How can we help you?

Summary:
Properly securing your Mikrotik router is essential to protect your network from unauthorized access, exploitation, and configuration tampering. Here are basic security practices every user should implement.

1. Change the Default Admin Password

Never keep the default login:

• Username: admin
• Password: (blank)

Change it immediately after the first login to a strong password.

To change it:
System > Users > admin > Password

Or via Terminal:

2. Disable Unused Services

Reduce attack surface by disabling services you don’t use:

1. Go to IP > Services
2. Disable unnecessary services like ftp, telnet, or www

Or via CLI:

TIP: Keep only what you use (e.g., WinBox, ssh, api, or www-ssl).

3. Limit Access to Trusted IPs

Restrict remote management to specific IPs:

1. Go to IP > Services, double-click a service (e.g., WinBox)
2. In Available From, enter allowed IP range (e.g., 192.168.1.0/24)

Or via CLI:

4. Create Non-Admin Users

Don’t share the admin account. Create user-specific accounts with appropriate roles (read, write, full).

Example:

5. Enable Basic Firewall Protection

Block unwanted traffic from the internet:

TIP: Adjust ether1 to match your WAN interface.

6. Keep RouterOS Updated

• Use System > Packages > Check for Updates
• Click Download & Install

Stay on the stable channel unless you need specific features.

7. Backup Your Config Regularly

Use .backup and .rsc files to prevent data loss in case of failure.

8. Disable MAC Server on WAN Interfaces

Prevent WinBox MAC access from the internet:

Go to Tools > MAC Server > Interface, and uncheck your WAN ports.

9. Monitor Logs and Login Attempts

Check logs regularly under Log or via:

10. Use Strong Passwords and Rotate Them

Avoid simple or reused passwords. Use a secure password manager if needed.