Do you want to have your own proxy that you don't share with anyone? MikroTik CHR is a cloud router that can be deployed on any VPS in just a few minutes and turned into a full-fledged proxy server. No neighbors on the IP, no traffic limits from the proxy provider — just your personal channel.
In this article, we will discuss how to set up such a server in literally 30–40 minutes, connect it to Dolphin Anty, AdsPower, or GoLogin, and start working with Facebook Ads, Instagram, and marketplaces without unnecessary risks.
What is MikroTik CHR and why is it needed for proxies
MikroTik CHR (Cloud Hosted Router) is a full-fledged RouterOS operating system from MikroTik that runs not on physical hardware but on a virtual machine in the cloud. Simply put, you take a regular VPS server, install CHR on it — and get a router with all the features: firewall, NAT, VPN, and, most importantly for us, a built-in proxy server.
RouterOS includes a built-in Web Proxy that supports HTTP and HTTPS traffic. This means you can literally turn your VPS into a working HTTP proxy with login and password authentication in just a few commands.
Why is this interesting for arbitrageurs and SMM specialists? It's all about control. When you buy a proxy from a provider, you don't know:
- How many other people are using the same IP address
- What history this IP has (it might already be on Facebook's blacklists)
- Whether the provider is leaking your traffic data
- Whether the server will crash at the most critical moment
Having your own proxy on CHR solves all these issues. The IP belongs only to you — it's the IP of your VPS provider that you chose yourself. The traffic only goes through your server. You manage access yourself and can change the IP at any time by simply recreating the VPS.
The CHR license for speeds up to 1 Mbps is free. This is quite sufficient for working with ad accounts, managing Instagram or TikTok accounts, or monitoring prices on Wildberries. If you need higher speeds — the P1 license costs $45/year, and P10 costs $95/year. But you can start without any licensing costs at all.
Who is this method suitable for: arbitrage, SMM, e-commerce
Before diving into the instructions, let's figure out if you even need CHR? This method is not suitable for everyone and not always. Here are three main scenarios where it really excels.
Arbitrageurs and media buyers
If you are farming Facebook Ads accounts or working with Google Ads, you need a clean IP with a good history. Data center VPS from major providers (Hetzner, DigitalOcean, Vultr) have IP addresses that Facebook sees as "commercial" — this is worse than residential, but better than shared proxies that have already been through thousands of hands.
The main advantage for an arbitrageur: one account — one IP. No neighbors. If an account gets banned, you simply recreate the VPS (or take a new one) and get a fresh IP. This is especially convenient when working with a small number of accounts (5–20), where the cost of a separate VPS for each is justified.
SMM specialists and agencies
Do you manage client accounts on Instagram, TikTok, VK? Each account needs its own IP. CHR on a VPS for $5 is the cheapest way to get a dedicated IP for each client. When working through Dolphin Anty or AdsPower, you simply enter your CHR proxy details in the browser profile — and that's it.
It's important to understand: data center IPs are still worse than residential ones for Instagram. If accounts constantly ask for verification or get banned, it makes sense to consider residential proxies — they appear to platforms as regular home users.
Marketplace sellers
Monitoring prices on Wildberries, Ozon, Avito is a task where speed is more important than the "warmth" of the IP. For scraping marketplaces, CHR on VPS is excellent: fast channel, static IP, full control over requests. Wildberries and Ozon block based on behavioral patterns, so it's important to set the delays between requests correctly — but that's more about the scraper than the proxy.
When CHR-proxy is NOT suitable:
- You need 50+ accounts — it's cheaper to buy a pool of residential proxies
- You work with platforms that strictly block data center IPs (some streaming services, banks)
- You have no time for setup — ready-made proxies are easier
- You need IP rotation — CHR provides a static address
Choosing a VPS hosting: where to launch CHR for $5
MikroTik CHR works on any VPS that supports loading a custom disk image or has CHR in the image catalog. The minimum requirements are laughable: 256 MB RAM, 1 CPU, 512 MB disk. Any cheapest VPS will handle it.
| Provider | Price from | IP Countries | CHR in catalog |
|---|---|---|---|
| DigitalOcean | $6/month | USA, Europe, Asia | No (image needed) |
| Vultr | $5/month | USA, Europe, Asia | No (image needed) |
| Hetzner | €4.15/month | Germany, Finland, USA | No (image needed) |
| Linode (Akamai) | $5/month | USA, Europe, Asia | No (image needed) |
| GCP / AWS | ~$5–10/month | Worldwide | No (image needed) |
For most tasks, we recommend Vultr or Hetzner — they are cheap, stable, and support loading custom ISO images, which is necessary for installing CHR. If the country of the IP is important (for example, you need a US IP for Facebook Ads), choose a data center in the USA.
Important point about the country: The IP address of your proxy will be from the country where the VPS data center is located. If you manage accounts for the Russian market — take a server in Russia or Europe. For American ad accounts — a data center in the USA.
Installing MikroTik CHR on VPS: step-by-step guide
There are several ways to install CHR. The simplest and most universal is through the installation script directly on top of Linux. We will demonstrate this method, as it works on any VPS with Ubuntu or Debian.
⚠️ Important before starting:
After installing CHR, Linux will no longer be on the server — RouterOS will start instead. Make sure you have access to the VNC console through the hosting control panel — it will be needed for the initial setup.
Step 1. Create a VPS and connect via SSH
Create a VPS with Ubuntu 22.04 (minimum plan). Connect via SSH — the login details will be sent to your email or displayed in the control panel. Open the terminal (on Windows, use PuTTY or Windows Terminal).
Step 2. Download the CHR image
Execute the following commands in the terminal. First, let's update the system and download the CHR image:
apt update && apt install -y wget wget https://download.mikrotik.com/routeros/7.14/chr-7.14.img.zip unzip chr-7.14.img.zip
Check the current version on the MikroTik website — at the time of writing, version 7.14 is current, but the number may change.
Step 3. Write the image to disk
This is a key step — we overwrite the system disk of the VPS with the CHR image. Find out the disk name using the command lsblk — it is usually vda or sda.
# Replace /dev/vda with your disk name! dd if=chr-7.14.img of=/dev/vda bs=4M oflag=sync
After this command, the SSH connection will be terminated — this is normal. The server will reboot with RouterOS.
Step 4. First login via VNC console
Open the VNC console in the hosting control panel (in Vultr, it's the "View Console" button, in Hetzner — "Console"). You will see the RouterOS welcome screen. Log in with the username admin and an empty password.
First, set the administrator password:
/user set admin password=YOUR_SECURE_PASSWORD
After that, you can connect via Winbox (the graphical utility for MikroTik) or continue via SSH — it is now accessible again on the standard port 22.
Setting up a proxy server on MikroTik CHR
RouterOS includes a built-in Web Proxy. This is an HTTP/HTTPS proxy with authentication support. It can be configured in just a few commands — we will do everything through the terminal or Winbox.
Step 1. Enable Web Proxy
/ip proxy set enabled=yes port=8080 max-connections=600
Port 8080 is standard for HTTP proxies. You can choose any unused port (for example, 3128 or 9090). max-connections=600 is the maximum number of simultaneous connections; 100 is enough for one or two accounts.
Step 2. Allow access through the firewall
By default, the CHR firewall blocks incoming connections. You need to open the proxy port:
/ip firewall filter add chain=input protocol=tcp dst-port=8080 action=accept comment="Allow Proxy"
🔒 Security Tip:
If you know your static IP (for example, your office IP or home IP), restrict access to the proxy only from it. This will protect against scanners and abuse: /ip firewall filter add chain=input protocol=tcp dst-port=8080 src-address=YOUR_IP action=accept
Step 3. Set up authentication (login and password)
The built-in Web Proxy in RouterOS supports basic authentication through the Access List. To restrict access by IP (without login/password), use:
/ip proxy access add src-address=YOUR_IP action=allow /ip proxy access add action=deny
The first line allows access from your IP, the second denies it to everyone else. Replace YOUR_IP with the IP address of the device you will connect from (or the IP of your anti-detect browser).
Step 4. Check that the proxy is working
The connection details for the proxy will be as follows:
| Parameter | Value |
|---|---|
| Type | HTTP |
| Host (IP) | IP address of your VPS |
| Port | 8080 (or whichever you specified) |
| Authentication | By IP (or not required if restricted by firewall) |
Check the proxy's functionality: open your browser, enter the IP and port in the proxy settings, go to whatismyip.com — you should see the IP of your VPS, not your home address.
Connecting the proxy to an anti-detect browser
Now for the most interesting part — connecting our CHR proxy to an anti-detect browser. We'll explore this using three popular tools: Dolphin Anty, AdsPower, and GoLogin.
Dolphin Anty
Dolphin Anty is one of the most popular anti-detect browsers among arbitrageurs. Setting up the proxy is done when creating a profile:
- Open Dolphin Anty → click Create Profile
- In the Proxy section, select the type HTTP
- In the Host field, enter the IP address of your VPS
- In the Port field, enter 8080
- If you set up authentication with a login/password — fill in the corresponding fields
- Click Check Proxy — your VPS IP and country should appear
- Save the profile and launch the browser
AdsPower
In AdsPower, the process is similar:
- Go to the Profiles section → New Profile
- Open the Proxy tab
- Select Proxy Type: HTTP
- Fill in the fields: VPS IP address, port 8080
- Click Test Connection
- Save and launch the profile
GoLogin
GoLogin supports HTTP and SOCKS5 proxies. Since the CHR Web Proxy operates over HTTP:
- Create a new profile in GoLogin
- In the Connection → Proxy section, select HTTP
- Enter the VPS IP and port
- Click Check Proxy to verify
- Launch the profile — done
💡 Lifehack for arbitrageurs:
If you need SOCKS5 (some platforms prefer it), set up an L2TP/PPTP tunnel on CHR or use an additional proxy service on top of CHR. Alternatively, consider mobile proxies — they natively support SOCKS5 and show excellent results when working with Facebook Ads and TikTok Ads.
Security and protection of the proxy from unauthorized access
An open proxy server is a serious problem. If attackers find your proxy, they will use it for their purposes: spam, attacks, fraud. As a result, the IP will end up on blacklists, and you won't be able to work properly. Therefore, security is a mandatory step in the setup.
Rule 1: Limit access by IP
This is the most reliable method. Allow connections to the proxy only from specific IP addresses — your computer, office, or the IP of the server with the anti-detect browser. We already covered the commands above in the Access List section.
If the IP is dynamic (changes with each internet connection), use a DDNS service (for example, DuckDNS) or simply update the firewall rule when the IP changes.
Rule 2: Change the default SSH port
Port 22 is constantly scanned by bots. Change SSH to a non-standard port (for example, 2222 or 54321):
/ip service set ssh port=2222
Rule 3: Disable unnecessary services
RouterOS by default enables several management services: Telnet, FTP, API, Winbox. Keep only what you use:
/ip service disable telnet /ip service disable ftp /ip service disable api /ip service disable www
Rule 4: Set up connection monitoring
In RouterOS, you can view active connections through the proxy with the command:
/ip proxy connection print
If you see suspicious IPs or a large number of connections — immediately block them through the Access List. Regularly check logs and monitor traffic through the VPS control panel.
Rule 5: Regularly update RouterOS
MikroTik regularly releases updates with security patches. Updating is done with one command:
/system package update check-for-updates /system package update install
CHR-proxy vs ready-made proxies: when to choose what
Having your own proxy on CHR is not a silver bullet. It has clear strengths and weaknesses compared to purchased proxies. Let's break it down honestly.
| Criterion | CHR on VPS | Ready-made proxies |
|---|---|---|
| Price (1 IP) | $5–6/month | $1–15/month depending on the type |
| IP Control | Full, only you | Depends on the type (shared/dedicated) |
| Type of IP | Data center | Residential, mobile, data center |
| Setup Complexity | Medium (30–60 minutes) | Minimal (5 minutes) |
| Speed | High (depends on VPS) | Varies |
| IP Rotation | No (static) | Yes (for residential and mobile) |
| Trust of Platforms | Medium (data center) | High (residential/mobile) |
| Scalability | Need a new VPS for each IP | Easy — just buy the required number |
When to choose CHR on VPS:
- You need 1–5 dedicated IPs with full control
- You have technical skills and time for setup
- Independence from the proxy provider is important
- Tasks: scraping, price monitoring, working with ad accounts
- You want to minimize costs with a small number of accounts
When to choose ready-made proxies:
- You need 10+ IPs — scaling VPS is expensive and complicated
- You work with Instagram, TikTok — they need residential or mobile IPs
- You have no time for server setup and maintenance
- You need IP rotation (for example, for scraping with a large volume of requests)
- Platforms strictly block data center IPs
For tasks that require "live" IPs with a good reputation, the optimal solution remains data center proxies from specialized providers — they are already filtered, have a clean history, and require no setup on your part.
Conclusion
MikroTik CHR in the cloud is an elegant solution for those who want to fully control their proxy server and not depend on third-party providers. For $5 a month, you get a dedicated IP, a powerful RouterOS firewall, flexible access configuration, and the ability to instantly recreate the server if necessary.
We covered the entire process: from choosing VPS hosting to connecting the proxy in Dolphin Anty, AdsPower, and GoLogin. The setup takes 30–60 minutes, and after that, you have a working HTTP proxy, protected by a firewall and accessible only to you.
However, remember: CHR-proxy gives you a data center IP. For working with Instagram, TikTok, and Facebook Ads, where platforms are increasingly checking traffic quality, this may not be enough. If you need IPs that platforms perceive as regular home users, we recommend considering residential proxies — they provide a significantly higher level of trust from social networks and advertising platforms, which directly reduces the risk of bans and verifications.
Use CHR for tasks where it truly excels — scraping, price monitoring, a small number of accounts with dedicated IPs. For large-scale work with social media, combine both approaches: your own CHR for technical tasks and quality residential or mobile proxies for working with platforms.
```