router's firewall accepts us only from the egress.edgeowl.org listNo port forwarding, nothing to open on the firewall
To revoke: delete the edgeowl userTo revoke: delete the edgeowl user, turn Relay off