# Block incoming winbox from non-trusted IPs
# Run: ./mikrotik-tool script edge edge-block-winbox.rsc

# Add missing RFC 1918 private ranges to trusted list
/ip firewall address-list
add address=172.16.0.0/12 list=trusted comment="RFC 1918 private"
add address=192.168.0.0/16 list=trusted comment="RFC 1918 private"

# Restrict winbox service to trusted networks only
/ip service
set winbox address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16

# Firewall drop for winbox from non-trusted sources (belt and suspenders)
# Place before "Established Input" to catch new connection attempts early
/ip firewall filter
add chain=input action=drop dst-port=8291 protocol=tcp src-address-list=!trusted comment="block winbox from non-trusted" place-before="Established Input"