How to Install and Configure MikroTik CHR on Proxmox VE for Your Network Lab

Table of Contents

Virtual Router Options for Proxmox VE: Comparing the Common Approaches

When engineering an isolated staging environment or home lab on Proxmox Virtual Environment (PVE), choosing the right routing software sets the foundation for your virtual topologies. In production and lab clusters alike, you generally run into three main virtualization approaches:

Software Linux bridges with raw iptables/nftables: Highly flexible and native to the host kernel, but difficult to maintain as firewall policies, routing tables, and VLANs scale up.
FreeBSD-based firewalls (pfSense / OPNsense): Excellent stateful inspection, intuitive WebGUI, and solid community support. However, they lean heavily toward security appliance paradigms rather than dynamic carrier-grade routing and ISP-style lab simulations.
MikroTik Cloud Hosted Router (CHR): A purpose-built RouterOS version tailored directly for hypervisors (KVM, Proxmox, VMware, Hyper-V). It gives you true L3 switching control, policy routing, MPLS, OSPF, BGP, WireGuard, and CAPsMAN inside a minimal resource footprint.

Side-by-Side Comparison

Here is how these common lab approaches stack up when hosted on Proxmox:

Feature / Metric	Linux Bridges + IPTables	pfSense / OPNsense	MikroTik CHR
Memory Requirement	Host native (~0 MB added)	1024 MB – 2048 MB	128 MB – 256 MB
Storage Footprint	None (uses host)	8 GB – 20 GB	1 GB – 2 GB (RAW disk image)
Boot Time	Instant	45 – 90 seconds	3 – 5 seconds
Routing Protocol Depth	Requires FRR or Bird	Basic BGP/OSPF via plugins	Native RouterOS core (BGP, OSPF, MPLS, VPLS)
Management UI	Bash / Systemd	Web Browser	WinBox GUI, WebFig, SSH, API

Pros and Cons of Running MikroTik CHR on Proxmox

Deploying a virtualized router inside your hypervisor comes with architectural trade-offs that are worth analyzing before building your entire virtual network on top of it.

The Advantages

Ultra-lightweight resource footprint: RouterOS CHR needs only a single virtual CPU and 128 MB to 256 MB of RAM to route packets at gigabit speeds within virtual networks.
Native WinBox management: The WinBox desktop utility provides real-time traffic graphs, instantaneous packet sniffing, and safe configuration modes without browser caching lags.
Generous free tier: The free CHR license gives you every enterprise software feature unlimited by expiration dates, capped only at 1 Mbps per interface. That bandwidth restriction is more than enough for testing routing protocols, access lists, and VPN tunnels before purchasing an inexpensive P1 perpetual license.
Hardware-independent backups: Snapshots and disk exports inside Proxmox make rollback effortless before applying major RouterOS updates.

The Disadvantages

Hypervisor dependency: If your Proxmox node reboots or loses power, your entire routing infrastructure goes offline unless you run a redundant high-availability cluster.
1 Mbps rate-limit on default trial: Running full lab speed tests requires either a 60-day trial registration or an affordable license tier.
KVM image onboarding curve: MikroTik does not publish an official Proxmox ISO installer; deployment requires importing a raw disk image via the PVE command line.

Recommended Architecture for a Proxmox Network Lab

In my real-world experience, this is one of the essential skills to master when designing reproducible staging environments. Rather than bridging every virtual machine directly to your home LAN, the ideal architecture uses MikroTik CHR as the perimeter router between your physical network and internal private bridges.

Here is the architectural pattern that delivers maximum isolation and flexibility:

WAN Interface (vmbr0): Connected to your physical network interface (`eth0` or `eno1`). CHR pulls an IP via DHCP from your home router or upstream gateway.
LAN / Isolated Lab Bridge (vmbr1): An internal, non-bridged virtual interface created inside Proxmox without an assigned physical network port. All lab virtual machines and containers attach to this bridge.
Management / DMZ Bridge (vmbr2, Optional): A separate bridge reserved for testing outward-facing reverse proxies and isolated workloads.

By routing everything through CHR, you can enforce strict firewall filter rules, inspect lab traffic, and simulate WAN outages without disrupting anything on your local physical network.

Step-by-Step Implementation Guide

Let’s run through provisioning the virtual machine on Proxmox and configuring the baseline network on RouterOS.

Step 1: Create the Isolated Proxmox Bridge

First, verify that your Proxmox host has an internal virtual bridge that is not tied to any physical Ethernet port. You can inspect your existing network settings via CLI:

cat /etc/network/interfaces

If you do not have a dedicated internal bridge yet, add `vmbr1` by appending the following snippet to /etc/network/interfaces:

auto vmbr1
iface vmbr1 inet manual
        bridge-ports none
        bridge-stp off
        bridge-fd 0
# Virtual Internal Lab Bridge

Apply the change immediately without restarting the host:

ifreload -a

Step 2: Download and Extract the MikroTik CHR Disk Image

Connect to your Proxmox server via SSH. Navigate to a temporary folder and download the raw disk image from MikroTik’s software repository. RouterOS v7 is the current stable branch:

cd /tmp
wget https://download.mikrotik.com/routeros/7.16.1/chr-7.16.1.img.zip

# Unzip the raw disk image
apt-get install -y unzip
unzip chr-7.16.1.img.zip

Step 3: Create the Virtual Machine Wrapper

We will provision an empty VM shell using the qm utility. In this example, we use VM ID 900:

qm create 900 \
  --name "MikroTik-CHR" \
  --memory 256 \
  --cores 1 \
  --cpu host \
  --net0 virtio,bridge=vmbr0 \
  --net1 virtio,bridge=vmbr1 \
  --ostype other \
  --onboot 1 \
  --boot order=scsi0

Step 4: Import the Disk Image and Attach It to the VM

Import the unzipped image directly into your target Proxmox storage pool (replace local-lvm with local-zfs or ceph depending on your storage backend):

qm importdisk 900 chr-7.16.1.img local-lvm

Once the disk is imported, attach it to SCSI controller 0 using VirtIO SCSI:

qm set 900 --scsihw virtio-scsi-pci --scsi0 local-lvm:vm-900-disk-0

Remove the downloaded installer files to keep the storage clean:

rm -f /tmp/chr-7.16.1.img /tmp/chr-7.16.1.img.zip

Step 5: Boot the Router and Perform Initial Setup

Start the virtual router from the Proxmox CLI:

qm start 900

Open the Proxmox Web UI console for VM 900. Log in with the default credentials:

Login: admin
Password: (press Enter, there is no password by default)

When prompted to view the license agreement, press n, then assign a secure administrative password when prompted.

Step 6: Configure Interfaces, Addressing, and NAT Masquerade

Run these initial RouterOS commands inside the console to name your interfaces clearly, assign an internal gateway IP, and enable Internet access for lab machines:

# 1. Rename interfaces for clarity
/interface set ether1 name=ether1-WAN
/interface set ether2 name=ether2-LAN

# 2. Configure DHCP Client on WAN
/ip dhcp-client add interface=ether1-WAN disabled=no

# 3. Assign static gateway address to the internal lab bridge
/ip address add address=10.10.10.1/24 interface=ether2-LAN

# 4. Create an internal DHCP pool and server for lab clients
/ip pool add name=lab-pool ranges=10.10.10.50-10.10.10.200
/ip dhcp-server add name=lab-dhcp interface=ether2-LAN address-pool=lab-pool disabled=no
/ip dhcp-server network add address=10.10.10.0/24 gateway=10.10.10.1 dns-server=1.1.1.1,8.8.8.8

# 5. Enable Source NAT (Masquerade) so lab VMs can reach the internet
/ip firewall nat add chain=srcnat out-interface=ether1-WAN action=masquerade

# 6. Enable DNS caching for internal lookups
/ip dns set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8

Step 7: Verify Outbound Connectivity

Test that RouterOS is communicating properly with upstream networks by running a quick ping directly from the CLI:

/ping 1.1.1.1 count=4

Any new virtual machine or LXC container attached to vmbr1 will now receive an IP in the 10.10.10.0/24 subnet automatically, routed through your virtual MikroTik router with full firewall isolation from your local physical environment.