A MikroTik router is powerful out of the box, and that is exactly why it needs a few minutes of hardening before real traffic touches it. Most compromised routers are not victims of clever attacks. They were reachable from the internet with default services, a weak password, or old software. Closing those doors takes less than an hour, and it is the cheapest security work you will ever do.
This checklist is written for anyone who deploys MikroTik routers, whether for an ISP, an office, or a customer site. It follows the order we use: update, lock down access, build the firewall, remove what is not needed, then back up and test. If you want it done and documented for you, our MikroTik and ISP support covers exactly this.
1. Update RouterOS and the firmware
Old RouterOS releases have had serious vulnerabilities, including ones in the management interfaces that were widely exploited. Update to a current release on the channel you trust, then upgrade the RouterBOARD firmware and reboot. Read the release notes first, and test on one device before updating a whole fleet.
/system package update check-for-updates
/system package update install
/system routerboard upgrade2. Replace the default login
Create a new administrator with a strong, unique password, sign in with it, and then disable the default admin account. Never reuse the router password anywhere else. For monitoring tools, create a separate account in a read-only group instead of giving them full access.
/user add name=netadmin group=full password="use-a-long-unique-password"
/user disable admin3. Know which services are listening
Every enabled service is a door, and each one has a well-known port that scanners look for. Disable what you do not use and limit the rest to your management network.
| Service | Default port | Recommendation |
|---|---|---|
| Telnet | 23 | Disable. Traffic is unencrypted |
| FTP | 21 | Disable. Use SFTP over SSH if you need file transfer |
| WWW (WebFig) | 80 | Disable, or use WWW-SSL on a management network only |
| SSH | 22 | Keep, restricted to your management addresses |
| WinBox | 8291 | Keep, restricted to your management addresses or reachable only over a VPN |
| API / API-SSL | 8728 / 8729 | Disable unless a system needs it, then use API-SSL with a certificate |
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
set winbox address=192.168.88.0/24
set ssh address=192.168.88.0/24
/ip ssh set strong-crypto=yes
/tool bandwidth-server set enabled=noReplace the address with your own trusted management range. For remote administration, reach the router through a VPN rather than exposing WinBox to the internet.
If a system does need the API, such as a web dashboard for a hotspot, enable API-SSL only and give it a certificate. The MikroTik Hotspot Management Suite works this way: online, it connects to the router over API-SSL only.
4. Stop answering on discovery interfaces
Neighbor discovery and MAC-based access are handy on a bench and risky on a live network. Limit them to a trusted interface list, or switch them off.
/ip neighbor discovery-settings set discover-interface-list=none
/tool mac-server set allowed-interface-list=none
/tool mac-server mac-winbox set allowed-interface-list=none5. Build the firewall: first match wins
The input chain protects the router itself. Rules are read from the top, and the first rule that matches decides what happens. A sound pattern is to accept established connections, drop invalid ones, allow management only from your LAN, and drop everything else. Because order matters, the final drop must come last, and the LAN accept rule must come before it.
/ip firewall filter
add chain=input action=accept connection-state=established,related,untracked
add chain=input action=drop connection-state=invalid
add chain=input action=accept protocol=icmp
add chain=input action=accept in-interface-list=LAN
add chain=input action=drop comment="drop all other input"This assumes an interface list named LAN already exists. The forward chain, which controls traffic passing through the router, needs its own rules based on your network design.
6. Do not forget IPv6
If IPv6 is enabled and you only secured IPv4, the router can be wide open on the other protocol. Mirror the same logic, and do not drop all ICMPv6, because IPv6 needs it to work. If your provider hands out addresses with DHCPv6, allow that traffic before the final drop.
/ipv6 firewall filter
add chain=input action=accept connection-state=established,related,untracked
add chain=input action=drop connection-state=invalid
add chain=input action=accept protocol=icmpv6
add chain=input action=accept in-interface-list=LAN
add chain=input action=drop comment="drop all other input"7. Do not be an open DNS resolver
If the router does not need to answer DNS for clients, switch remote requests off. If it does, make sure the firewall only lets your own networks use it. Open resolvers are routinely abused to amplify attacks against other people.
/ip dns set allow-remote-requests=no8. Turn off features you do not use
/ip proxy set enabled=no
/ip socks set enabled=no
/ip upnp set enabled=no
/snmp set enabled=noIf you do use SNMP, change the default community and restrict it to your monitoring server. If you use the cloud DDNS feature, review whether you need it on that device at all.
9. Time and logs you can trust
Accurate time makes logs useful when something goes wrong. Send logs to a remote server too, so evidence survives a reboot, a reset, or a compromise.
/system ntp client set enabled=yes
/system ntp client servers add address=pool.ntp.org
/system logging action add name=syslog target=remote remote=192.168.88.10 remote-port=514
/system logging add topics=system,error,warning action=syslogThe NTP commands above are for RouterOS v7. On v6 the client is configured with a primary server setting instead.
10. Back up before you go live
Save both a binary backup and a readable export, and again after every important change. The binary backup restores a whole router, and the export is human-readable, which is invaluable when you move to different hardware. Store both off the router.
/system backup save name=before-go-live password="a-different-strong-password"
/export file=before-go-live11. Test it like an outsider
Before you leave, check the router from outside. From a connection that is not on your network, scan the router's public IP address, which you are entitled to do, and confirm that only what you intend is reachable.
- No management ports answer from the internet.
- Management still works from the LAN and over your VPN.
- The default
adminaccount is disabled. - The firewall counters show the drop rules are catching traffic.
- Backups and exports are saved somewhere off the device.
- Every rule has a comment that says what it is for.
Related reading: how to plan and secure a business network and the monthly IT maintenance checklist, which includes the firmware and backup checks this article starts with.
Frequently asked questions
Is it safe to leave WinBox open to the internet?
No. Restrict WinBox and SSH to your management addresses, or reach the router over a VPN. Exposed management ports are one of the most common ways routers are compromised.
Do I need both a backup and an export?
Yes. The binary backup restores the same router quickly, while the export is readable, can be reviewed before changes, and can be applied to different hardware.
Do these steps differ on RouterOS v7?
The ideas are the same, but some commands differ, for example NTP client configuration. Check the syntax for your version and test in Safe Mode before applying firewall changes.
How often should I update RouterOS?
Read the release notes regularly and update on a schedule, for example monthly or quarterly, testing on one device first. Security fixes are the main reason to stay current.