Securing MikroTik Routers Against Common Attacks
A practical checklist for closing the ports that get scanned constantly, plus the five changes that actually stop most compromises — written for operators running RouterOS on real subscriber-facing networks.
MikroTik routers get scanned constantly — not because anyone specifically targets you, but because RouterOS's management ports (Winbox, Telnet, the API, sometimes FTP) sit on the same well-known port numbers on every deployment. Bots sweep public IP ranges looking for exactly these ports, all day, every day. If your WAN interface has a public IP — including a Starlink or fiber setup with any reachable port — it's already being probed.
This isn't a theoretical risk. Compromised MikroTik routers have been used in real botnets, mostly through two mistakes: default or weak passwords, and management ports left open on the WAN side. Both are fixable in a few minutes.
The five things that actually matter
1. Close Winbox, Telnet, FTP, and the API on the WAN interface
This is the single highest-impact change you can make. None of these services need to be reachable from the public internet — you manage the router from your LAN, or through a VPN if you need remote access. The NAT + Firewall Generator on this site builds this rule for you automatically.
Need remote management? Don't leave Winbox open — set up a WireGuard tunnel instead and manage the router as if you were on the LAN.
2. Change every default password, including the RADIUS shared secret
The admin account with no password, or a weak one, is still the #1 way MikroTik routers get compromised. Use a long, random password for the router itself, and a separate strong shared secret for RADIUS — never reuse the router's admin password there.
3. Rate-limit connection attempts to router services
Even with management ports closed on the WAN, it's worth adding a rule that temporarily blacklists any address making repeated connection attempts to router services — a basic defense against brute-force scanning before it even gets to the login prompt. This is a checkbox option in the NAT + Firewall generator.
4. Keep RouterOS updated — but test before rolling out fleet-wide
MikroTik ships security patches regularly. Running years-old RouterOS versions on subscriber-facing routers is a common way vulnerabilities stay open long after they're publicly known. That said, don't push an update to your whole network at once — test on one router first, since RouterOS updates occasionally change default behavior.
5. Don't trust the LAN side either
A firewall rule set that only hardens the WAN interface still leaves the router open to anything already on your network — a compromised subscriber device, a misconfigured access point. The forward-chain rules in both the PPPoE and Hotspot generators on this site (drop invalid connections, accept established/related) apply regardless of which side traffic comes from.
Quick checklist
| Item | Why it matters |
|---|---|
| Winbox, Telnet, FTP, API closed on WAN | Removes the ports bots scan for first. |
| SSH closed on WAN unless needed | Same exposure risk as Winbox/Telnet. |
| Strong, unique admin password | Still the most common way routers get taken over. |
| Strong, unique RADIUS shared secret | Never reuse the router's admin password here. |
| Brute-force rate-limiting enabled | Blocks repeated login attempts automatically. |
| RouterOS version current, tested first | Closes known vulnerabilities without breaking your fleet. |
| Remote management via VPN, not exposed Winbox | Keeps management traffic off the public internet entirely. |
Generate a hardened config now
The NAT + Firewall Generator builds all of the WAN-side hardening above into one script, ready to import.
Open the NAT + Firewall Generator →