Sep 27, 2026 · @MikroTik Marc
Yes, you can build it. Here’s what it actually takes.
With today’s AI coding tools, a capable network engineer can build a working MikroTik RMM. We know, because we’ve spent years building Admiral and we use AI tools in our own development every day.
The real question isn’t whether you can build it. It’s what it costs to build, secure and keep running, and whether that’s the best use of your team’s time.
We wrote this to give you honest numbers. Every estimate below leans toward building it yourself: we assume an experienced engineer, heavy AI assistance and no major detours. If your numbers come in lower, you should probably build. If they don’t, you’ll know why.
Bottom line up front: for most fleets, the one-time build alone costs as much as several years of Admiral licensing. For small and mid-size fleets, just maintaining a DIY tool each year costs about as much as the license, or more, and you have to spend time and effort supporting it.
How we estimated
We based these numbers on what it has taken us to build and operate Admiral, which today manages fleets ranging from dozens of MikroTiks to more than 14,000+. Every assumption below favors the DIY builder.
- The builder is experienced. They know MikroTik well, can write code, and use AI coding assistants (Claude Code, Cursor, Codex and similar) throughout. Without AI, expect the hours to roughly double (or more).
- The scope is a core MikroTik RMM comparable to Admiral’s core features, itemized below. Add-on products are priced separately.
- There are two estimates per item. Lean means things go well. Realistic includes normal surprises, rework and testing. We never use a worst case.
- Rates are loaded hourly costs: salary plus roughly 25–30% for payroll taxes, benefits and overhead, across three tiers.
| Builder profile | Annual salary | Loaded hourly rate |
|---|---|---|
| Owner-operator or DIY WISP/MSP | ~$50,000 | $30 |
| Mid-size ISP or MSP engineer | ~$100,000 | $60 |
| Enterprise or large-carrier engineer | ~$160,000+ | $100 |
What AI changes, and what it doesn’t
AI shrinks the initial coding effort, not the ownership and responsibility of maintaining the project. It makes the first 70% of the project feel fast. The last 30% (edge cases, hardening, field conditions and scale) is where most of the hours in this post live.
| Area | Where AI helps a lot | What’s still on you |
|---|---|---|
| Writing code (screens, APIs, database) | Drafts most of it quickly | Reviewing every line that touches credentials or routers |
| Integrations with documented APIs | Very capable | Keeping up when the syntax changes / updates |
| RouterOS behavior | Knows the documented API | Undocumented quirks, v6/v7 differences and per-model oddities, firmware changes |
| Testing | Writes tests fast | Building a real test fleet, because tests against a simulated router prove little |
| Scale and performance | Implements a design you specify | Knowing where it breaks at hundreds or thousands of devices, which takes real load |
| Security | Catches common bugs in review | Owning the threat model for a system with admin access to every router you run |
| Operations | Writes runbooks | Being on call when it’s down at 2 a.m. |
The build, module by module
It’s taken us 5+ years to build Admiral without AI. A core MikroTik RMM like Admiral breaks into 14 blocks of work, totaling roughly 550–1,100 hours with AI assistance. That’s about 3.5 to 7 months of one full-time engineer, or twice that working part-time.
| # | Module | What it includes | Lean (hrs) | Realistic (hrs) |
|---|---|---|---|---|
| 1 | Foundation | Architecture, multi-tenant data model, login, roles and permissions, 2FA, audit log | 40 | 80 |
| 2 | Device onboarding and credentials | CSV import, subnet scanning, secure per-device credential storage, randomized credentials | 30 | 60 |
| 3 | Secure connectivity and NAT traversal | VPN concentrator, tunnel provisioning, reaching devices behind CGNAT, LTE and NAT, reconnect handling | 60 | 120 |
| 4 | Remote access | Browser-based SSH, WinBox access through the tunnel, port forwarding, session logging | 40 | 80 |
| 5 | Polling engine and monitoring | RouterOS API poller, worker scheduling, time-series storage, graphs for interfaces, CPU, RAM, health, SFP and latency | 60 | 120 |
| 6 | Alerting and notifications | Alert rules, email, SMS, Slack and Telegram, deduplication, maintenance windows | 30 | 60 |
| 7 | Config backups and diffs | Scheduled exports, change detection, diffs, retention, off-site copies | 30 | 50 |
| 8 | Firmware management | RouterOS package and RouterBOARD firmware upgrades, staged rollouts, version tracking | 30 | 60 |
| 9 | Bulk commands and scripting | Run commands or scripts across many devices, script library, per-device results | 30 | 60 |
| 10 | Web UI, dashboards and reports | Device lists, tags, search, dashboards, uptime, firmware and event reports | 60 | 120 |
| 11 | Topology and discovery | Neighbor discovery, network map, routing (e.g., OSPF) visualization | 30 | 70 |
| 12 | Security hardening | Secrets handling, input validation, rate limiting, dependency scanning, fixing what a review finds | 40 | 80 |
| 13 | Test lab, QA and CI/CD | Virtual (CHR) and physical test routers across RouterOS versions, automated tests, build pipeline | 40 | 80 |
| 14 | Deployment, platform backups and docs | Servers, database backups, monitoring the monitor, upgrade process, runbooks, user docs | 30 | 60 |
| Total | 550 | 1,100 |
The two modules people underestimate most are #3 and #5. Bringing one tunnel up is quick. Keeping thousands healthy while devices sit on flaky links, packet-loss mid-handshake or retry with bad credentials in a loop is the real engineering. Polling is the same: easy at 50 devices, a storage and scheduling problem at hundreds, thousands, tens of thousands.
Up-front costs (CAPEX)
The one-time build runs about $17,500 to $56,000 at lean estimates and $62,000 to $139,000 at realistic ones, depending on who builds it. That’s before anyone even uses it in production.
| Line item | $30/hr builder | $60/hr builder | $100/hr builder |
|---|---|---|---|
| Engineering (550–1,100 hrs) | $16,500–$33,000 | $33,000–$66,000 | $55,000–$110,000 |
| AI coding tools during the build | $1,000–$4,000 | $1,000–$4,000 | $1,000–$4,000 |
| Test lab and staging (virtual routers, CHR licenses, spare hardware) | $0–$5,000 | $0–$5,000 | $0–$5,000 |
| Independent security review or pen test (recommended) | $0–$20,000 | $0–$20,000 | $0–$20,000 |
| Total, lean → realistic | ~$17,500–$62,000 | ~$34,000–$95,000 | ~$56,000–$139,000 |
Lean assumes you already own lab hardware and skip the outside security review. We don’t recommend skipping it for a system that holds admin access to your routers.
Not included: time spent learning, product design, running your network without the tool while it’s being built, and the extra scale work large fleets need (see Scenario C).
Keeping it running (OPEX)
The build is a one-time cost; ownership is not. Expect 120–700 engineering hours a year depending on fleet size, plus hosting and tooling. Those hours go to:
- RouterOS releases. New versions change APIs and behavior (the RADIUS changes between v6 and v7 are a recent example), and every release needs testing against your tool.
- New MikroTik hardware and model-specific firmware quirks.
- OS, language and dependency updates, including security patches.
- Bug fixes and small features your team asks for you to build.
- Operations: platform backups, monitoring the monitoring system, capacity growth and incident response.
| Line item | Small fleet (~150 devices) | Mid fleet (~2,000 devices) | Large fleet (~15,000 devices) |
|---|---|---|---|
| Maintenance and operations (hrs/yr) | 120–300 | 200–550 | 300–700 |
| Engineering cost per year | $3,600–$9,000 (at $30/hr) | $12,000–$33,000 (at $60/hr) | $30,000–$70,000 (at $100/hr) |
| Hosting (servers, storage, backups) | $600–$1,200 | $2,000–$4,000 | $8,000–$15,000 |
| AI tools | $1,200–$2,400 | $1,500–$3,000 | $3,000–$4,000 |
| Total per year | $5,400–$12,600 | $15,500–$40,000 | $41,000–$89,000 |
There’s also key-person risk. If one person built it, one person understands it. Budget for documentation and a second engineer who can support it when the first is on vacation or moves on.
Three scenarios: 3-year cost of ownership
In all three scenarios, licensing Admiral costs less than even the lean DIY estimates. The gap is widest for small fleets and narrows as fleets grow.
- Scenario A: owner-operator WISP, ~150 MikroTiks, built at $30/hr.
- Scenario B: regional ISP or MSP, ~2,000 MikroTiks, built at $60/hr.
- Scenario C: large carrier or enterprise, ~15,000 MikroTiks, built at $100/hr. Adds 150–300 hours of scale and compliance work, and assumes a security review is required.
| A: ~150 devices | B: ~2,000 devices | C: ~15,000 devices | |
|---|---|---|---|
| DIY build (CAPEX), lean → realistic | $17,500 → $42,000 | $36,500 → $83,000 | $93,000 → $175,000 |
| DIY upkeep per year (OPEX), lean → realistic | $5,400 → $12,600 | $15,500 → $40,000 | $41,000 → $89,000 |
| DIY 3-year total, lean → realistic | $34,000 → $80,000 | $83,000 → $203,000 | $216,000 → $442,000 |
| Admiral per year (typical) | $2,000–$4,000 | $10,000–$15,000 | $45,000–$60,000 |
| Admiral 3-year total (incl. setup where applicable) | $6,000–$12,000 | $35,000–$50,000 | $140,000–$185,000 |
| Years of Admiral the lean build alone would pay for | ~4–9 years | ~2.5–3.5 years | ~1.5–2 years |
Two things stand out:
- For small and mid-size fleets, DIY never pays for itself. Yearly upkeep alone costs about as much as an Admiral license, or more, so there’s no break-even point to reach.
- For very large fleets, DIY can break even eventually. If everything stays lean, the yearly savings recover the build cost in roughly five years or more. That’s why some large operators reasonably choose to build, and why the decision there comes down to focus, not just cost.
Admiral figures are typical ranges for fleets of these sizes, not quotes. Your price depends on deployment type (cloud or dedicated) and term, and 24/7 support SLAs cost extra. See our pricing page or ask us for a quote.
Optional add-ons
If you also want what Admiral’s add-on products do, add these to the build. Hours are AI-assisted, lean → realistic, and each add-on also adds to yearly upkeep.
| Add-on | Comparable Admiral product | Hours | Cost at $60/hr |
|---|---|---|---|
| Linux and server monitoring with remote shell | WatchTower | 80–160 | $4,800–$9,600 |
| Subscriber-facing WiFi portal (SSID, devices, parental controls), white-label | Compass WiFi | 150–300 | $9,000–$18,000 |
| Hotspot or captive portal with payments and VLAN support | Anchor | 120–250 | $7,200–$15,000 |
| Billing and OSS integrations (e.g., Sonar, Powercode) | Built-in integrations | 40–80 each | $2,400–$4,800 each |
| Public REST API with documentation | Admiral API | 40–80 | $2,400–$4,800 |
Anything that takes payments also brings PCI compliance work on top of these hours.
Build or buy: who should do which
Build if software is part of your strategy and you can staff it for years. Buy if your business is running networks.
Building is a good fit when
- You have developers with spare capacity and a real software practice: code review, automated testing, on-call.
- Your requirements are unusual enough that no product fits, and you’ve checked whether an API or custom development would close the gap.
- The tool itself is strategic: you plan to sell it, or it’s core to how you compete.
- Your fleet is small and simple. For a few dozen routers, open-source tools like Oxidized (backups) and LibreNMS (monitoring), plus a few scripts, may honestly be all you need.
- Learning is the goal, and you’ve budgeted the time that way.
Buying is a better fit when
- Networking is your product, and software isn’t.
- One person would build and own it, which creates key-person risk.
- You need it working this quarter, not in six months.
- You can’t commit maintenance hours every year for the life of the tool.
- The system will hold admin access to customer networks, and you face security or compliance scrutiny.
The middle path
- Buy the platform, build what’s unique on top of it with the REST API.
- Ask for custom development to close specific gaps. It’s often a project of a few hundred to a few thousand dollars, not months.
A note on “free” time
If you’re building on nights and weekends, no invoice arrives, but the time isn’t free. It’s time not spent on customers, on your own network, or away from work entirely.
Pressure-test your own estimate
Answer these before you commit. Every “we’ll figure it out later” usually adds weeks.
- Who is on call when the RMM is down, and who covers when that person is on vacation?
- How will you test against real devices across RouterOS versions and hardware models?
- What happens when a RouterOS update changes an API your tool depends on?
- Who reviews AI-written code that handles router credentials, and against what standard?
- How do you store and rotate credentials for every router you manage?
- How will devices behind CGNAT or LTE reach you, and what happens when thousands reconnect at once after an outage?
- Where do backups of the RMM itself live, and have you tested a restore?
- Who writes the documentation so the next engineer can support it?
- What would that engineer build instead if they weren’t building this?
The bottom line
AI has made building your own MikroTik RMM possible for more teams than ever, and we think that’s a good thing. But the code is the smallest part of the cost. The rest is testing against real devices, hardening a system that holds the keys to your network, and maintaining it through every RouterOS release for years.
That work is already done in Admiral, built and run by MikroTik-certified engineers across fleets of MikroTiks sized from dozens to tens of thousands. If your team’s time is better spent running your network and serving your customers, leave the software effort and engineering to us!