tool mac-server mac-winbox set allowed-interface-list=none tool mac-server set allowed-interface-list=none The particular services should be shutdown on production networks. RouterOS has built-in options for easy management access to network devices. ip service set winbox address=192.168.88.0/24 RouterOS MAC-access ip service disable telnet,ftp,www,api,api-sslĪnd also change the default port, this will immediately stop most of the random SSH bruteforce login attempts:Īdditionaly each /ip service entity might be secured by allowed IP address (the address service will reply to)

Most of RouterOS administrative tools are configured at Note, that in newest Winbox versions, 'Secure mode' is ON by default, and can't be turned off anymore. Use the latest Winbox version for secure access. Note: login to router with new credentials to check that username/password are working.Īll production routers have to be administred by SSH, secured Winbox or HTTPs services. user add name=myname password=mypassword group=full We suggest you to follow announcements on our security announcement blog to be informed about any new security issues.Ĭhange default username admin to different name, custom name helps to protect access to your rotuer, if anybody got direct access to your router. Click 'check for updates' in Winbox or Webfig, to upgrade. Keep your device up to date, to be sure it is secure.

Some older releases have had certain weaknesses or vulnerabilities, that have been fixed. Start by upgrading your RouterOS version.

Routeros version 7