graham/network
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
network/secure.md
Graham McIntire d0d1667991
update
2026-07-19 14:42:02 -05:00

2.1 KiB
Raw Permalink Blame History

MikroTik Router Management Access Hardening

These commands restrict API, Winbox, and SSH access to only trusted subnets (CGNAT, VNTX public IPs, and private RFC 1918 space).

Apply to every router in the fleet. The address list is the same on all routers so the management ACL is consistent regardless of which tower you're connecting from.

1. Create the trusted address list

/ip firewall address-list
add address=204.110.188.0/22 comment="VNTX public IPs" list=trusted
add address=100.64.0.0/10 comment="CGNAT pools" list=trusted
add address=10.0.0.0/8 comment="RFC 1918 private" list=trusted
add address=192.168.0.0/16 comment="RFC 1918 private" list=trusted

2. Drop non-trusted traffic to management services

Place these at the top of /ip firewall filter chain=input (before any existing accept rules for management ports). The place-before=0 puts them at position 0 and 1 — adjust the number if you already have rules at the top that must stay there.

/ip firewall filter
add action=accept chain=input comment="allow trusted to management services" dst-port=8728-8729,8291,22 protocol=tcp src-address-list=trusted place-before=0
add action=drop chain=input comment="drop untrusted to management services" dst-port=8728-8729,8291,22 protocol=tcp place-before=1

Ports covered:

  • 8728 — API (plaintext, if ever used)
  • 8729 — API-SSL
  • 8291 — Winbox
  • 22 — SSH

3. Verify

/ip firewall address-list print where list=trusted
/ip firewall filter print chain=input where dst-port~"8728|8729|8291|22"

Notes

  • The accept rule must come before the drop rule (lower number = earlier in the chain).
  • If a router already has an accept for dst-port=22,8291 etc. without a source filter, remove it or place these new rules above it — otherwise the broad accept will match first and the drop will never fire.
  • IPv6 management access is not covered here. If you want the same for v6, mirror the rules in /ipv6 firewall filter chain=input using the v6 equivalents of those subnets.
  • After applying, test from a trusted source IP before closing the session — a misordered rule can lock you out.