codesecho
NET NET-001 working

MikroTik Security Hardening: 10 Checks Most People Miss

Ten RouterOS defaults that stay enabled after a clean install, why an /export will never show them to you, and the exact command to close each one.

Verified on RouterOS 7.14 6 min

There is a specific moment, usually about four minutes into an incident call, when someone pastes a router’s /export into the chat and says “the config looks fine.”

The config does look fine. That is the problem.

/export records the difference between your device and its factory state. Anything you never touched is absent — not shown as a default, not shown as off, just absent. So the services that were enabled the day the device booted are invisible in exactly the artefact everyone reviews. Ten of them are worth your attention.

1. Services listening that you never enabled

Start here, because it is the largest exposure and the easiest to miss.

/ip service print where disabled=no
 #   NAME    PORT  ADDRESS
 0   telnet    23
 1   ftp       21
 2   www       80
 3   ssh       22
 4   api     8728
 5   winbox  8291

Telnet and FTP carry credentials in plaintext. The API port has been a favourite brute-force target for years. None of these lines appear in an export unless you changed one.

Close what you do not use, and bind what you do:

/ip service set telnet disabled=yes
/ip service set ftp disabled=yes
/ip service set www disabled=yes
/ip service set api disabled=yes
/ip service set ssh address=10.10.0.0/24
/ip service set winbox address=10.10.0.0/24

The address= restriction is the part people skip. A disabled service is closed; a service reachable only from your management subnet is closed to everyone who matters and still usable by you.

Check the port numbers against your own output before you copy anything. MikroTik has changed which services ship enabled between releases, and the set on your device may not match the set above.

2. MAC-Telnet, which ignores your firewall entirely

This is the one that surprises people who have written a careful firewall.

/tool mac-server print
/tool mac-server mac-winbox print

MAC-server access operates at layer 2. It does not traverse the IP firewall, so every input chain rule you wrote is irrelevant to it. Anyone on the same broadcast domain can attempt to reach the router by MAC address.

The default allows this on all interfaces:

/interface list add name=MGMT
/interface list member add list=MGMT interface=ether2
/tool mac-server set allowed-interface-list=MGMT
/tool mac-server mac-winbox set allowed-interface-list=MGMT
/tool mac-server ping set enabled=no

Setting allowed-interface-list=none is safe only if you have another working path to the device. MAC-Winbox is how people recover a router they have locked themselves out of. Keep it on one trusted interface rather than removing it entirely.

3. Neighbour discovery advertising to the internet

/ip neighbor discovery-settings print

The default discovers on all interfaces, which means the router announces its identity, model and RouterOS version to anyone on the connected segment — including your ISP’s, if the WAN is in that set.

/ip neighbor discovery-settings set discover-interface-list=MGMT

Version disclosure is not an exploit on its own. It is how somebody decides you are worth the effort.

4. The bandwidth test server

/tool bandwidth-server print

Enabled by default, and it accepts sessions from authenticated users. A bandwidth test will saturate CPU on a small device, which makes it a denial-of-service primitive that ships switched on.

/tool bandwidth-server set enabled=no

If you genuinely use it, set authenticate=yes and restrict which users can run it, rather than leaving it open.

5. An open DNS resolver

/ip dns print

If allow-remote-requests is yes and your firewall does not block UDP/53 inbound on the WAN, the router is an open resolver and will be found by internet-wide scanning within days. It then becomes a DNS amplification reflector pointed at somebody else.

/ip dns set allow-remote-requests=no

If your LAN needs the router as its resolver, leave it enabled and block the port at the edge instead:

/ip firewall filter add chain=input in-interface-list=WAN protocol=udp dst-port=53 action=drop
/ip firewall filter add chain=input in-interface-list=WAN protocol=tcp dst-port=53 action=drop

6. Proxy, SOCKS and UPnP

/ip proxy print
/ip socks print
/ip upnp print

All three should be disabled unless you deliberately deployed them. An enabled SOCKS proxy in particular is worth treating as a compromise indicator rather than a misconfiguration — it is what the CVE-2018-14847 exploitation wave turned on.

/ip proxy set enabled=no
/ip socks set enabled=no
/ip upnp set enabled=no

7. The admin account

/user print detail

A username that every attacker already knows halves their work. Create your own account, verify you can log in with it on a second session, then remove admin:

/user add name=YOURNAME group=full password="..." address=10.10.0.0/24
# log in as YOURNAME on a separate session and confirm it works, then:
/user remove admin

The address= parameter restricts where the account may be used from, which is independent of the service restriction in check 1 and worth having as well.

8. SSH accepting weak ciphers

/ip ssh print
/ip ssh set strong-crypto=yes allow-none-crypto=no

Enabling strong-crypto disables the older ciphers and MACs. Confirm your management tooling still connects afterwards — very old jump hosts occasionally cannot.

9. RoMON

/tool romon print

RoMON is layer-2 device-to-device management, and it is genuinely useful. It is also a lateral movement path: a compromised device on the same segment can reach others through it. If it is enabled, it needs a secret set and a restricted port list. If you are not using it, confirm it is off.

10. The firmware behind the software

/system package update check-for-updates
/system routerboard print

Two separate things update on a MikroTik. /system package update handles RouterOS. The RouterBOOT firmware in the second command has its own version, and upgrading RouterOS does not upgrade it — you have to run /system routerboard upgrade and reboot. A device that has been patched for years can still be running original bootloader firmware.

Run all ten

/ip service print where disabled=no
/tool mac-server print
/ip neighbor discovery-settings print
/tool bandwidth-server print
/ip dns print
/ip proxy print
/ip socks print
/ip upnp print
/user print detail
/ip ssh print
/tool romon print
/system routerboard print

Twelve commands, about ninety seconds. Then run /export and compare: almost nothing you just looked at will be in it, which is the entire point.

What to do next

Fix the findings on one device, then write the results down somewhere durable — the value is in doing this identically on every router you run, not in doing it once carefully. The next article in this track covers whether a device that was exposed during the CVE-2018-14847 window is still carrying the artefacts of it.