RouterOS is powerful and, out of the box, chatty — half a dozen management services listening, MAC-Winbox answering on every port, neighbour discovery broadcasting the model to anyone on the wire. This is the management-plane hardening pass I run on every MikroTik before it goes live, the exact counterpart to the Cisco hardening post, and the fix list the offensive companion keeps pointing back to.
Most MikroTik compromises aren't clever — they're a Winbox port left facing the internet and an old RouterOS version, or a management service nobody turned off. The device defends the network well by default but doesn't defend itself unless you tell it to. This post closes the management plane: prune listening services, build an input-chain firewall that protects the router (not just traffic passing through it), lock down users and SSH, and silence the discovery/MAC-server surfaces that hand an attacker a free map.
The organising idea is the same as Cisco IOS: Management-Plane Hardening: the control plane — how you reach and manage the box — is a separate, higher-value target than the data plane, and it deserves its own deny-by-default posture. Every section here maps to a technique in Attacking MikroTik Gear.
01
RouterOS starts several management services by default — Telnet, FTP, the HTTP UI, the API — most of which you'll never use and each of which is attack surface. Turn off everything but SSH and WinBox, and move SSH off 22.
> /ip service print # Kill cleartext and unused management protocols outright: > /ip service disable telnet,ftp,www,www-ssl,api,api-ssl # Keep SSH (moved off 22) and Winbox, and bind both to the mgmt subnet only: > /ip service set ssh port=2200 address=10.10.99.0/24 > /ip service set winbox address=10.10.99.0/24
api and api-ssl look harmless but are complete config interfaces — anything you can do in the terminal, the API can do. If you don't run an automation tool or dashboard against this box, disable both. If you do (see Managing a Fleet), use api-ssl only, bound to the automation host's address — never plain api, which sends credentials in a trivially-recovered form.
02
The forward chain filters traffic passing through; the input chain filters traffic destined for the router. This is the one that stops the internet from talking to your management ports. Build it deny-by-default.
# 1. Fast-path what's already allowed; drop obviously bad state. > /ip firewall filter add chain=input connection-state=established,related action=accept add chain=input connection-state=invalid action=drop # 2. Allow management ONLY from the trusted source list, and ICMP. add chain=input src-address-list=MGMT action=accept comment="mgmt in" add chain=input protocol=icmp action=accept # 3. Everything else to the router is dropped — including from the WAN. add chain=input action=drop comment="default deny to router" # Define who's trusted (your jump host / admin subnet): > /ip firewall address-list add list=MGMT address=10.10.99.0/24
With a default-drop input chain, it no longer matters that Winbox listens — the internet can't reach it. The service-level address= restrictions from §01 are defence-in-depth on top. If you do only one thing from this post, do this: a router with no unsolicited inbound to itself is dramatically harder to attack, full stop.
03
Named accounts, least-privilege groups, key-based SSH, and strong ciphers. The default admin should already be gone from First Contact; here we finish the job.
# A read-only group for monitoring/NOC logins: > /user group add name=readonly policy=read,winbox,test,!write,!policy > /user add name=noc group=readonly password="..." # SSH keys instead of passwords for the admin, then require them: > /user ssh-keys import user=noctis public-key-file=id_ed25519.pub > /ip ssh set strong-crypto=yes always-allow-password-login=no
04
Two RouterOS conveniences double as free recon and a backdoor path: neighbour discovery (MNDP/CDP/LLDP) advertises the box, and the MAC-server answers WinBox/telnet over Layer 2 on every interface — including untrusted ones.
# Only discover/advertise on an interface list you control: > /interface list add name=MGMT-IF > /interface list member add list=MGMT-IF interface=bridge > /ip neighbor discovery-settings set discover-interface-list=MGMT-IF # MAC-telnet and MAC-Winbox: restrict to the mgmt interface list. > /tool mac-server set allowed-interface-list=MGMT-IF > /tool mac-server mac-winbox set allowed-interface-list=MGMT-IF > /tool mac-server ping set enabled=no # Disable the bandwidth-test server (an abuse and DoS magnet): > /tool bandwidth-server set enabled=no # And RoMON, unless you deliberately run it on a trusted segment: > /tool romon set enabled=no
05
Every mass MikroTik compromise in the wild traces to a management port exposed to the internet on an unpatched box. Say it out loud: Winbox (8291), SSH, and the API never face the WAN.
The infamous Winbox directory-traversal bug (CVE-2018-14847) let attackers read credentials from an exposed port with no auth, and fuelled the VPNFilter and Meris botnets. It's long patched — but the lesson isn't "patch," it's "don't expose the management plane at all." New bugs will come; a Winbox port the internet can't reach is immune to the ones not written yet. Keep RouterOS current (upgrades) and keep 8291/2200/API off the WAN with the §02 input chain. Reach them over a VPN — WireGuard — instead.
Takeaways
input chain is the whole game — it protects the router regardless of what's listening. Build it first.NOCTIS hardens and audits RouterOS and Cisco estates across Crete — management-plane lockdown, firewall review, exposure checks — and shows you exactly what was reachable before, with a fix-first report.
Book a Discovery Call →