fibyr.ph
For ISPs - Router setup

Connect your MikroTik router to fibyr.ph

fibyr.ph creates and switches subscriber PPPoE accounts on your router for you. First it needs a way to reach the router - here are the two ways, and the exact steps for each.

Secure tunnel Recommended

fibyr.ph generates a setup block you paste once. Your router dials out, so it works behind NAT or on a changing IP — no port-forwarding, nothing exposed to the internet.

Direct Public IP / DDNS

For a router already reachable at a public address or a MikroTik IP-Cloud hostname. You point fibyr.ph straight at it over API-SSL.

Not sure which? Pick Secure tunnel. It's the least setup and works on almost any connection. Everything below is done from your MikroTik and the fibyr.ph Router page (sidebar → Operations → Router).

Option A · Secure tunnel (recommended)

fibyr.ph does the hard part — it generates the keys, an address, and a ready-to-paste config. You paste it into the router once.

  1. Add the router as a tunnel
    On the Router page, under "How should fibyr.ph reach this router?" choose Secure tunnel, then enter:
    • Name — any label, e.g. "Core router".
    • API username & password — make one up. fibyr.ph creates this exact login on your router for you in the pasted block.
    Press Save router. fibyr.ph assigns your router a private address and shows a setup block.
  2. Copy the generated block
    A panel titled "Paste this into your MikroTik once" appears with a Copy the block button. It looks like this (your real values filled in):
    what it looks like — you get your real block above once you Generate
    /interface/wireguard/add name=wg-fibyr private-key="PRIVATE-KEY-FROM-FIBYR"
/interface/wireguard/peers/add interface=wg-fibyr public-key="PUBLIC-KEY-FROM-FIBYR" \
    endpoint-address=SERVER-ADDRESS-FROM-FIBYR endpoint-port=51820 allowed-address=10.66.0.0/16 persistent-keepalive=25s
/ip/address/add address=YOUR-TUNNEL-IP-FROM-FIBYR/16 interface=wg-fibyr
/user/add name="YOUR-API-USERNAME" password="YOUR-API-PASSWORD" group=full comment="fibyr API"
/ip/service/set api address=10.66.0.0/16
/ip/firewall/filter/add chain=input in-interface=wg-fibyr action=accept place-before=0 comment="fibyr tunnel"
  3. Paste it into the router — once
    Open your router's terminal (WinBox → New Terminal, or SSH) and paste the whole block, then press Enter. It sets up the tunnel, the fibyr.ph API login, and the firewall in one go. Nothing to configure by hand.
  4. Test the connection
    Back in fibyr.ph, press Test connection. Within a few seconds it should read "Connected to '…'" — the tunnel is up and fibyr.ph logged in over it.
  5. Import & go live
    Moving from another system? Hit Import subscribers to pull your existing PPPoE accounts into fibyr.ph — their connections aren't touched. When you're ready for fibyr.ph to manage the router, tick Active (and stop any old app that was managing it, so only one system is ever in control).
Why this is safe. Your router opens the connection outward, so it works from behind NAT and on a dynamic IP with no port-forwarding — and your router's API is never exposed to the internet, only reachable inside the encrypted tunnel.

Option B · Direct (public IP / DDNS)

Use this only if your router already has a reachable public address.

  1. Prepare the router
    On your MikroTik:
    • Enable the API service and create a dedicated API user (not admin).
    • On a dynamic public IP? Turn on MikroTik IP Cloud for a stable xxxx.sn.mynetname.net hostname.
    • Firewall the API to fibyr.ph's address only — never leave it open to the whole internet.
  2. Add it in fibyr.ph as Direct
    Choose Direct, then enter the Host (your public IP or the IP-Cloud hostname), switch on API-SSL, and the API username / password. Save.
  3. Test the connection
    Press Test connection. If it times out, the API firewall rule or the hostname is the first thing to check.

Troubleshooting

Test connection times out on a tunnel router
Check the paste block ran without a red error, and that persistent-keepalive=25s is present on the WireGuard peer (it's baked into the block — it's what keeps the tunnel reachable through NAT). If you edited the peer, re-add it.
It connects, then stops working a minute later
Classic missing keepalive — your router's NAT mapping closed. The generated block includes persistent-keepalive=25s; make sure it's still on the peer.
WinBox says "The address is not available"
That's your router having no usable IP on the port you're plugged into — unrelated to fibyr.ph. Connect to the router by its MAC address in WinBox's neighbour list, give it an IP, then continue.
Do I need a static IP or to open ports?
Not for the Secure tunnel — that's the whole point. Your router dials out, so a dynamic IP behind NAT is fine and no port-forwarding is needed. A static/public IP is only relevant for the Direct option.

Discussion

Questions or tips about connecting your router? Everyone can read along.

No comments yet - be the first to start the conversation.