RouterOS 7.22: Apps, Reverse Proxy, and BGP updates

MikroTik released a new RouterOS 7.22. In short: the developers decided to turn regular containers into a more user-friendly “Apps” ecosystem, added a native Reverse Proxy, and upgraded BGP to the level of modern data centers.

Below is a distillation of the most important points for those who administer networks and automate infrastructure.

Containers are now officially “Apps”

The /app menu is an attempt by MikroTik to abstract away from the raw Docker CLI and make working with applications more “out-of-the-box”.

What changed:

• App Store: A parameter app-store-url has been added. You can now connect repositories with ready-made templates (YAML). Examples already include jupyter-notebook, livebook and myip.
• Automatic updates: The router can now perform the stop -> pull -> start cycle itself when an image is updated in the repository. No more crafting scripts in the scheduler.
• Shared Memory: shm_size support was added. This is critical for databases and high-load applications that previously just crashed with segmentation faults.
• Forced Swap: On devices running Apps, a Swap partition is now enabled automatically. This improves overall system stability on hardware with small amounts of RAM (for example, L009).

Example of adding an application via CLI:

/app/add app-store-url=https://some-repo.com/templates/jupyter.yaml name=jupyter
/app/start jupyter

⚠️ Important warning: A regression with TUN interfaces inside containers has been noticed in version 7.22 (relevant for sing-box and similar solutions). If your container works as a VPN gateway for transit traffic — be sure to test the upgrade on a staging setup.

Native Reverse Proxy

Many have been waiting for this feature to avoid running a separate VM or a Caddy/Nginx instance just to forward internal services.

It is located at /ip/reverse-proxy. It supports HTTP/2 (on ARM, ARM64 and x86), can work with ACME certificates (Let’s Encrypt) and is integrated with the new /app section.

Verdict: This is not a complete replacement for complex L7 load balancers, but for home labs or access to internal web panels in an office — it’s an ideal solution. Fewer entities mean fewer points of failure.

BGP and the network stack

BGP in the v7 branch continues to gain “mature” features for building modern topologies:

1. BGP Unnumbered: You can now establish sessions without assigning IP addresses to interfaces, using only IPv6 Link-Local. This removes the need to manage hundreds of /30 or /31 subnets in large fabrics.
2. ECMP (Multipath): Improved support for multiple paths. BGP now distributes traffic across uplinks more correctly.
3. Add-Path: Allows advertising multiple routes for a single prefix, which is critical for fast network convergence.

In the Bridge section, support for MLAG was moved to a separate submenu and RA Guard was added, which protects your network from unauthorized IPv6 routers (Rogue Router Advertisements).

Small quality-of-life improvements

• Console: Became more user-friendly. Added :continue, :break and :exit commands for loops in scripts. Now familiar Linux keybindings work: Ctrl + arrows (move by words) and Ctrl + W (delete a word).
• IPv6 Scripting: Bit shifts << and >> have been added for IPv6 addresses. Handy if you automate subnet slicing.
• USB Tethering: Support has been added for sharing internet over USB from iPhones and modern Pixel models. A great option for quickly bringing up a backup link.

Summary

Release 7.22 confirms MikroTik’s direction of turning the router into a universal applications platform.

When to upgrade?

• If you need a built-in Reverse Proxy or convenient container management — yes.
• If you use complex setups with containerized VPNs or deeply customized BGP — caution, only after backing up and testing on identical hardware.