MikroTik CHR (Cloud Hosted Router): Run RouterOS on Any VM or Cloud (2026)

You don't need physical MikroTik hardware to run RouterOS. CHR (Cloud Hosted Router) is a virtual machine image that runs RouterOS on any x86 hypervisor or cloud platform. It gives you the full MikroTik feature set – routing, firewall, VPN, queues, everything – in a VM.

Use Cases

• Cloud VPN concentrator – Run CHR on AWS/GCP as a WireGuard or SSTP hub.
• Lab/testing environment – Practice MikroTik configs without physical hardware.
• Remote site router – Deploy a virtual router at a colocation or branch office.
• ISP core router – High-performance routing on server-grade hardware.
• Network automation testing – Test API scripts safely.

CHR Licensing

The free license is fully functional – just speed-limited. Perfect for labs and learning.

Installation: VirtualBox

Step 1: Download CHR Image

Go to mikrotik.com/download → Cloud Hosted Router → download the VMDK or VDI image.

Step 2: Create VM

1. VirtualBox → New → Name: "MikroTik CHR", Type: Linux, Version: Other Linux (64-bit).
2. Memory: 256 MB minimum (512 MB recommended).
3. Hard disk: Use existing → select the downloaded VMDK/VDI file.
4. Network: Adapter 1 → Bridged Adapter (or NAT for lab).
5. Start the VM.

Default login: admin with no password. Set a password immediately:

/user set admin password=YourPassword2026

Installation: VMware ESXi

1. Download the VMDK image from mikrotik.com/download.
2. Create a new VM in ESXi with Linux (Other 64-bit).
3. Delete the default disk and attach the CHR VMDK.
4. Set the NIC to your management network.
5. Boot and configure.

Installation: Hyper-V

1. Download the VHDX image from mikrotik.com/download.
2. Hyper-V Manager → New Virtual Machine.
3. Generation 1, 256 MB RAM, select your virtual switch.
4. Use existing virtual hard disk → select the VHDX file.
5. Boot.

Cloud Deployment: AWS

Step 1: Find CHR AMI

Search for "MikroTik" in the AWS Marketplace, or launch from the MikroTik community AMI. Alternatively, upload the raw image to S3 and import as an AMI.

Step 2: Launch EC2 Instance

• Instance type: t3.micro (free tier) for testing, c5.large for production.
• Security group: Allow SSH (22), WinBox (8291), and any VPN ports you need.
• Key pair: Use EC2 key pair or set password via serial console.

Step 3: Access

ssh admin@<ec2-public-ip>

Configure WAN IP, routes, and your VPN/firewall as with any MikroTik router.

Cloud Deployment: Google Cloud (GCP)

1. Upload the raw CHR image to a GCP bucket.
2. Create an image from the uploaded file.
3. Launch a VM instance using the image.
4. Allow necessary firewall ports in VPC rules.

Cloud VPN Hub Setup

A common CHR use case: cloud-based VPN concentrator for remote offices.

# On CHR (cloud):
/interface wireguard add name=wg0 listen-port=51820
/ip address add address=10.99.0.1/24 interface=wg0

# Add peer for each office
/interface wireguard peers add interface=wg0 public-key="OfficePublicKey..." allowed-address=10.99.0.2/32,192.168.1.0/24 endpoint-address=office.example.com endpoint-port=51820

# Firewall
/ip firewall filter add chain=input protocol=udp dst-port=51820 action=accept comment="WireGuard"
/ip firewall nat add chain=srcnat src-address=10.99.0.0/24 action=masquerade

See our hub-and-spoke WireGuard guide for the full multi-site configuration.

Licensing Your CHR

# Check current license
/system license print

# Request a trial (60-day unlimited)
/system license renew

# Apply a purchased license
/system license set key="YOUR-LICENSE-KEY"

Purchase licenses from mikrotik.com. CHR licenses are tied to the VM's system ID – if you recreate the VM, you may need a new license.

Performance Tuning

• CPU cores: CHR supports multi-core. Assign 2-4 vCPUs for production. RouterOS uses one core per fastpath connection.
• Memory: 256 MB minimum, 1 GB recommended for production with large routing tables or many VPN tunnels.
• Disk: The default image is ~128 MB. Expand if you need logging, containers, or caching.
• Network: Use virtio NIC drivers for best performance. Avoid legacy e1000 on production.
• Disable unnecessary packages: /system package disable wireless – CHR has no wireless, disable the package to save resources.

CHR + MikroRadius

Run CHR alongside MikroRadius on the same VM host or cloud instance. The CHR handles routing, VPN, and PPPoE, while MikroRadius on a separate VM manages users, billing, and accounting. Both communicate via RADIUS on the internal network.

Troubleshooting

• 1 Mbps speed limit: You're on the free license. Purchase a P1/P10/P-Unlimited license or start a 60-day trial.
• Can't access after boot: CHR gets its IP via DHCP on ether1 by default. Check your hypervisor's DHCP or set a static IP via the console.
• No internet from CHR: Verify the VM's network adapter is connected to a bridge/switch that has internet access. Check routes: /ip route print.
• License lost after VM migration: CHR licenses are tied to the system ID. If the VM hardware (UUID) changes, contact MikroTik support for license transfer.
• Poor performance: Use virtio NIC drivers, assign more vCPUs, and ensure the hypervisor host isn't overloaded.

Conclusion

CHR brings MikroTik RouterOS to any virtualization platform – from a VirtualBox lab on your laptop to a production VPN concentrator on AWS. The free license is perfect for learning and testing, and paid licenses are among the most affordable in the networking industry.

Deploy CHR in the cloud as a VPN hub, use it for lab testing before pushing configs to physical routers, or run it as a production router on server-grade hardware. The full RouterOS feature set is available – everything from firewall to OSPF to containers.