MikroTik Router Security Checklist for ISPs

This MikroTik security checklist is written for hotspot or home internet business owners in Kenya who may or may not have an engineering background. Your router is what sits between the internet and all of your customers, and all of those M-Pesa payments go through the walls of networks surrounding it. If someone takes over that router, then they can steal bandwidth from strangers, have your internet line blacklisted for spam, expose your customers' devices, or have your billing stop working. Hackers do not target small ISPs. Automated scanners simply sweep the internet all day and try every router they find.

The quick version

• Back up your configuration before any change.
• Update RouterOS and the router's firmware.
• Create your own admin user, then disable the default one.
• Turn off services you do not use, such as telnet, FTP and the plain web page.
• Restrict Winbox and SSH to your management addresses only.
• Add firewall rules that drop unwanted traffic aimed at the router.
• Turn on customer isolation, so one customer cannot attack another.
• Block outbound email (port 25) and file sharing ports from customers.
• Protect the link to your billing server with a strong secret and a VPN.
• Send logs to another server and keep the router's clock correct.
• Lock the router away from customers.

Before you touch anything

Three habits will save you from the most painful mistakes.

Back up first. Save a binary backup and a readable export of your configuration before every change. The binary backup restores a router fast, and the export lets you read exactly what is set.

/system backup save name=before-hardening

/export file=before-hardening

Use Safe Mode. In Winbox, the Safe Mode button undoes your changes if your connection drops. On the command line, press Ctrl+X to turn it on. If a firewall rule locks you out, Safe Mode rolls it back.

Test on a spare router first. The commands below are examples for RouterOS 7. Menus and names differ in older versions, so check your version before you copy anything, and never paste commands into a live router you cannot reach physically.

1. Update RouterOS and the firmware

Old software is the biggest risk. A Winbox bug from 2018 let attackers read passwords from unpatched routers, and large numbers of routers were taken over because their owners never updated. Updates fix holes like that one.

Open the package check in your router, install the latest version from the stable or long-term channel, and reboot. Then upgrade the RouterBOARD firmware, which is separate, and reboot once more. Put a reminder in your calendar to repeat this every month or two, and read the release notes before upgrading routers that carry paying customers.

2. Fix the logins

The default setup has an admin account, and attackers know that. Create your own user with a strong password, log in with it, then disable the old one.

/user add name=youradmin group=full password=a-long-strong-password

/user disable admin

Use a long passphrase, not a short word with numbers on the end. Give junior staff a lower-privilege group, such as read-only, instead of full access. For extra safety, set up SSH keys and turn off password login for SSH. And do not share one admin account among several people, because you lose track of who changed what.

3. Turn off what you do not use

Every running service is another door. List them and close what you do not need.

/ip service print

/ip service disable telnet,ftp,www,api,api-ssl

Keep only what you use, such as Winbox and SSH, and restrict them to trusted addresses.

/ip service set winbox address=10.10.10.0/24

/ip service set ssh address=10.10.10.0/24

Swap in your own management network. Then tidy up the extras. Disable neighbour discovery and the MAC server on customer and internet-facing interfaces, since they announce your router to anyone nearby. Turn off the bandwidth test server, the proxy, SOCKS and UPnP unless you truly use them.

/ip neighbor discovery-settings set discover-interface-list=LAN

/tool mac-server set allowed-interface-list=LAN

/tool mac-server mac-winbox set allowed-interface-list=LAN

/tool bandwidth-server set enabled=no

/ip proxy set enabled=no

/ip socks set enabled=no

/ip upnp set enabled=no

4. Build a proper firewall

A router with no firewall rules answers anyone who asks. Start by sorting your interfaces into two lists, one for the internet side and one for your own network.

/interface list add name=WAN

/interface list add name=LAN

/interface list member add list=WAN interface=ether1

/interface list member add list=LAN interface=bridge

Then protect the router itself with input rules. The idea is simple: allow replies to your own traffic, allow your own network in, and drop everything else.

/ip firewall filter

add chain=input connection-state=established,related action=accept

add chain=input connection-state=invalid action=drop

add chain=input protocol=icmp action=accept

add chain=input in-interface-list=LAN action=accept

add chain=input action=drop comment="drop everything else"

Add any exceptions above the final drop rule, such as a VPN port or your billing server. Then protect traffic passing through the router, with forward rules.

add chain=forward connection-state=established,related action=accept

add chain=forward connection-state=invalid action=drop

add chain=forward connection-nat-state=!dstnat connection-state=new in-interface-list=WAN action=drop

The last rule blocks new connections from the internet into your customers' devices, unless you have set up port forwarding on purpose. Rule order matters, because the router reads from the top and stops at the first match.

5. Do not be an open DNS server

Hotspot routers often act as the DNS server for customers, which is fine. But if the router also answers DNS questions from the internet, attackers can use it to hit others with traffic, and your upstream provider may cut you off.

/ip dns set allow-remote-requests=yes

Keep that on only if customers need it, and make sure your input firewall drops DNS from the WAN side. The input rules above already do this, which is why the final drop rule matters so much.

6. Keep customers away from each other

On a shared Wi-Fi network, customers sit on the same network as other customers. Without isolation, one person can scan and attack another person's phone or laptop. Turn on client isolation on your wireless interfaces or access points, and in CAPsMAN turn off client-to-client forwarding. Keep management addresses on a separate network that customers cannot reach.

Rogue DHCP is another risk. A customer plugging in a home router can start handing out wrong addresses and break your network. On RouterOS 7, DHCP snooping on the bridge, with only your real server port marked as trusted, stops that. Check the current documentation for your version before you enable it.

7. Block the usual abuse from customers

As an ISP, what your customers do reflects on you. A few simple blocks protect your reputation and your upstream line.

Outbound port 25. Block direct email sending from customers, because infected devices send spam and get your address blacklisted.

Windows file sharing ports. Block ports 135, 137, 139 and 445 outbound, which attackers scan for.

Fake source addresses. Turn on reverse path filtering so packets pretending to come from another network get dropped. Loose mode is the safer starting point, since strict mode can break setups with more than one internet line.

SYN cookies. Turn them on to help against floods of fake connection requests.

/ip settings set rp-filter=loose tcp-syncookies=yes

8. Protect the link between your router and billing

If your router checks RADIUS for every customer, that link carries decisions about who may connect and what they pay. Treat it carefully.

Use a long, random shared secret, and different secrets for different routers where you can. Do not expose RADIUS ports to the open internet. Run the traffic through a VPN, such as WireGuard on RouterOS 7, between your router and the billing server. A VPN also solves a practical problem, because routers behind carrier-grade NAT cannot be reached from outside, and disconnect messages from the server need a path in.

If you accept disconnect messages from the billing server, allow that port only from the server's address.

/radius incoming set accept=yes

/ip firewall filter add chain=input protocol=udp dst-port=3799 src-address= action=accept place-before=0

Adjust the rule placement so it sits above your final drop rule. The hotspot login page deserves care too. If customers type usernames and passwords, serve the login page over HTTPS so those details are not sent in the open.

9. Log, monitor and keep the clock right

You cannot fix what you never see. Set the router's time through NTP first, because logs with the wrong time are useless when you try to work out what happened. Send logs to a separate server, so an attacker who breaks in cannot wipe the evidence.

/system ntp client set enabled=yes

/system logging action add name=remote target=remote remote=

/system logging add topics=system,error,critical,warning action=remote

Watch CPU, memory and traffic with graphs, or a tool such as The Dude or an SNMP monitor. A sudden jump in traffic or CPU at odd hours is often the first sign of trouble. If you use SNMP, restrict it to your monitoring server and avoid the default community name.

10. Protect the box itself

Physical access beats software security. Anyone with a hands-on reach can press the reset button. Put routers in a locked cabinet or room, away from customers. RouterBOARD hardware also has a protected boot option that limits what the reset button and boot menu can do. Read the documentation carefully before you turn it on, because if you lose your login, it makes recovery harder.

Keep a written record of every router: its model, version, location and who has access. Routers you have forgotten about are the ones that stay unpatched for years.

If you think a router has been hacked

Signs include users you did not create, strange scheduled tasks, DNS settings you did not set, traffic you cannot explain, and settings that change back after you fix them. Act in this order.

Disconnect the router from the internet, if you can do it safely.

Look for leftovers. Check users, scheduler, scripts, static DNS entries, NAT rules, proxy and SOCKS settings, and the service list.

Reset the router fully, without keeping its old configuration.

Update RouterOS and the firmware before it goes back online.

Rebuild from a clean configuration. Do not restore an old backup unless you have checked every line.

Change every password that touched the router, including RADIUS secrets and VPN keys.

Then work out how they got in. If you do not find the cause, it will happen again.

Common questions

How do I secure a MikroTik router?

The basic process begins with backing up your current configuration, updating RouterOS and creating your own admin account. The next steps involve disabling unneeded services, limiting management access and deploying a firewall which drops unwanted packets. The paragraphs above walk through the process one step at a time.

Is MikroTik safe for use as an ISP?

Yes, provided it's properly configured. Default configurations and unneeded services are often the source of a security breach, not the hardware itself. A hardened MikroTik is a great option for a Wi-Fi business.

What should I do immediately after setting up a new MikroTik?

The first order of business is to backup the default configuration, then update RouterOS and the firmware. This procedure completes before the router goes live (with customers).

Should I delete or disable the default admin account or change the password?

It's a good idea to create a user account with a strong password first, and test the credentials. After verifying that everything works as intended, you can disable the default account. It's much easier for an attacker to guess a username than a strong password, especially if they already know the default admin account exists.

Do I need a firewall if I only have a hotspot?

Yes, you should still implement firewall rules. While the hotspot login page authenticates users and limits internet access, it doesn't protect the router itself. Without proper rules in place, anyone with an IP address can access your router.

Can users on my Wi-Fi network attack my router or each other?

It's possible, but with the proper rules in place, the risk is mitigated. Isolated (customer) networks, a management VLAN and firewall rules on the LAN interfaces limit the damage.

Will the changes affect my billing?

It depends on what rules you're adding. If you have a RADIUS or disconnect service configured, you will want to make sure that the ports they use are not being blocked. Consult your billing provider's documentation about the required ports and test on a spare router if possible. Noch Wired has some MikroTik specific guides on its blog that can help.

How often should I update RouterOS?

Check for updates every month or so and review the changelog for each version. Only apply them to production routers if there aren't any security fixes listed.