tool mac-server mac-winbox set disabled=yesĮxample output after > /tool mac-server mac-winbox print This is essentially the process as above, but adding the mac-winbox option. Note: if you need MAC Telnet access, please configure it to only be on your trusted private network interfaces. While it can be extremely handy on the trusted private side of the network, you shouldn’t have a need to have this enabled on a un-trusted interface.ĭisable the MAC server on all interfaces.

The MAC server feature can be used to access the Mikrotik/RouterOS device by MAC address only, even if not IP address is set on the router. It would be best to disable all unsecured/unencrypted/unused services Verify the service has been > /ip service print Note: Firewall rules should be set up to limit access to the services that you don’t want to disable. This example command will disable the telnet service. Show the services that are available on the router.ĭisable any unused services, especially the unsecure ones such as telnet. The X in the 2nd column shows that it has been disabled. Replace ether4 with the name of the interface you want to disable. This will vary greatly depending on your hardware.įlags: D - dynamic, X - disabled, R - running, S - slave To prevent this, disable any unused interfaces. Having interfaces enabled when your router is in a publicly accessable location can mean someone can physically go up to the router, and plug a cable in. Replace ‘test’ with the name of the account you want to change it to. Its much harder to try and guess a password via brute force when you don’t know what the username is. This can help prevent people guessing usernames and passwords and subsequently gaining access to your router. In this example the default ‘admin’ username will be renamed to ‘test’. Replace ‘admin’ with the name of the account you want to change the password for.Ĭhange the admin username to be something more unique The default admin account is blank, so the first thing you need to do is change the admin password. This first point should be the most obvious.

Here are the steps to help secure your Mikrotik RouterOS router via the command line interface. As a general rule of thumb, block everything coming into your router, and poke holes in the firewall for the services you need. That is more complex and is going to be heavily dependent on your own scenario. This guide will not go into detail on configuring the firewall. This howto will outline some recommended steps you can take to secure your Mikrotik RouterOS device, be it RouterBoard, a x86 install on bare metal, or a CHR (Cloud Hosted Router). This can sometimes mean that the configuration of them isnt as simple as point and click for a new user. Mikrotik RouterOS devices are extremely powerful router devices.

Mikrotik routeros login