MikroTik Safe Mode: Power Loss - Rollback or Save?

MikroTik Safe Mode stages configuration changes so they can be automatically undone if your session ends abnormally. If you unplug a MikroTik device while it’s in Safe Mode, RouterOS treats that as an abnormal termination and — by design — will roll back the Safe Mode changes when the router restarts, unless you explicitly exited Safe Mode or hit the session history limit (in which case changes may be committed).

Contents

• MikroTik Safe Mode: how it works
• MikroTik Safe Mode behavior on power loss
• Exceptions and real-world reports
• How to avoid losing changes (best practices)
• Quick troubleshooting and testing steps
• Sources
• Conclusion

MikroTik Safe Mode: how it works

Safe Mode in RouterOS is a per-session safety net: when you enable Safe Mode (WinBox, CLI or WebFig), RouterOS flags the configuration changes from that session so they can be undone automatically if the session ends unexpectedly. The official MikroTik documentation explains that when a session in Safe Mode terminates abnormally (dropped SSH/WinBox, network failure, power loss, etc.), RouterOS will undo the changes that were made while the Safe Mode session was active.

Why does this exist? Simple: to prevent you from accidentally locking yourself out or shipping a bad config to production. The rollback mechanism is tied to the session state and a small local action history (the session “undo” buffer). The rollback timing normally uses TCP timeouts (roughly nine–ten minutes by default), but a power loss is treated as an immediate abnormal termination and triggers the rollback behavior per the documentation and practical guides like ShellHacks.

A few technical caveats from the RouterOS docs and console notes: Safe Mode does not protect commands that require an immediate reboot (for example, reset/restore operations), and if you exceed the session history limit (currently about 100 actions), RouterOS may exit Safe Mode automatically — in that situation the automatic undo will not occur. See the Console details for history limits and related behavior: https://help.mikrotik.com/docs/spaces/ROS/pages/8978498/Console.

MikroTik Safe Mode behavior on power loss

Short answer: unplugging the device while it’s in Safe Mode normally causes RouterOS to roll back the Safe Mode changes on the next boot.

Unplugging = abnormal session termination. The intended behavior (per the official docs) is that changes made during that Safe Mode session are undone if the session ends abnormally — and a power loss counts as such. Practical references (for example, ShellHacks) describe rollback happening within the TCP timeout window in many cases, but the documentation treats power loss as an immediate trigger for rollback. So if you made edits while in Safe Mode and then the router suddenly loses power, you should find the device booted with the previous configuration (the state from before Safe Mode began).

If you wanted the changes to persist: exit Safe Mode intentionally before you disconnect (for example, click the Safe Mode control in WinBox or end the session cleanly). That action commits the changes.

Exceptions and real-world reports

Real-world behavior sometimes differs. Community threads report occasions where Safe Mode changes appeared to have been saved after a power cycle — users noted this happening on specific RouterOS builds (for example, reports mentioning behavior around 6.40.4) and suspected bugs or race conditions (forum example 1, forum example 2). Those threads are useful reminders: software bugs, device model differences, or unusual state transitions can cause behavior that departs from the documented design.

Other important exceptions:

• If Safe Mode automatically exits because you exceeded the session history limit (the session no longer tracks undo steps), the rollback won’t occur. See the Console notes: https://help.mikrotik.com/docs/spaces/ROS/pages/8978498/Console.
• Commands that force a reboot, restore a backup, or explicitly reset configuration are not protected by Safe Mode.
• If your session is replaced or the router applies a command that kills the session in a way RouterOS treats as a normal termination, the outcome may vary.

Bottom line: RouterOS is designed to roll back on power loss, but bugs and edge cases exist — check your RouterOS version and test in a lab if you rely on Safe Mode for critical changes.

How to avoid losing changes (best practices)

If you want to make changes safely and keep them when intended, follow these practical steps:

• Backup/export before you change anything:
• Create a readable export: /export file=backup-before-change
• Create a binary backup: /system backup save name=backup-before-change
• Copy the backup or export off the router (WinBox drag-and-drop from Files, FTP/SFTP, or use tool fetch) so you have an off-device copy.
• Use Safe Mode for risky edits, but when you’re satisfied, explicitly exit Safe Mode or close the session cleanly to commit changes.
• Don’t perform risky changes on production devices during unstable power conditions. If possible, test in a lab or maintenance window.
• Keep RouterOS up to date — some unexpected Safe Mode behavior has been reported on older builds.
• If you anticipate many small edits, avoid exceeding the history limit (keep batches modest) so Safe Mode stays active.

Example commands to create local copies:

/export file=backup-before-change
/system backup save name=backup-before-change

After creating these files, move them off the router before making risky changes.

Quick troubleshooting and testing steps

If you unplugged the device and the outcome surprised you, do this:

• Check logs: /log print — look for entries mentioning Safe Mode termination or rollback.
• Export the current config and compare it to your backup: /export file=current-check
• Verify RouterOS version: system resource print and system package update — if behavior looks buggy, update or search the MikroTik forum for similar reports.
• Reproduce safely: use a test router or VM, enable Safe Mode, make a controlled change, then force a reboot (software reboot first) to confirm rollback behavior before doing it in production.
• If changes persist unexpectedly after power loss, gather logs and consider opening a support thread with MikroTik or the community (include RouterOS version, exact steps you ran, and a log excerpt).

Sources

• https://help.mikrotik.com/docs/display/ROS/Configuration+Management
• https://help.mikrotik.com/docs/spaces/ROS/pages/8978498/Console
• https://www.shellhacks.com/mikrotik-safe-mode-cli-winbox-webfig/
• https://forum.mikrotik.com/t/safe-mode/182675
• https://forum.mikrotik.com/viewtopic.php?t=117456

Conclusion

MikroTik Safe Mode is designed to protect your configuration: unplugging a router while in Safe Mode is normally treated as an abnormal termination and will cause RouterOS to roll back the Safe Mode changes on reboot. To avoid surprises, back up or export the configuration before making risky edits, explicitly exit Safe Mode when you want to keep changes, and update/test RouterOS if you run into inconsistent behavior.