Set up an agent on a Windows PC
Already have a Windows PC that stays on at the site? One download turns it into an agent — no extra hardware, and nothing else to install.
Before You Start
- You need a MikRouter account with at least one agent created under Agents.
- Open the agent's detail page and keep its
tokenandtunnel hostnearby — you'll paste them into the app. - A PC running Windows 10 or 11, on the same network as the devices you want to reach.
- You need to be able to approve an administrator prompt on it once, if you install the background service — an optional last step in the app, and step 2 of the command-line route.
What you are installing
One program. The MikRouter agent is a single self-contained executable — there is no Visual C++ redistributable, no .NET and no other runtime to install first. It connects on its own as soon as it has your tunnel host and device token.
Separately, it can register a background service that starts with the PC and keeps running after you sign out, so nobody has to stay signed in. That is the last step and it is optional — the agent works without it.
Download the agent and unpack it
Downloads folder, then right-click the file and choose Extract All. Inside are the program, mikrouter-agent.exe, plus its licence and a short read-me — nothing else to fetch and nothing else to install.Got an ARM PC — a Snapdragon laptop, or a Surface that says "ARM-based processor" under Settings›System›About? Take mikrouter-agent-windows-arm64.zip instead. Everything below is the same. If you are not sure, use the first download — it runs on every Windows PC.
Windows will warn you the first time
Open it — the settings window appears
mikrouter-agent.exe in the folder you unpacked. The window below opens straight away: there is no sign-in, no installer wizard and nothing to accept. Everything you need is on this one screen.Not set up yet
Fill in the tunnel host and the device token, then choose Start tunnel. Installing the background service is optional, and is what keeps the tunnel up after you sign out.
TUNNEL CONNECTION
1–1024 simultaneous tunnelled connections (default 64). One web page can use several. Raising this uses more memory and sockets; it does not add mappings or make the connection faster.
STARTUP
BACKGROUND SERVICE
Not installed
The tunnel can run without any of this — Start tunnel connects straight away, for as long as this app is open. The background service is what keeps it up when the app is closed: it starts with this computer, before anyone signs in, and keeps running after you sign out. Installing it needs administrator rights.
ABOUT
Version 1.0.0 (windows agent)
Windows 11 Pro 24H2 (amd64)
Settings: C:\Users\you\AppData\Local\MikRouter Agent\config.json
Log: C:\Users\you\AppData\Local\MikRouter Agent\agent.log
For more info visit https://mikrouter.com
Enter the tunnel host and device token
443 and Use TLS (wss) ticked unless your dashboard shows different values.| Field | Value | Note |
|---|---|---|
| host | test.mikrouter.com | Example only — see below |
| port | 443 | TLS port |
| tls | true | Always on |
| token | <your agent token> | From the agent detail page |
test.mikrouter.com is not a real address — it's a stand-in for this guide. Your agent's real tunnel host depends on the agent server you picked when you created the agent, so copy the exact value from the agent's detail page rather than typing the one shown here.
Maximum streams
64. It is how many tunnelled connections the agent will carry at once — one web page can use several. Raising it uses more memory and sockets; it does not add mappings or make the connection faster.Confirm the agent is Online in the dashboard
— on a wired machine.Front Desk PC
Windows 11 Pro 24H2 (amd64)OnlineAgent
Live status reported by the agent — only while it's online.
Hardware
Windows 11 Pro 24H2 (amd64)
Wi-Fi network
—
Wi-Fi signal
—
IP address
192.168.1.100
Firmware
v1.0.0
RAM available
7.1 GB
Active streams
0 / 64
Connected
just now
It is already working at this point
Install it as a background service — optional
You can stop here. The agent is connected and you can start adding mappings. This step is worth doing when the PC is meant to stay reachable on its own — and you can come back to it at any time.
What the background service actually is
Right now the tunnel is running inside the app. That means it lives and dies with the app: close it, sign out, or restart the PC, and the tunnel goes with it. Nothing is broken about that — it just needs somebody signed in with the app open.
The background service moves the tunnel out of the app and into Windows itself, as a Windows service — a program Windows starts at boot, before anyone signs in, and keeps running after everyone signs out. The window then stops being the thing that holds the tunnel up and becomes just a remote control for it: you can close it, quit it, or sign out entirely and the tunnel carries on.
So do you need it?
Install it for anything you are leaving in place — a PC at the site, or any machine that has to come back on its own after a power cut or a restart. Without it, a reboot leaves the agent offline until someone signs in and opens the app.
Skip it if you are trying MikRouter out, or using a PC you are sitting at anyway and do not mind restarting the tunnel yourself.
To install it: in the STARTUP section choose Install as a background service and approve the Windows administrator prompt — it asks because a program that starts before sign-in is a machine-wide change. Your saved settings are carried over, so nothing is retyped. Afterwards the row reads Installed — the tunnel starts with Windows and a MikRouter icon appears in the notification area near the clock.
Connected to test.mikrouter.com:443
0 of 64 streams in use · LAN address 192.168.1.100
TUNNEL CONNECTION
1–1024 simultaneous tunnelled connections (default 64). One web page can use several. Raising this uses more memory and sockets; it does not add mappings or make the connection faster.
STARTUP
BACKGROUND SERVICE
Installed — the tunnel starts with Windows
The tunnel can run without any of this — Start tunnel connects straight away, for as long as this app is open. The background service is what keeps it up when the app is closed: it starts with this computer, before anyone signs in, and keeps running after you sign out. Installing it needs administrator rights.
ABOUT
Version 1.0.0 (windows agent)
Windows 11 Pro 24H2 (amd64)
Settings: C:\ProgramData\MikRouter Agent\state\config.json
Log: C:\ProgramData\MikRouter Agent\logs\agent.log
For more info visit https://mikrouter.com
Installed. The tunnel now starts with Windows and keeps running after you sign out.
When to use this instead
cmd and PowerShell are not interchangeable here
Both work, but they disagree about two things, and each one bites in a way that looks like the program is broken:
Running a file in the current folder. cmd.exe searches the folder you are standing in, so mikrouter-agent.exe install works. PowerShell deliberately does not, and answers "not recognized as the name of a cmdlet" — there you must write .\mikrouter-agent.exe install, with the leading .\.
Paths containing spaces. C:\Program Files\MikRouter Agent\ has one, so the path needs quotes. In PowerShell a quoted string on its own is just text — put the call operator & in front of it to actually run it.
Open a terminal as Administrator
Terminal (Admin) on Windows 11, or Windows PowerShell (Admin) on Windows 10. You can also search for cmd, right-click Command Prompt and choose Run as administrator.Only some commands need this
status, setup, set, pause, resume — talks to the background service over a loopback channel on this PC and runs fine in an ordinary window, with no password.Install the background service
cd into the folder you unpacked to and run it. This registers the Windows service that starts at boot and keeps running when you sign out.mikrouter-agent.exe install
The same thing in PowerShell:
.\mikrouter-agent.exe install
Where the program lives afterwards
Installing copies it to C:\Program Files\MikRouter Agent\mikrouter-agent.exe and does not add it to your PATH. Typing mikrouter-agent in a fresh terminal will not find it — call it by full path, or cd into that folder first.
"C:\Program Files\MikRouter Agent\mikrouter-agent.exe" status
In PowerShell the same line needs the call operator in front:
& "C:\Program Files\MikRouter Agent\mikrouter-agent.exe" status
Enter the tunnel host and device token
Enter to accept anything already in brackets, which is how the port stays 443 and TLS stays on. Copy both values from your agent's page in the MikRouter dashboard.mikrouter-agent.exe setup
To set them in one go instead — which is what you want in a provisioning script — pass them as options:
mikrouter-agent.exe set --host <tunnel host> --token <device token>
| Field | Value | Note |
|---|---|---|
| host | test.mikrouter.com | Example only — see below |
| port | 443 | TLS port |
| tls | true | Always on |
| token | <your agent token> | From the agent detail page |
test.mikrouter.com is not a real address — it's a stand-in for this guide. Your agent's real tunnel host depends on the agent server you picked when you created the agent, so copy the exact value from the agent's detail page rather than typing the one shown here.
Confirm it is connected
status prints the tunnel state, the host and port, whether the device token is set, streams in use and the LAN address — Tunnel connected is the line to look for.mikrouter-agent.exe status
The dashboard agrees within a few seconds — open Agents and the badge turns Online.
Front Desk PC
Windows 11 Pro 24H2 (amd64)OnlineAgent
Live status reported by the agent — only while it's online.
Hardware
Windows 11 Pro 24H2 (amd64)
Wi-Fi network
—
Wi-Fi signal
—
IP address
192.168.1.100
Firmware
v1.0.0
RAM available
7.1 GB
Active streams
0 / 64
Connected
just now
The window is still there if you want it
mikrouter-agent.exe gui opens the same settings window the other tab walks through, and it edits the same saved settings. On a PC with a desktop the tray icon also appears near the clock once the service is installed.Removing the agent
Both forms need an Administrator terminal, because the service is machine-wide. The difference is what happens to your settings.
mikrouter-agent.exe uninstall
Removes the service, the tray icon and the installed files, and deletes your saved settings and logs — including the device token. This is what you want when the PC is leaving your hands. It lists exactly which folders it removed.
mikrouter-agent.exe uninstall --keep-settings
The same, but keeps your settings and logs, including the device token, so reinstalling later reconnects without retyping anything. It prints the folders it kept.
Either way the agent and its mappings stay in your dashboard — uninstalling here does not delete them. Remove them under Agents if you no longer need them, and remember the token is still valid until you do.
Every mikrouter-agent command
First: Windows does not put mikrouter-agent on your PATH
Installing copies the program to C:\Program Files\MikRouter Agent\mikrouter-agent.exe and adds nothing to your PATH, so typing mikrouter-agent in a fresh terminal will not find it. The simplest fix is to change into that folder once, after which every command below works as written.
cd "C:\Program Files\MikRouter Agent"
In PowerShell the same cd works, but running the program then needs a leading .\ — .\mikrouter-agent.exe status. The Command Line tab explains why, and shows the full-path form if you would rather not change folder.
The full list is mikrouter-agent.exe help. Only the rows marked Administrator change machine-wide state; everything else runs in an ordinary terminal with no password.
Day to day
mikrouter-agent.exe statusShow the tunnel state and this agent's settings.
mikrouter-agent.exe pauseDisconnect the tunnel, leaving the service running. Remembered across reboots.
mikrouter-agent.exe resumeReconnect after a pause.
mikrouter-agent.exe logsPrint where the log file lives.
mikrouter-agent.exe guiOpen the tray icon and the settings window.
Changing settings
mikrouter-agent.exe setupGuided prompt for the tunnel host and device token — asks for each value in turn.
mikrouter-agent.exe set --host <name>Tunnel host, from the agent's page in the dashboard.
mikrouter-agent.exe set --token <48 hex>Device token, from the same page.
mikrouter-agent.exe set --port <1-65535>Tunnel port. Default 443.
mikrouter-agent.exe set --tls | --no-tlsUse TLS for the tunnel. On by default; leave it on.
mikrouter-agent.exe set --max-streams <1-1024>Simultaneous tunnelled connections. Default 64 — one web page can use several.
mikrouter-agent.exe resetClear the tunnel settings, keeping the agent installed.
Updates
mikrouter-agent.exe update --listList published releases for Windows.
mikrouter-agent.exe update --version <x.y.z>Install one. The tunnel does not have to be connected. With the background service stopped, run it as Administrator — it installs and runs the next time you start the service.
The background service (Administrator)
mikrouter-agent.exe installRegister the service and the tray icon at sign-in.
mikrouter-agent.exe install --no-trayThe same, without the sign-in tray icon.
mikrouter-agent.exe startStart the service itself.
mikrouter-agent.exe stopStop the service. The tunnel goes with it.
mikrouter-agent.exe set-startup --service=on|offTurn the service on or off without removing anything — a pause, not an uninstall.
mikrouter-agent.exe set-startup --tray=on|offShow or hide the tray icon at sign-in. Never starts or stops the tunnel.
logs prints the location of the service log rather than the log itself. To read it:
type "C:\ProgramData\MikRouter Agent\logs\agent.log"
The log timestamps are UTC
LocalSystem and inherits no time zone, so it stamps every line in UTCwhile Explorer shows the file's own time as local. On a PC eight hours ahead of UTC the last line looks eight hours old when it is a minute old.