# mikrotik-irrupdater: Automating Strict IRR Prefix Filters on RouterOS 7 > A Python and shell script collection that wraps bgpq4 to generate and push IRR-based prefix lists to Mikrotik routers running RouterOS 7. It targets network operators who want strict BGP import filters without manual prefix list management. **edgenative/mikrotik-irrupdater** — Scripts to automatically deploy strict IRR filters to your peers on Mikrotik routers. - Repository: https://github.com/edgenative/mikrotik-irrupdater - Stars: 21 · Forks: 7 - Language: Python - License: GPL-3.0 - Published: 2026-08-23 · Updated: 2026-08-23 · Language: en - Canonical page: https://hysenlabs.com/projects/edgenative-mikrotik-irrupdater ## What Problem It Solves and Who It Is For Network operators who peer at Internet exchanges or with downstream customers often need to apply strict IRR filters to BGP sessions. On Mikrotik routers, building and updating those filters manually is tedious and error-prone, especially when peers announce hundreds of prefixes. This project provides a set of scripts that generate prefix lists from IRR data and push them to a RouterOS 7 router via the API. The intended user is someone who already runs BGP on Mikrotik, has a host with bgpq4 installed, and wants to automate filter updates. It is not a full BGP security suite; it focuses on the prefix-list generation and deployment step. ## How the Scripts Work: From AS-SET to Router Filter The workflow is split into two shell scripts. buildprefixes.sh reads config/peers.conf, which contains ASN and AS-SET pairs. It invokes bgpq4 to resolve those AS-SETs into a list of prefixes. The script then translates that list into a filter format that the Python code can consume. The README shows the target format as a list of dictionaries, each with a chain name and a rule string. For example, a rule might be 'if (dst==194.246.109.0/24) { accept }'. The chain name follows a pattern like as35008-fcix-import-ipv4. After buildprefixes.sh produces these rules, pushfilters.sh calls the Python script to connect to the router using the RouterOS API and apply the rules. The Python script can also accept the filter format directly, which means you could feed it from a different source if you wanted to bypass bgpq4. ## Configuration Files and Naming Conventions The project uses three configuration files under config/. routers.conf holds the username and password for the router API. peers.conf lists ASN and AS-SET pairs, one per peer. sessions.conf is the most detailed: it combines the ASN, a slug (like the IXP name), the router hostname or IP, an optional affinity of ipv4 or ipv6, and an optional human-readable peer name. The affinity field can be left empty to push both address families. The peer name replaces the ASN in the chain name, so you get Kerfuffle-fcix-import-ipv4 instead of as35008-fcix-import-ipv4. This naming is important because the generated filters jump to another filter chain named -import. That chain is expected to already exist on the router and contains your local policy, such as setting local preference or communities. The README notes that in their own setup, they then jump to an RPKI check. ## Getting It Running: Commands and Dependencies The README asks you to install the project into /usr/share/mikrotik-irrupdater/. The prerequisites are RouterOS 7 or later, the RouterOS API Python package, and bgpq4 installed on the host. On Debian or Ubuntu, you would run apt-get install bgpq4. After configuring the three config files, you run buildprefixes.sh on a schedule, then pushfilters.sh. The build script can take time depending on the number of peers and prefixes. The push script loops through sessions.conf automatically. There is no mention of a setup script or a package manager, so installation appears to be a manual copy of files plus editing the configs. The README also mentions a presentation with slides and a YouTube recording, which could be useful for understanding the intended deployment. ## Limitations and Failure Modes A few limitations stand out from the material. First, the scripts require RouterOS 7; there is no support for older versions. Second, the process is not fully automatic for new peers: you must manually edit peers.conf and sessions.conf each time you add a peer or a new session. The README says so explicitly. Third, the generated filters depend on a pre-existing -import chain. If that chain is missing on the router, the filter jump will fail or behave unexpectedly. Fourth, the accuracy of the filters depends entirely on the quality of the AS-SET data and bgpq4's ability to resolve it. If a peer has a poorly maintained AS-SET, the filter will be incomplete, and you could drop legitimate routes or accept unwanted ones. The scripts do not validate the prefix list against actual BGP announcements. ## Alternative: Junos-irrupdater and Manual Filtering The author has released a Juniper version called Edgenative/junos-irrupdater, which follows the same concept but targets Junos. The key difference is the target platform: Junos uses a different configuration syntax and a different API or automation method. If you run a multi-vendor network, you would need both tools. Another alternative is to write your own cron job that runs bgpq4 and then uses RouterOS scripts or Ansible to push filters. That gives you more control over the filter structure and naming, but you would have to build the integration yourself. The value of this project is that it already handles the conversion from bgpq4 output to RouterOS filter rules and the API push, so you avoid writing that glue code. ## Maintenance, License, and Upgrade Considerations The project is licensed under GPL-3.0, which means you can modify and redistribute it, but any derivative work must also be GPL-3.0. If you plan to embed this in a commercial product, that is a consideration. The repository has no recent releases listed, and the last push date is unknown, so you should check the commit history before relying on it. The README mentions that the previous release was more complex and required IRRPT, and this version was simplified based on feedback. That suggests the code has evolved, but also that breaking changes may occur between versions. The scripts themselves are simple enough to audit, but you should review the Python code for any hardcoded paths or assumptions about the router API. There is no mention of a migration path or upgrade notes, so plan to test each update in a lab. ## Conclusion Adopt mikrotik-irrupdater if you run Mikrotik routers on RouterOS 7 with BGP sessions and want to enforce strict IRR filters without manually building prefix lists. It is a good fit for IXP or customer-facing sessions where you can accept the chain-based filter design and the need for a separate host with bgpq4. Do not use it if you need full automation of peer additions, real-time RPKI integration, or support for RouterOS versions below 7. Before deploying, verify that your RouterOS API is reachable and that your peers' AS-SETs are accurate, because the scripts depend entirely on bgpq4 output. Also confirm that your router already has the -import filter chain defined, as the generated filters jump to it. ## FAQ ### What does mikrotik-irrupdater need before it will push filters? A MikroTik router on ROS 7 or newer with the RouterOS API reachable, the RouterOS API Python packages, and bgpq4 installed on the host running the scripts. The router also needs to be running BGP. The maintainers tested against ROS 7.7 through 7.16.1. ### How are filter names decided in mikrotik-irrupdater? From a slug you choose in `config/sessions.conf`, such as `fcix` or `sfmix`. Without a peer name the result is `as--import-ipv4`; with a peer name in the optional fifth field it becomes `--import-ipv4`. ### Why does mikrotik-irrupdater refuse to push some filters? A file that is empty or malformed, or whose rules name a different chain, is never sent. A filter that lost all its prefix rules, or more than 80% of them once the baseline had at least 10, is refused as well. Setting IRRUPDATER_FORCE=1 bypasses only the shrink comparison for a single run. ### Can I test mikrotik-irrupdater without a MikroTik router? Yes. `python3 tests/run.py` exercises the safety checks against a fake RouterOS API and needs nothing installed and no router. The disk space abort, the empty bgpq4 guard and the readback comparison are all covered that way. ## Sources - [Official README](https://github.com/edgenative/mikrotik-irrupdater#readme) - [Project repository](https://github.com/edgenative/mikrotik-irrupdater) - [README](https://github.com/edgenative/mikrotik-irrupdater/blob/main/README.md) - [Releases](https://github.com/edgenative/mikrotik-irrupdater/releases) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/edgenative-mikrotik-irrupdater