BryanNetNetwork architecture and router connectivity choices
Prerequisites and authority
Network/RouterOS authority, known topology and a recovery management path are required. Preserve existing router configuration before managed changes.
Separate internet distribution from management
BryanNet must reach each MikroTik's management IP and RouterOS API port. Customers reach the internet through the hotspot/router network. Those paths can be separate, and hosting BryanNet remotely does not require customer traffic to pass through its server.
| Arrangement | Management path | Customer internet path |
|---|---|---|
| Local server and one router | Direct LAN/routing | Router to local internet source |
| Local server and several routers | Reachable management subnet(s) | Each router through the designed distribution network |
| Remote server | Routed VPN to router or site gateway | Normally local breakout |
| Multiple sites | VPN and distinct site routes | Each site's internet source(s) |
Choose addresses before onboarding. Record server address, routers, API ports, customer networks, management networks and event/callback routes. Avoid overlapping site networks in a routed design.
Test from the application runtime as well as the host. A host can reach a VPN network while its containers cannot. Also test router-to-BryanNet events where the bootstrap uses them.
A public web tunnel is an ingress route for web traffic; it does not replace a management VPN. If a router is physically separated from its internet source, an actual distribution link or an independent routed connection is still needed. Software registration cannot substitute for that link.
Follow Internet sources and multi-site network topology for physical topology and Connecting remote sites through WireGuard for VPN configuration. Add each router individually in BryanNet after connectivity is established.
Related guides
Related guides: RouterOS API access, account policy and firewall hardening, Validate hotspot login, provisioning and router health, Shipped Desired State presets and safe customization, Internet sources and multi-site network topology, Router connection fails or API authentication is rejected.