You've got a handful of trusted admin IPs that need access to WinBox, and that list changes every so often — someone's home IP changes, a new technician joins, an old one leaves. If those addresses are hardcoded directly into individual firewall rules, every change means hunting down and editing every rule that mentions one of them, on every router. That doesn't scale past a couple of routers, and it's easy to miss one.
Create the address list
An address list is just a named, reusable set of addresses:
/ip firewall address-list add list=allowed-admins address=203.0.113.5Add more entries, including ranges
Add as many individual IPs or subnets as you need — they all share the same list name:
/ip firewall address-list add list=allowed-admins address=203.0.113.0/28
/ip firewall address-list add list=allowed-admins address=198.51.100.20Reference the list in a firewall rule
Instead of a specific src-address, match against the list by name. This rule needs to sit before any general drop rule for WAN traffic:
/ip firewall filter add chain=input src-address-list=allowed-admins dst-port=8291 protocol=tcp action=acceptUpdate the list, not the rule, going forward
Someone leaves the team? Remove their IP from the list. Someone new needs access? Add theirs. The firewall rule itself never has to be touched again:
/ip firewall address-list remove [find list=allowed-admins address=198.51.100.20]
/ip firewall address-list add list=allowed-admins address=198.51.100.40Why do it this way
An address list separates "who is trusted" from "what trusted people are allowed to do" — those are two different questions that change at different rates and for different reasons, and mixing them into one big pile of hardcoded rules makes both harder to reason about. With a list, the set of trusted IPs lives in exactly one place, so every rule that references allowed-admins updates automatically the moment you change the list — no risk of updating three rules out of four and forgetting the last one.
How MoniTik helps
This is the same underlying mechanism MoniTik uses for its Remote WinBox allowlist — a list of addresses per device that controls who's allowed to reach it through the tunnel, managed from one screen instead of router by router. If you're already using MoniTik for remote access, this pattern should feel familiar; if you're not, it's worth trying the same idea locally on any router where more than one person needs admin access.
Santiago spends his days on rooftops and in racks, keeping MikroTik links online for local ISPs.