Concepts
Helix NMS+ is a multi-tenant network management system for MikroTik routers with an ISP business-support system attached. Four nouns carry most of the product:
- Organisation — a tenant. Every device, customer, plan and invoice belongs to exactly one, and access is checked against it on every request.
- Device — one RouterOS router, reached either directly or through a managed tunnel.
- Customer — the person or business being billed. A customer may hold several subscriptions.
- Subscription — one service on one device: a plan, a service model, and the router objects that deliver it.
The two halves are joined at the subscription. That is what lets billing ask the network a question, and the network ask billing one.
Organisations and access
Roles are ranked: CLIENT, MEMBER, FINANCE_ADMIN, ADMIN, OWNER. A guard asks for a floor rather than an exact role, so a rank above the floor is admitted and a suspended account is refused before any role is considered.
What a refusal records
Every refusal raised by a guard writes an audit row — who asked, for what, and which check refused. Unauthenticated requests are deliberately not audited: scanners produce them in bulk with no identity, and recording them would let anonymous traffic write to the trail without limit.
Working across organisations
Provisioning onto another organisation’s device requires an active reseller agreement naming both parties. A pending agreement is a proposal and authorises nothing.
Enrolment
A device joins by running one generated RouterOS script. The script creates its management user, imports the certificate authority it needs, fetches its own client certificate and — for tunnelled devices — brings up the OpenVPN client.
Two paths
- Direct — the router has a reachable public address. Helix dials it.
- Tunnel — the router has no public address. It dials Helix, and everything afterwards runs over that tunnel.
Things worth knowing before you enrol a fleet
- RouterOS ships no trusted root store. The script imports the root certificate it needs so the certificate fetch can be verified. Do not “fix” a trust failure by disabling verification — that fetch carries the device’s own credentials.
- The enrolment URL is a bearer credential. Treat it like a password. It is per-device and can be re-issued from the console, which rotates the token and clears any identity binding.
- Generated passwords avoid RouterOS’s own string syntax. A
$ inside a double-quoted RouterOS string is variable interpolation, so a password containing one is stored differently by the router than by Helix — and every retry faithfully reproduces the mismatch. The alphabet excludes those characters and the script generator refuses them outright.
Connection modes
A device is DIRECT or TUNNEL. That decides how its address is resolved, and nothing else about it changes.
The tunnel
Tunnelled devices are issued their own certificate and a fixed address inside the tunnel network. Revocation is real: deleting a device revokes its certificate at the next nightly rebuild, and a regenerated certificate revokes its predecessor.
Two OpenVPN planes
RouterOS v6’s OpenVPN client speaks a narrower set of algorithms than v7. Rather than weaken the primary instance for everyone, v6 devices connect to a second instance with its own port, pool and settings, and the enrolment script picks the right one from the device’s reported version.
Never proxy the device-facing hostname through an HTTP CDN. OpenVPN, the RouterOS API, FTP and syslog are not HTTP, and an HTTP proxy cannot carry them. Doing it drops every tunnel at once.
Monitoring and telemetry
Reachability, CPU, memory, per-interface throughput, optical power on SFP ports, and syslog. Time frames are 1 hour, 24 hours, 48 hours and the full retention of your plan.
Gaps are gaps
A missing sample is never drawn as zero, and an outage renders as a break in the line rather than a line through the floor. A counter that cannot be trusted — because the firewall state that produced it changed — is marked unmeasurable instead of being reported as a number.
Reachability has one decider
A device is offline when it has not been seen for the threshold, derived from a durable timestamp rather than from a single failed probe, so one lost packet does not flip what the console shows. Recovery is deliberately not damped: arrival is proof.
Alerting and incidents
Alert rules match events; channels deliver them. An unacknowledged incident escalates on a ladder you configure, and can be acknowledged from the console — individually or in bulk.
Repetition is suppressed, absence is not
A condition that is still true does not re-page you every cycle: the first occurrence raises, repeats inside the window are withheld, and past the window the condition is restated so it never falls silent. A device broken for a week must not vanish from its own log.
Correlated storms are summarised
When one upstream failure takes many sites offline, the first alert goes out immediately and the rest coalesce into a single summary — rather than the first being sent and the others discarded.
Backups and firmware
Configuration backups
Scheduled and on-demand, transferred over FTP, with a readable diff between versions. A failed attempt does not mark the device done for the day — the scheduler asks whether a backup actually landed, and retries on a bounded cadence so an unreachable router cannot become a session storm.
Firmware
Manual, scheduled and canary upgrades all pass through one gate that enforces downgrade blocking, version pins, minimum versions and patch-only mode. A pre-flight refuses an upgrade the device has no flash room for and says what to do instead.
Where a check cannot run — an unknown architecture, an unreadable version — the upgrade proceeds with a warning rather than being blocked. An invented obstacle that stops a legal upgrade is worse than a missing check.
Billing
Plans, customers, subscriptions, invoices, payments, credit notes and dunning. Money is stored as a fixed-point decimal, never a float, and currency is read from the organisation’s settings rather than assumed.
An organisation must state its currency before it can bill
Creating a plan or raising an invoice requires a billing settings row. Helix refuses rather than defaulting, because a default prints the wrong currency on a document that leaves the building.
Manual billing
- Ad-hoc invoices for installations, equipment and arrears. A due date in the past is accepted and reported, because arrears are exactly what a migration produces.
- Cash desk for payments taken in person.
- Bank statement reconciliation — paste a statement, see what parsed before anything is written, then match against recorded payments. A row that cannot be read is reported with its line number, never skipped.
Dunning
Overdue invoices age, reminders are sent, and — only if you have turned it on — service is suspended. An organisation that has never chosen a policy is treated as not having chosen one.
Service models
Each subscription provisions the objects its service actually needs.
Everything Helix creates is tagged
Objects Helix owns carry a comment identifying them, and teardown is scoped to that tag. An object Helix did not create is left alone and reported, rather than removed on a name match.
Suspension and enforcement
A suspension changes the router first and the record second. If the device did not confirm, the previous status is kept, an intent is recorded, and a sweep completes or cancels it later. A customer who pays in the meantime has their queued suspension cancelled rather than executed.
Coexistence
While another billing system is still live on the same network, Helix runs in observe mode: it watches, reports, and does not enforce. Every automated path that could cut service consults that gate — including the ones that cut service by removing an account rather than by suspending it.
What a withheld action looks like
Withheld is reported separately from failed. Failed means go and look at a device; withheld means change a setting. Conflating them sends an operator to a healthy router.
Splynx migration
- Connect the instance with a signature-auth API key.
- Import the plan catalogue — tariffs become plans, with nothing else written.
- Dry run the subscriber migration and read the result. Nothing is created.
- Apply, filtered by tariff, so corporate and residential cohorts move separately and at different times.
Placement is observed, not inferred
Which router a subscriber sits on is determined from the routers themselves — a live session, or a per-client queue — and not from the router field in the source system, which is an administrative grouping. A subscriber no device claims is refused by name rather than guessed onto a router, because a wrong device means the client cannot be suspended and their usage is read from somebody else’s queue.
Double billing is detected and named
During coexistence, any subscriber both systems would invoice is reported with their source service id, so the incumbent record can be stopped. Helix reports rather than suppressing: an invoice silently withheld leaves a subscription that owes nothing and a period nobody agreed.
API
The console is a web application over an HTTP API. Requests authenticate with a session; automation uses organisation-scoped API keys.
The public product feed
One endpoint needs no authentication, because it carries no tenant data:
GET https://cloud.helixnms.com/api/public/product-feed
It returns the shipped capability list this site’s features page is built from. If the source cannot be read it answers 503 — never an empty list, which would state that the product does nothing.
Machine clients should use the origin hostname, not a proxied one. A CDN in front of the console challenges non-browser clients, which a script, a cron job or a payment callback cannot pass.
Operational limits
- Router API sessions are shared with your Winbox. The limit defaults to 20 per device. Fleet operations are bounded so a sweep cannot exhaust it and lock you out of your own equipment.
- Retention is per plan. SLA metrics 3, 7 or 15 days; device and portal logs 7, 30 or 45. Fifteen days is a hard maximum for SLA data.
- Low-flash devices cannot be upgraded remotely. A 16 MB router typically has nowhere near the free space a current image needs, and bundled packages cannot be removed to make room — only disabled, which reclaims nothing. The pre-flight says so rather than failing mid-flash.
- Empty collections used to look like unreachable devices. Recent RouterOS answers an empty list with a reply older client libraries treat as an error. Helix handles it, which is why “this router has no entries” reads differently from “this router did not answer”.
How we report state
These are product rules, not style preferences.
- Never report success that was not achieved. A queued action says queued; it does not say done.
- Unknown is unknown. A measurement that could not be taken is shown as such, never as zero and never as an invented figure.
- A failed read is not an empty result. “We could not load this” and “there is nothing here” are different screens, because they call for different actions.
- Status is never carried by colour alone. Every state has words or a glyph beside it.
- A check that cannot run does not pass. Where failing closed would block legitimate work it warns loudly instead — and says which it did.
