MikroTik

Since v5.4 we have a new feature in Webfig - "Design Skin". Click this button to make changes to the Webfig interface. This is perfect to remove unnecessary features for RouterOS users who don't want to see them, to make it easier to find what is needed to this specific user, or to hide things he could "break". Also great for translating the entire interface!

How to make a skin

Log into Webfig: Click "Design skin" button: You can now uncheck any element to hide it, you can rename any element or translate it: You can also add limits to text fields, add notes or make fields read-only: Once you SAVE the skin with a new name, and exit the Design mode, you will see the changes: Go back to full skin mode with the Design Skin button, and go to the System Users menu to assign this skin to a specific user group (probably make a new group). To hide the "Design skin" button from this group, uncheck the "policy" checkbox: Once again, this is not a security measure, as skilled users will be able to overcome these applied limitations.

Is there a way to delete unnecessary skin?

Cheers

Is there a way to delete unnecessary skin?

Cheers

skins are stored as files in /skins with the <skin name>.json

Just delete the file.

You can also download the file, edit it using a text editor and upload it back to the router.
This makes creating skins and cloning RB's easier.

Wy dont you make the check/uncheck options to winbox? !

Wy dont you make the check/uncheck options to winbox? !

Yes, I fully second this!
I want a browser independent management program for ros. But winbox could definately have more edit functionality...

One of the MT-ros advantages over ubnt-ros is the fact that no matter if my browser is crashed, not loading or whatever, I can still reach my unit with a gui.
I can even prioritize my gui (winbox) in my network. With http for only management this becomes much more complicated.

MT, don't copy too much from ubnt. The groove is a very good idea, but their html management gui sucks imho.

Agreed, MT do so much so well; please keep doing THAT

Wy dont you make the check/uncheck options to winbox? !

Yes, I fully second this!
I want a browser independent management program for ros. But winbox could definately have more edit functionality...

One of the MT-ros advantages over ubnt-ros is the fact that no matter if my browser is crashed, not loading or whatever, I can still reach my unit with a gui.
I can even prioritize my gui (winbox) in my network. With http for only management this becomes much more complicated.

MT, don't copy too much from ubnt. The groove is a very good idea, but their html management gui sucks imho.

before webfig everyone asked for an OS independent interface. now it's backwards again

before webfig everyone asked for an OS independent interface. now it's backwards again

No, I never asked for it. And me, but also some others, have been asking for winbox improvements since the day 2.xx versions where in use.
I also explained why html/port 80 solutions is not preferred. Having its own tcp port and program is one of the big advantages of winbox above browser based solution.
For security I actually disable any port 80 access to routers anyway. Or every kid will be tempted to get into my routers. Only for the challenge and than ruin it if they succeed. Using winbox is just another step away for the `accidental`intruder.

Also, by using browser based solutions suddenly the browser maker, or the way it is installed on your PC, has influence on how your management console performs. We all know of all the problems that come with browsers.... html, activeX, cookies, history, regular updates, safety flaws, add-ons, spy ware, agents... do I need to go on? All possible problem sources.
A serious management program is browser independent, not OS independent. I hate browsers for configuration tools. Winbox just has a port and tcp protocol. KISS (Keep it simple and Stupid) but make it a complete tool box.

I think you may be alone on this one, as OS independent solution was one of the top requested features since we introduced Winbox.

webfig works on all browsers that support standard javascript. So every single platform there is that has working browser with javascript is working (at least that is our goal). So you can use simple netbook running linux, your smartphone no matter what.

And for me - security usually comes with firewall configuration not with some external application.

Oh, and there is universal CLI (ssh or telnet)

well, I am sure I am not the only one preferring winbox above all other, with CLI in case winbox won't work.
But no use to fight it over, as long as you guys also try to improve winbox and don't let it become a ´forgotten child´ I don't mind what else you'd develop.

Started to play with webfig. I`ll guess I have to if winbox isn't improved much...

Anyway, don`t know if this is the place to mention possible bugs, but I think I found one in webfig:

Interface graphs in IE8 not showing traffic. In Firefox not a problem...
routerboard runs v5.5.

webfig is mainly tested on mozilla firefox and google chrome. There might be some quirks with IE as it lacks features in some areas (eg. standard support)

well, I am sure I am not the only one preferring winbox above all other, with CLI in case winbox won't work.

I also prefer Winbox and the command line via ssh or a terminal session.

and then you just take your phone or some electronic pad, fire up the browser and set up the router.

Same applies if some firewall nazi has cut off everything but port 80, just log in webfig and configure away. And since winbox has "new terminal" button it has made its appearance in webfig too - terminal in browser window.

We've all loved winbox, I'm sure. But being windows only was a problem.

I believe we started asking for iPhone, Android apps and a linux version of winbox, it was Mikrotik who answered us and said "No, we're not doing any of those, we'll do a cross browser/os web interface, that will work almost anywhere".

Fair enough, it does cut down development, no question.

No one said we didn't still want winbox, in fact, only thing I feel it really needs is to be able to re-order columns!

I hope both continue and see improvements as time goes on.

webfig is mainly tested on mozilla firefox and google chrome. There might be some quirks with IE as it lacks features in some areas (eg. standard support)

This concerns me, while IE is continously bashed for it's lack of standards, security flaws, you can't escape that it's on (almost) every Windows PC out there, and if there are "firewall nazis" there are certainly workstation equivalents that don't want programs installed without authorisation, including web browsers.

I'm all for Firefox, Chrome, Safari, Opera, in fact I frequently float between all of them, depending on which of their current versions are best at small memory foot print and not leaking (I find it varies enormously which is best, depending on the version), however IE's market share shouldn't be ignored and I would hope Mikrotik and other companies test their web interfaces with it as much as they do other browsers, and if it needs modification to work/display properly, then that's included.

We have no plan to discontinue Winbox. Both interfaces will coexist.

We have no plan to discontinue Winbox. Both interfaces will coexist.

Normis, Good Answer !!
With that in mind, can you have the WinBox configuration stored as a file much like a skin too?
Copying that file to different devices would be a lot easier than re-doing the layout each time.

Hope to be in LAS (October)

Hi all, is posible to use Webfig on iphone?, i tried but authentication fails , i'm using ROs 5.5 and Iphone 4 . Any help will be apreciated.
Dimas

Hi all, is posible to use Webfig on iphone?, i tried but authentication fails , i'm using ROs 5.5 and Iphone 4 . Any help will be apreciated.
Dimas

We just tested v5.5 and iPhone and it works great. Also Android works too.

yes, i goit it, authentication has to be entered twice, Thankyou.

Dimas

Same here, interface graphs in IE9 are not showing traffic.Kinda annoying since I am always curious to monitor the bandwith usage.

we will get to "works with IE" hacking. For now there are still some dents that has to be ironed out. At the moment best results you will have with Firefox.

all routers that I have access to, work fine with any IE version, including IE9

It looked to me that the graphs and Tx/Rx metrics on the 'Interface' page stopped refreshing after I had navigated away from the interface page that contains the graphs.

I have restarted my workstation over the weekend and upgraded to 5.6 and since then I am not able to replicate this issue on IE9, which makes me a big fan of the webfig.

Thanks.

If you haven't tried WebFig lately, please give it a try before posting here, I think you will be impressed. This is a great step forward and the Design Skin gives you the ability to customize or "dumb down" the UI for your customers. I think this is what we have asked for and it works very well. I am adding it to my MTCNA curriculum.

If you haven't tried WebFig lately, please give it a try before posting here, I think you will be impressed. This is a great step forward and the Design Skin gives you the ability to customize or "dumb down" the UI for your customers. I think this is what we have asked for and it works very well. I am adding it to my MTCNA curriculum.

That's great! Thanks, Steve.

just wanted to throw my two cents in. I am very glad to see webfig. I use a MacBook and a motorola xoom and it works great with them. I use links from other programs to access routers and again works very well. Thanks guys for getting this going.

RouterOS 5.7 adds new features to Webfig

• Add new tab and add new separator - you can add these anywhere in existing interface
  
  Status page - want fast and easy access to values you are monitoring most often all in one page, this is feature you should go for. Add all of them in one page and reorder for better overview on how router operates

Amazing... Webfig+Design+Policy control. Thanks MT guys. I will start to use webfig from today.

Hi,

Love webfig, however I would like to see the ability to disable the "disable eable buttons" particuarly in "interfaces" you can click the "D" to disable the interface, would like a read-only or remove option for those buttons, either for individual interfaces or as a whole.

If you click the interface the disable button there can be removed, made read only etc, would be nice to see that everywhere.

Once I had that I could actually give customers access to routers, as long as I know they cant disable interfaces, or anything for that matter, simple blanket read only.

Webfig is great improvement regarding multiplatfrom use. It looks good and works pretty much fine. I was afraid that Mikrotik will discontinue Winbox, but I am very glad to hear that this will not happen.

However, there are feq quirks:

a. Webig is narowly oriented to desktop or large screen platforms. It is not designed for small screeen mobile devices which is, probably, mostly needed. O really cannot understand how anyone can say that Webfig forks fine on small screen mobile device. Yes, technicaly, it works, but everything is so small, it is hard to click things, you have to scroll in all directions to get what you want... that is not good.

b. Webfig just simulates policies for access limitation for options. Mikrotik lacks proper user policies which should go below user interface. If I want to disable some function for a user I need it to be disabled as an policy, which reflects to user interface too, not just to hide option in web interface but leave access rights intact. Webfig skins just simulates policies and that is very dangerous. I do not want just to hide option from a user. I want to make sure he cannot use them.

well, if you red the docs carefully - it is not a security feature. It meant to make simplified interface. Like NV2 skin - wireless section only has options that can impact NV2 all the other options are left out.

Or user can translate interface, add notes

if you are worried about users changing something - give them only read rights - so no changes to configuration can be done.

Webfig and webfig design are very nice features . thanks

Hello,
Is there any way to hide "design skin" button for some user group? Because I have user group "operators", they need write and password permission to change some passwords, but they don`t need to change other settings. I already configured them custom skin, but if they click on button "design skin", they can see all other menus.

it is not a security feature. If you get the link and enter it, you can open any hidden page.

In this case you can go for API implementation of the interface, so that they only get interface that allows to do some certain things.

Thank you janisk.

can I change the webfig skin html and/or the html of login page (ex. add company logo) ?

can I change the webfig skin html and/or the html of login page (ex. add company logo) ?

you can change the login page with the branding package, which is available to resellers and distributors.

can I change the webfig skin html and/or the html of login page (ex. add company logo) ?

you can change the login page with the branding package, which is available to resellers and distributors.

thank you. So isnt there a way to change the webfig login, like I do with the hotspot login page?
can it will be a new feature request?

no there isn't

about security feastures

1.
do you plan to make webfig to have partial or full security for diferent type of users ?

2.
i try to block direct link in firewall on input chain ... in IE some link can be block ... but, in firefox, not

i can see that traffic are cript ... you probably what to hiden code, frmo some one who what to still for thay app.


posible solution are ...

1. full admin control over winbox
2. partial (full secure) operater control over webfig

for second i need to have posibility to block direct link like, maybe base on Content in firewall, and put this : webfig/#Wireless ... maybe you can make L7 rules for this link, and then we will used this medote ?
also i will remove wireless in skin , and if user try to open direcly firewall will block

is ther solution with L7 filter ?

do you somone have some solution to make webfig , security features ... with firewall , L7 or some script ... ?

btw,

mikrotik team ... you can make this ...

- status page to see by default (empty)

- user try to load direct link to Wireless

- webfig go to skin file, to see what are seting for wireless menu

- if wireless enable , open page normal

- if wireless disable do redirect on status page , or block with some other metode


if used redirect , one page need to be always present ... status can be this page.

hey ...

i create new gropu, and remove some menu with design skin ...

when i add this group to new user ... this user can load direct link to 'removed/hiden' menu option

but, when i add this group to admin user ... then admin can not load direct link to hiden menu option ?!

can some one comfirm this !

i work all night , and maybe i skipp some thing

webfig skins are not a security feature - it allows to tailor user interface to fit the user. it is still possible to access hidden pages.

webfig skins are not a security feature - it allows to tailor user interface to fit the user. it is still possible to access hidden pages.

i can not access to hiden pages ... why ?

check the link you are using, maybe there is some error. And as a result you cannot access the page. Also, check if you are logged in.

What's new in 5.17 (2012-May-28 12:34):

*) files - fixed problem when directories disappeared after reboot on usb or sd flash;
*) webfig - make QuickSet scan list work in Firefox v12;
*) webfig - fixed problem in QuickSet when changing country or channel-width in AP
mode would enable NV2 protocol;
*) webfig - fixed skins when hiding first tab may make other tabs inaccessible;
*) winbox - fixed packet raw data view in packet sniffer;
*) winbox - fixed problem when router could be DoS attacked through winbox port;
*) ports - add option "/port firmware ignore-directip-modem"
which will ignore modems ip interface
and modem's serial ports will be made accessible to users;
*) ipv6 pool - allow pools with prefix equal to prefix length;
*) ping times improved on Nv2 high data rate wireless links;
*) tool email - added starttls option;
*) snmp - allow multiple ip ranges for each community;
*) serial console - added channel support;


...

I have question !

why you dont what to make hiden page to be hiden , and to prevent direct link load ...

... obviously it can be done !!!

what is mistery about this ?!?!

@janisk

- user try to load direct link to Wireless

- webfig go to skin file, to see what are seting for wireless menu

- if wireless enable , open page normal

- if wireless disable do redirect on status page , or block with some other method

webfig skins are not a security feature - it allows to tailor user interface to fit the user. it is still possible to access hidden pages.

There is no problem with security, it's easy to create 'read-only' user group.
IMHO working direct links are bad idea, because we also want WebFig to hide some configuration details.
There is no need for end-user to see whole router configuration, only few selected status informations.
As marko_bg suggested, if page is disabled, status page shoud be displayed instead of direct-linked page.
Probably this feature request is not too hard to implement in WebFig.

Thanks in advance,

Is there anyway to remove or add the columns... like in winbox.

In particular, is there a way to add columns like "to-address" in nat and all other firewall columns?
Without them, webfig is not very useful for firewall.

I love webfig, I just wish it was skinned to look exactly like winbox.

Also, an upload feature would be cool.

hi,

I am running 5.16 on RB750GL boxes for some simple tasks.

I tried to disable ALL buttons in WebFig for the Read Only Group.

I left Tools: Netwatch

and

Logout


Works great except, from Logon...it shows IP Address' screen after logon...no matter what I do..

One click of the Tools Netwatch button , and it is gone , of course, and then cannot be accessed, .....

How can I make the first screen after logon go to the Screen I want it to, and not something that is disabled???

Confused. Is it the reseller package that adjusts this?

please update to newer version of RouterOS, if i am not mistaken we where working on this issue, that when skin disabled a page, it was loaded as default.

I want to ask something odd if this possible with Mikrotik CPE
I m sure almost every one have experience with UBQ CPE Nano Station Loco or Airmax or linksys
From remote site u can access in UBQ NStation/Linksys web witch is set to station(client) and than u can do Scan/Site Survey - Than Loco/Linksys will disconnect do the scan and
reconnect and will show u results (from scanning) in new tab

i want remove or add column in the wireless registration table, also i want to view inline comments, is's possible? thanks

me too need the option for add & remove columns.
Any plan for this in future...?

Have anyone any custom skin to share with other users?

I have found a major security glitch in the webfig. Basically I have user with read - write access but I only allow them to have access into the IP - Hotspot tabs and the tools, nothing else. I want them to be able to log users off and kick macs out of the host list. I do not allow them winbox or access to any of the vital information within the router.

When I log in with the username they only get what I want them to get. However there is a small tab called "Design Skin" where they can click on this, simply select the skin that they have credentials too and select any or all of the tabs, save the skin and BOOM, they now have access to everything. Is there a way around this? Can I set skins to read only or something.

Anyone else discover this yet?

@plankanater
Disable 'policy' permission for this user.

HTH,

according to http://wiki.mikrotik.com/wiki/Manual:Webfig#Skins,

It is not a security tool. If user has sufficient rights it is possible to access hidden features by other means.

@plankanater
Disable 'policy' permission for this user.

HTH,

Worked! Awesome, thanks.

Need to be able to set columns.

what I don't like about webfig is that it opens 8 connections to mikrotik while winbox only one. on the overloaded system/link webfig breaks a lot.

First post

Short story:
The default (full) skin is loaded instead of the custom one I made.

Longer story:
I have a 5.11 configured as Hotspot and is working fine for some time now.
The problem is that I want to give the local IT admin, who is not very much into "IT", a skinned mode username to only access the Hotspot section to add and delete users.

I created a trimmed skin with only the Hotspot section enabled. If I enable it, while being logged in as admin, it shows exactly what I want them to see and change.
They have their own user group and this group has read, write and web permissions only and the above skin assigned to it.

If I log in with their account, I can still see and change everything. What am I doing wrong?

Found the answer myself

its probably a bug in 5.11.
Upgraded (manually as auto upgrade is not implemented in 5.11) to 5.26 and everything works fine.

False alarm after all...

Hi MT guys, great work with webfig skins,

I had make a skin only to use bandwidth test, i tried to setup a default ip, user, password but i could not get it defined, when using that skin there are no details inserted.

Is there any way to define that fields and hide them, clients just click on start and stop to see speed.


Thank you.

P.s. Make new dude version ehehe.

I dont have any access to an MT right now, but all the fields that can be hidden (not ALL fields can be hidden) have a little drop-down style arrow in skin edit mode. If you see one by the field you want to hide, just click it and you can take it from there..

Hello There!

I have designed the Webfig skin as per the tutorial with removing unnecessary interfaces and leave few ones as per the user requirement, but when user login through web interface he still gets full featured wefig with all normal deign as before. Please any help will be gratefully appreciated. Thanks.

Did you try this?

Found the answer myself

its probably a bug in 5.11.
Upgraded (manually as auto upgrade is not implemented in 5.11) to 5.26 and everything works fine.

False alarm after all...

Did you try this?

Found the answer myself

its probably a bug in 5.11.
Upgraded (manually as auto upgrade is not implemented in 5.11) to 5.26 and everything works fine.

False alarm after all...

I am using this with 5.26, but still not working. Any further help please

Not sure I can help but if I were you I would clear the cache of my browser or try a browser I haven't visited webfig with before. Control+F5 is on my Firefox but other browsers may (will) have a different command. Similar effect is if you use "Incognito mode" or "Private browsing".
Please let me know if it worked.

Not sure I can help but if I were you I would clear the cache of my browser or try a browser I haven't visited webfig with before. Control+F5 is on my Firefox but other browsers may (will) have a different command. Similar effect is if you use "Incognito mode" or "Private browsing".
Please let me know if it worked.

Thanks for your suggestion, but i am sorry. I cleared the cache of my browser and try to open the winfig web browser and its still opening same normal winfig web browser and not specific designed one. I'm not getting why this is so? Any further help from anyone out there to fix this webfig skin designed issued?

The skin has to be assigned to user group of the user.

The skin has to be assigned to user group of the user.

Please refer to the attached screenshot. I have done the same as per the process, but nothing happened. Am i missing something to configure. Please any further assistance. Thanks.

Also these last two ones.


I have done the same as per the process, but nothing happened.

Hi. I already showed you how to do it: http://forum.mikrotik.com/viewtopic.php ... 96#p426596.
Try the newer version, i am not going to install 5.x and check if it is possible or how it is possible. Unfortunatelly the pictures are damaged in my tapatalk client - will look later.

Hi. I already showed you how to do it: http://forum.mikrotik.com/viewtopic.php ... 96#p426596.
Try the newer version, i am not going to install 5.x and check if it is possible or how it is possible. Unfortunatelly the pictures are damaged in my tapatalk client - will look later.

Thanks for keep supporting. I really appreciate. I am using latest version v5.26 and created skin as per the link you have provided and explained other ones on net. But unfortunately nothing happened. Created a new user group with restricted rights as much as possible and assigned this new skin to it. What i'm missing to cofig. the setting now? Please review the attached screenshort for more clear details and would heartily appreciated your further help on this to fix this.

if you believe that in your last image MT-Skin05.PNG you have logged in as user1, you are wrong.
If you notice the text on the tab of your browser (just below the menu: file, edit, view, history) it says:
Gateway - Interface List at admin@10...
which means you log in again as admin and not user1, probably automatically, so this means this is cached somehow. Try logging out first or even Chrome's incognito mode (Ctrl+Shift+N) and if even this does not work, change the admin password (or set one if you have it blank) so that anything cached is wrong.

Good luck

Guliverrr is right, you are logging as "admin", not as "user1". This is the reason. So, log in as "user1", and you will see...

Hey Guys! You are really GREAT. Got it.... . Yes! i was login with admin not for the user created. Great Job. Keep it up to assist with MT support. Thanks a lot once again.

Hello there! Please let me know could we edit webfig login page with just only username and password on the webfig login window with adding our own service promotional texts to the created login group users, same as like we can edit Mikrotik Hotspot login page? Thanks

paams, provide some e-mail contact...

paams, provide some e-mail contact...

Okay Bro! Thank you very much.

In particular, is there a way to add columns like "to-address" in nat and all other firewall columns?
Without them, webfig is not very useful for firewall.

absolutely ..even a simple find/edit/fix is hard on relatively complex firewalls without columns customization

can I disable access from webfig, and only access via winbox. in ver 6.7?
thanks

can I disable access from webfig, and only access via winbox. in ver 6.7?
thanks

Yes of course, just disable http access in /ip service

Hi,
I have a little issue with my webfig desing skin feature, and i hope you guys will be able to help me. Problem is, that some parts work - and some dont. For example, i can hide everything from main panel located on the left, but when im trying to hide something specific, like wireless card options, it just wont save. I mean, im unchecking the box next to the option that i want to be hidden, click save, refresh the page and nothing happens. Same goes for translating. After save + refresh procedure, everything stays the same.
Im using RB 433 with v6.22 soft, firefox browser (but i have tested it with chrome also).

Any ideas ?
Cheers,
MS

Hi,
I have a little issue with my webfig desing skin feature, and i hope you guys will be able to help me. Problem is, that some parts work - and some dont. For example, i can hide everything from main panel located on the left, but when im trying to hide something specific, like wireless card options, it just wont save. I mean, im unchecking the box next to the option that i want to be hidden, click save, refresh the page and nothing happens. Same goes for translating. After save + refresh procedure, everything stays the same.
Im using RB 433 with v6.22 soft, firefox browser (but i have tested it with chrome also).

Any ideas ?
Cheers,
MS

Clearing your browser's cache would solve your problem. Also you should try again. At least it works for me.

before webfig everyone asked for an OS independent interface. now it's backwards again

pardon me, SSH ? secure, platform/OS independant, fast, clean... did i mention secure ?



and i still wish, there was a way to disable webfig completely. i'd like to show _only_ graphs to my users (and on non-default port).

Would be nice to be able to add logos etc.

Would be nice to be able to add logos etc.

yes but maybe they think you should use Syslogs

he said logos, not logs

he said logos, not logs

hahaha.
My fault.
checking forums in end of my work time and this is the result

Is there any way to adjust menu like in Winbox?
I'd like to add byte-out in specified place.

Hi all,


Designes is great options in web interface to remove some items for end users.


But i have problem with USERS panel.

I have two users admin and wifi user who can change only wifi SSID and password.


If I want that user with wifi can change password on account, I can only check or uncheck all users, but not individually.

I want hide all account, but show only acc who is loged to it?


Thx

Tomislav

Love webfig, however I would like to see the ability to disable the "disable eable buttons" particuarly in "interfaces" you can click the "D" to disable the interface, would like a read-only or remove option for those buttons, either for individual interfaces or as a whole.

I also look for a way to disable these "disable" and "remove" buttons in the overview/table page. I tried to disable the "Enabled" field in the details page but this does not have an effect on the overview. It is a really big risk to accidentially disable a primary interface without safe mode.
Did I miss something or is there no way to do so?

I'm using the web-config for some time now , very good and helpful .
mu only question is -
how can I make a user that can't change the skin but can change the script?

if I allow some user policy in the user setting , he can change the skin - I don't want this

so how can it be done?

Thanks ,

Hi, I have one question about webfig skin and radio buttons.
I solve problem with configuration wan in quick set function.

I want to have choice between Static, Automatic ip address. But no PPOE
When I use Limit see nothing

How do I change the language or customize text on the columns.. as listed in the pic (in red circle)?

Also... how do I add tabs on the left menu... as listed in the pic (in green)?

Thank you

-
Rich

Please make webfig as security feature. Then it will be veeery useful to offer our customers.