Opening WinBox to the internet is the fastest way to manage a router remotely, which is exactly why so many routers are configured that way and then forgotten. The trouble is that port 8291 on a public IP is found by automated scanners quickly, and from then on the router is being probed for weak passwords and known vulnerabilities around the clock. If you have ever told a client "just open the port so I can get in", this note is for you.
Check what your router exposes right now
On the router, list the services and the firewall rules that protect the input chain:
/ip service print
/ip firewall filter print where chain=inputThen test from outside, on a different network such as a phone hotspot, against the router's public IP:
nmap -Pn -p 8291,8728,8729,22,23,80 <public-ip>Anything reported as open is reachable by every scanner on the internet. A router behind CGNAT may look safe, but check anyway: a misconfigured upstream device can still expose it.
Understand why this is not a theoretical risk
In 2018 a vulnerability in WinBox (CVE-2018-14847) let attackers read credentials from RouterOS devices without logging in, and it was exploited at scale on exposed routers. It was fixed in RouterOS 6.42.1 and later, but the lesson holds: the management service is the most valuable target on your router, and keeping it reachable from anywhere means trusting that the next flaw will be patched before someone finds it. Weak or default passwords make it worse, since an exposed login is also a brute-force target.
Restrict each service to the addresses that need it
The simplest fix is telling RouterOS to answer only to known addresses. Replace the example with your management network:
/ip service set winbox address=192.168.88.0/24
/ip service set ssh address=192.168.88.0/24
/ip service set api address=192.168.88.0/24
/ip service disable telnet,ftp,www,api-sslDisable what you do not use. Be careful to include your own current address before applying, or you will cut your own session.
Drop unsolicited input traffic from the WAN
Service restrictions are a good first layer, but the firewall should be the main one. The order matters, because rules are evaluated top to bottom:
/interface list add name=WAN
/interface list member add list=WAN interface=ether1
/ip firewall filter add chain=input connection-state=established,related action=accept comment="allow replies"
/ip firewall filter add chain=input src-address-list=mgmt action=accept comment="trusted management"
/ip firewall filter add chain=input in-interface-list=WAN action=drop comment="drop everything else from WAN"The mgmt address list holds the addresses allowed to manage the router. Put your accept rules above the drop rule and test from a second session before closing your first one.
Reach the router through a tunnel instead of an open port
If you need to manage the router from anywhere, let the router open an outbound tunnel (WireGuard or SSTP) to something you control, and run WinBox over that tunnel. The router then exposes nothing to the internet, and it also works when the router sits behind CGNAT with no public IP. There are separate notes on this blog for setting up both WireGuard and SSTP tunnels.
Close the layer-2 backdoors too
WinBox can also be reached by MAC address, and RouterOS announces itself through neighbor discovery. Limit both to your LAN so neither is offered on the WAN side:
/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN
/ip neighbor discovery-settings set discover-interface-list=LANThis assumes you already have a LAN interface list. Then repeat the nmap test from step one and confirm the ports no longer answer.
Why do it this way
Every service you leave open to the internet is something you must keep patched, monitor and defend forever. A tunnel or an allowlist replaces that permanent exposure with one narrow, controlled path. The change is small and takes minutes, while the alternative is discovering, after the fact, that a router was compromised and has been used to attack others or to reconfigure your network. Treat any management port reachable from the whole internet as a finding to fix, not a convenience to keep.
How MoniTik helps
MoniTik's remote WinBox is built around this idea. The router connects out to the platform through an encrypted tunnel, so there is no open port on its public IP, and it keeps working behind CGNAT or Starlink. WinBox access is then limited to the source addresses you authorize for that client, so even a leaked link does not give a stranger a way in. You get the convenience of managing the router from anywhere without publishing it to the scanners.
Mateo supports wireless ISPs running MikroTik gear, from first install to day-two troubleshooting.