Hardening MikroTik routers: a practical checklist for network admins

The edge router is the first point where the internet touches your infrastructure. A router with default settings can become part of a botnet, a sniffing tool or a gateway into the internal network. This checklist is based on our experience with ISP projects.

1. Update RouterOS and firmware

Many large-scale attacks on MikroTik exploited vulnerabilities patched long before. Choose the stable or long-term channel and schedule updates.

/system package update check-for-updates
/system package update install
/system routerboard upgrade

2. User accounts

• Disable or rename the default admin user.
• Create a separate account with a strong password for every administrator.
• For software integrations (such as a CRM), create a dedicated API user in a restricted group.

/user group add name=api-crm policy=read,write,api,!ftp,!ssh,!winbox,!web
/user add name=crm-api group=api-crm address=10.10.0.5/32

3. Management services

Turn off unused services and restrict the rest to management IPs.

/ip service disable telnet,ftp,www,api
/ip service set ssh address=10.10.0.0/24
/ip service set winbox address=10.10.0.0/24
/ip service set api-ssl address=10.10.0.5/32 certificate=api-cert

If software connects to the router API remotely, use api-ssl with a certificate and never leave the plain API open to the internet.

4. Input firewall

/ip firewall filter
add chain=input connection-state=established,related action=accept
add chain=input connection-state=invalid action=drop
add chain=input protocol=icmp action=accept
add chain=input src-address-list=mgmt action=accept
add chain=input in-interface-list=WAN action=drop comment="drop all else from WAN"

5. Discovery and DNS

• Disable Neighbor Discovery and MAC Server on the WAN interface.
• If the router is not a public DNS resolver, turn off allow-remote-requests or block DNS from the WAN so it cannot be abused for DNS amplification.

/ip neighbor discovery-settings set discover-interface-list=LAN
/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN

6. Logging and backups

• Send logs to a central syslog server.
• Take regular configuration exports and encrypted backups.
• Sync the clock with NTP so logs are reliable as evidence.

7. Periodic review

Every month review users, scheduler scripts, firewall rules and proxies; attackers often persist through a scheduled script or a hidden user.

Router security is not a one-off task; it is an ongoing process.