MikroTik GeoIP: Manage GeoIP And GeoSite

A Complete Guide to Installing, Configuring, and Managing GeoIP and GeoSite Address Lists on MikroTik RouterOS

Meta Title: Mikro GeoIP v1.4 – Manage GeoIP & GeoSite on MikroTik

Meta Description: Learn how to install Mikro GeoIP v1.4 on MikroTik RouterOS, manage GeoIP and GeoSite datasets, automate address list updates, and configure secure REST API access.

Suggested URL Slug: mikro-geoip-geosite-mikrotik-routeros

Introduction

Managing country-specific IP addresses and service-based network lists across multiple MikroTik firewall rules can quickly become a time-consuming task.

Network administrators need to keep source databases updated, import new records, remove outdated entries, and ensure that their firewall address lists remain consistent.

Mikro GeoIP simplifies this process by providing a web-based management interface that connects directly to MikroTik RouterOS through its REST API.

The application runs inside a RouterOS container and imports selected GeoIP and GeoSite data into MikroTik address lists.

Once these lists are created, administrators can use them in firewall policies, routing configurations, and other network management scenarios.

Important: Mikro GeoIP does not automatically modify internet routing or traffic policies. It manages address lists, while the administrator remains responsible for implementing the appropriate firewall and routing rules.

What Is the Difference Between GeoIP and GeoSite?

Although GeoIP and GeoSite are often used together, they serve different purposes.

GeoIP

GeoIP datasets contain IP addresses and CIDR network ranges grouped by country or service.

These datasets are useful when administrators need to create firewall rules or routing policies based on IP ranges associated with a specific country or service.

GeoSite

GeoSite datasets contain domain-related rules, which may include:

Hostnames
Root domains
Regular expressions
Keywords

Unlike GeoIP, GeoSite focuses on domain-based information rather than directly mapping individual IP addresses.

Mikro GeoIP can read compatible DAT files and display their available categories in its management interface.

However, when converting GeoSite information for MikroTik, only domain entries suitable for the router’s DNS-based processing are used.

Complete compatibility with Xray domain-matching behavior, regular expressions, and every possible subdomain is not guaranteed.

GeoIP data should also not be interpreted as a definitive method of determining a user’s physical location.

Key Features of Mikro GeoIP v1.4

Mikro GeoIP provides the following capabilities:

Bilingual web interface supporting English and Persian, with browser-based language preference retention
Independent GeoIP and GeoSite dataset management
Download, manual upload, and cache removal functionality
File status, size, successful download time, and operation history
Searchable country and service catalogs
Custom MikroTik address list names
Batch insertion and removal of address list records
Automatic update intervals configurable from 1 to 365 days
REST API integration with MikroTik RouterOS
Persistent storage for application configuration and cached datasets

These features allow administrators to centrally manage large address lists without repeatedly importing individual records manually.

Requirements for Installing Mikro GeoIP on RouterOS

Before installing the application, make sure the MikroTik device supports RouterOS containers.

The following requirements must be satisfied:

A RouterOS version and hardware platform that support containers
The RouterOS container package installed
Container functionality enabled through RouterOS Device Mode
Sufficient storage for the container image, extracted files, database, and DAT datasets
A functional LAN and internet connection
A properly configured VETH interface and container network
Persistent storage for application data

The prebuilt container image referenced in this guide targets ARMv7.

Devices with other CPU architectures require a compatible image built for their respective platforms.

The compressed installation file size is not equal to the final storage requirement. Keeping multiple DAT files and replacing them during updates may require considerably more space.

Step 1: Verify RouterOS and Install the Container Package

First, check the router’s architecture, installed packages, and Device Mode configuration.

Run these commands in the MikroTik terminal:

/system resource print
/system package print
/system device-mode print

If the container package is not installed, download the appropriate package from the official MikroTik Extra Packages distribution.

The downloaded NPK package must match both the RouterOS version and the hardware architecture.

Upload the package through Winbox under Files, then perform a normal router reboot to complete the package installation.

Enable Container Support

If the container feature is disabled, run:

/system device-mode update container=yes

RouterOS requires physical confirmation of this security-sensitive change.

Depending on the device, confirmation may involve power cycling or another supported physical procedure within the specified confirmation period.

A normal /system reboot command does not replace the required physical confirmation.

After the router starts again, verify that Device Mode reports container: yes.

If container functionality is already enabled, this step is unnecessary.

Step 2: Prepare the Container Network and Persistent Storage

Mikro GeoIP requires a VETH interface with a dedicated IP address and gateway.

The interface must be connected to an appropriate bridge so the container can communicate with the router and authorized management devices.

When configuring the network:

Avoid subnet overlap with existing LANs, VPNs, or tunnels.
Ensure outbound connectivity is available for dataset downloads.
Allow administrative access to the web interface from trusted LAN devices.
Permit the container to communicate with the RouterOS REST API.
Configure firewall and NAT rules according to the existing network topology.

A public port-forwarding rule is not required for installation.

Persistent Data Storage

The container should use a dedicated persistent directory for its database, credentials, downloaded files, and application configuration.

This storage must remain available when the container image is upgraded or replaced.

Removing the application data directory may permanently delete configuration and locally stored data.

Step 3: Import the Mikro GeoIP Container Image

Before importing the image, prepare the container’s persistent data mount and environment configuration.

The application requires these environment variables:

ADMIN_USER=your-admin-username
ADMIN_PASSWORD=your-secure-password

Use a unique initial password containing at least 12 characters.

Download the installation ZIP package on your computer and extract it to obtain the ARMv7 container archive.

Upload the container archive to the router’s Files section.

RouterOS will handle extraction of the container image.

For a router where the VETH interface, mounts, and environment list have already been configured, the example command is:

/container add name=geoip-panel \
    file=mikro-geoip-rb4011-armv7-v1.4.tar.gz \
    interface=veth-mgeo \
    root-dir=mgeo-root-v14 \
    mountlists=mgeo-data \
    envlists=mgeo-env \
    dns=1.1.1.1 \
    logging=yes \
    start-on-boot=no

Note: This is not a standalone installation command for an unconfigured router. The referenced interface, mount list, and environment list must exist beforehand.

Start the Container

Allow RouterOS to complete the image extraction process.

Once the container reaches the STOPPED state, start it:

/container start [find where name="geoip-panel"]

Check its status:

/container print detail where name="geoip-panel"

To review application logs:

/log print where message~"geoip-panel"

The expected operational state is RUNNING.

If the container stops unexpectedly, inspect the logs before attempting to restart it.

Enable Automatic Startup

Once the application has been tested successfully, enable automatic startup:

/container set [find where name="geoip-panel"] start-on-boot=yes

This setting starts the container automatically when the router boots.

It does not replace backups or persistent storage.

Step 4: Connect Mikro GeoIP to RouterOS

The application web interface listens on port 8080 by default.

Open the following URL using the container’s actual IP address:

http://CONTAINER_IP:8080

Configure REST API Access

Create a dedicated RouterOS user for the application rather than reusing a personal administrator account.

The account requires the appropriate permissions, including:

read
write
api
rest-api

Configure the router’s REST endpoint and enter the corresponding connection information in Mikro GeoIP.

Depending on the deployment, RouterOS REST access uses the www or www-ssl service.

Ensure the router’s IP services and firewall rules allow communication from the container.

Security Recommendations

For permanent deployments, use HTTPS with a trusted certificate or an internally trusted certificate authority.

Plain HTTP should only be considered within an isolated, trusted management network.

Do not expose the administration interface directly to the public internet. External management should use an appropriately secured management connection.

Step 5: Manage GeoIP and GeoSite Source Files

Mikro GeoIP v1.4 separates dataset management from address list selection.

This design helps administrators maintain independent GeoIP and GeoSite sources without repeatedly changing download links while selecting categories.

Source File Management

The GeoIP and GeoSite source sections independently provide:

HTTPS download URL configuration
Dataset download or refresh
Manual DAT file upload
Cached dataset removal
Dataset information and recent activity

The default download links use the public Chocolate4U data source.

If the upstream project changes its distribution URLs, administrators can update the source addresses.

Updated addresses are retained after a successful download or upload operation.

Manual Upload for Restricted Networks

If the router cannot directly reach GitHub or the configured source, the datasets can be downloaded using another computer.

Upload the original files through the web interface:

geoip.dat
geosite.dat

The application validates the file structure and available storage before accepting the upload.

GeoIP and GeoSite must be provided separately.

Having a valid GeoIP file does not mean that GeoSite data is also available.

Understanding Dataset Status

The displayed download timestamp represents when the file was obtained by the router.

It does not necessarily represent the original publication date of the upstream dataset.

Recent activity records identify download attempts, successes, failures, and file removal operations.

Manually uploaded files remain available until explicitly replaced or refreshed.

Step 6: Create MikroTik Address Lists

After importing the necessary datasets, open the selection section of the Mikro GeoIP interface.

Choose either GeoIP or GeoSite.

Search the catalog for a country or service category.

For example, you can search for:

youtube

when using the GeoSite catalog.

After selecting a category:

Enter a unique MikroTik address list name.
Save the selected source configuration.
Use the Add action to import the corresponding records.
Verify the resulting entries on the router.

Why Unique Address List Names Matter

Existing address lists with the same name may contain records originating from another application or manual configuration.

Mikro GeoIP does not automatically claim ownership of unrelated records.

Conflicting entries in a previously created list may prevent the operation from completing.

The interface also provides a way to inspect the actual entries associated with an address list on RouterOS.

GeoSite Coverage Limitations

Selecting a GeoSite category does not guarantee full coverage of a service.

Services such as YouTube may use multiple domains, dynamic infrastructure, content delivery networks, and different traffic distribution mechanisms.

As a result, importing a GeoSite category should not be considered equivalent to identifying every IP address or domain used by that service.

Step 7: Configure Automatic Updates

Mikro GeoIP supports automatic update intervals between 1 and 365 days.

The default interval is 7 days.

The update process is handled inside the application container.

A separate RouterOS Scheduler configuration is not required.

However, successful updates depend on:

The container remaining operational
The required datasets being available
Network access to configured download sources when refreshing files
Adequate storage and system resources

Performance Considerations

Mikro GeoIP uses batch operations to reduce the number of REST API round trips.

Each batch contains up to 200 commands and is also constrained by the permitted script size.

Although requests are batched, the router still processes the underlying operations sequentially.

Very large address lists can therefore consume considerable execution time and RAM.

Administrators should monitor resource utilization when importing large datasets, especially on routers with limited hardware resources.

Removing Dataset Files vs. Removing Address Lists

Two different removal operations are available, and their effects should not be confused.

Removing a DAT File

Deleting a GeoIP or GeoSite DAT file removes the locally cached dataset and releases storage.

It does not automatically remove existing MikroTik address list entries.

Removing a Managed Source from the Router

Removing a managed source deletes its managed address list records and stops automatic updates for that source.

Removing Individual Entries

If an individual address list entry is deleted manually while it remains part of the selected source dataset, a future update may recreate that entry.

For permanent exclusions, the source configuration and update behavior must be considered.

Troubleshooting Common Problems

Insufficient Storage

If the router reports insufficient storage, inspect the following:

Installation archives
Old container root directories
Cached datasets
Available free space

Do not delete the application database simply to reclaim space.

Dataset Download Failures

Check DNS resolution, internet connectivity, TLS connectivity, source URL availability, and free storage.

Web Interface Is Not Accessible

Verify that:

The container is running.
Port 8080 is reachable.
The management device has a valid network route.
LAN firewall and forward rules allow access.

RouterOS REST API Connection Errors

Verify the configured URL, service availability, credentials, user permissions, and firewall restrictions.

Upgrading Mikro GeoIP Safely

When upgrading to a newer release:

Back up the application database and configuration.
Preserve the persistent data directory.
Prepare the new container image.
Attach the existing data storage to the new version.
Validate application functionality.
Retain a rollback option until the upgrade has been confirmed.

Do not run two instances of the application against the same writable data directory simultaneously.

Database backups and essential network configuration backups should be stored outside the MikroTik device.

Using Address Lists in Firewall and Routing Policies

Once Mikro GeoIP has populated the relevant MikroTik address lists, those lists can be referenced in firewall and routing configurations.

The exact implementation depends on the network topology, tunnel configuration, security requirements, and firewall rule order.

Mikro GeoIP provides the underlying address list management functionality. Policy design and traffic handling remain the administrator’s responsibility.

For a production deployment, follow the complete version 1.4 technical installation guide and use a container image compatible with the target router architecture.

Conclusion

Mikro GeoIP v1.4 provides a centralized approach to managing GeoIP and GeoSite datasets on MikroTik RouterOS.

By combining a web interface, REST API integration, independent dataset management, and scheduled updates, it reduces the repetitive work associated with maintaining address lists.

For network administrators managing geographic or service-based firewall policies, Mikro GeoIP offers a practical method for keeping those lists organized and updated while retaining control over the router’s actual traffic policies.

Official References

mikro-geoip-v1 Download

Managing GeoIP and GeoSite on MikroTik with Mikro GeoIP v1.4