Firewall · Topic 4 of 7

Default Configuration and Management Access

Read the RouterOS default firewall configuration and learn best practices to limit management access with address lists, service settings and strong SSH.

  • 5 min
In a nutshell
  • The default configuration depends on the model and the RouterOS version.
  • The default input chain drops everything that is not from the LAN, after accepting established, related and untracked.
  • The default setup uses masquerade on the WAN interface.

What it is

The default configuration is the setup that many MikroTik routers apply on first start, and it already includes a safe firewall.

Management access is the set of ways that an administrator reaches the router, such as SSH, WinBox and the web interface. These are the paths an attacker also wants.

The two topics belong together. The default rules guard the management services, and you improve them by narrowing who may connect.

Administratortrusted addressallowed byInput chainfirewall rulesreachesServiceSSH or WinBoxInternetunknown addressdropped byInput chain

How it works

The default setup protects the router with a short, readable rule set that you can learn and extend.

What the default configuration contains

The exact content depends on the model and on the RouterOS version. A typical home or office router gets the following.

  • A LAN address range, with one port or a bridge as the LAN side.
  • A DHCP server for the LAN clients.
  • A WAN port with a DHCP client.
  • A source NAT rule with action=masquerade on the WAN side.
  • Firewall rules that protect the router and the clients.

Depending on the model and version, the admin account may have an empty password or a unique password from the device label. Always check this and set a strong password.

/system default-configuration print
/ip firewall filter print
/ip firewall nat print

The default filter rules

The default input chain follows the stateful pattern from the previous page.

  1. Accept established, related and untracked packets.
  2. Drop invalid packets.
  3. Accept ICMP.
  4. Accept everything that arrives from the LAN interface list.
  5. Drop everything else.

The default forward chain accepts established and related traffic, drops invalid traffic, and lets only redirected new connections come in from the WAN. In short, the LAN may talk out, but the WAN may not start connections in.

Resetting and starting clean

You can wipe the router and apply the defaults again, or remove the defaults and start with an empty configuration.

/system reset-configuration
/system reset-configuration no-defaults=yes skip-backup=yes

The second command removes all configuration and the default script. Use it when you plan to write your own full configuration.

Best practices for management access

Most attacks on a router come from the internet, so limit management to the LAN or to named admin addresses.

/ip firewall address-list add list=mgmt address=192.168.88.0/24
/ip firewall address-list add list=mgmt address=198.51.100.25
/ip firewall filter add chain=input src-address-list=mgmt action=accept place-before=0
/ip firewall filter add chain=input action=drop

The list holds trusted addresses. The first rule accepts management from them, and the last rule drops everything else.

Limit the services as well

The firewall is the first layer. The service settings are a second layer, which still protects the router if a rule is removed by mistake.

/ip service disable telnet,ftp,www,api,api-ssl
/ip service set ssh address=192.168.88.0/24
/ip service set winbox address=192.168.88.0/24

Stronger SSH and keys

SSH can use public keys instead of passwords. You import the key for a user and then disable password login.

/ip ssh set strong-crypto=yes
/user ssh-keys import public-key-file=admin-key.pub user=netops

The strong-crypto setting makes SSH use stronger algorithms. Some old clients cannot connect when it is on. Newer RouterOS versions also have a setting under /ip ssh to refuse password login for users that have a key, so check /ip ssh print on your version.

More good habits

HabitReason
Use a separate named account per personYou can see who did what in the log
Use groups with only the needed rightsA stolen read only account does less harm
Limit MAC server and discovery to the LAN listThey can expose the router on a shared segment
Log login eventsYou can notice repeated failures
Check /user active printYou see who is logged in now
Exam tip

Use a firewall address list for administrators. When an address changes you edit one list entry and not every rule.

What to remember for the exam

Seven facts summarise this topic.

  • The default configuration depends on the model and the RouterOS version.
  • The default input chain drops everything that is not from the LAN, after accepting established, related and untracked.
  • The default setup uses masquerade on the WAN interface.
  • /system reset-configuration no-defaults=yes starts with an empty configuration.
  • Limit management with an address list on the input chain and with the address setting of /ip service.
  • Disable services that you do not use, such as telnet and FTP.
  • SSH keys and /ip ssh set strong-crypto=yes improve SSH security.

Common mistakes

Four mistakes are common here.

Assuming the default password is safe. Some models still start with an empty password, so set a strong one at once.

Adding the drop rule before the accept rule for the admin list. Your own session is then dropped. Use place-before or move to fix the order.

Restricting a service but leaving the firewall open. One layer is not enough. Use both the firewall and the service address setting.

Turning off password login before the key works. Test the key login in a second session first.

Watch out

Resetting the configuration removes users, rules and addresses. Make a backup and an export before you run it on a router you cannot reach by console.

Check yourself

Work through these three questions.

  • What does the default input chain do with traffic that does not come from the LAN?

    It drops it, after the established, related and untracked packets have been accepted and invalid packets dropped.

  • How can you start a router with no default configuration at all?

    Run /system reset-configuration no-defaults=yes. This removes the configuration and the default script.

  • Why restrict management both in the firewall and in /ip service?

    Two layers protect the router even if one layer fails or a rule is removed by mistake.

Topic 4 of 7 in Firewall

Test yourself on Firewall

The full MikroTik MTCSE question bank has 446 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.