Introduction · Topic 3 of 3

RouterOS Security Deployment Checklist

A practical checklist for deploying a MikroTik router securely: updates, users, services, discovery, firewall, logging and backups, with console examples.

5 min

In a nutshell

Update RouterOS and the RouterBOARD firmware regularly.
Replace the factory admin password and avoid shared accounts.
Disable every management service that you do not use.

What it is

Security deployment is the set of steps you take to make a new or existing router safe before it carries real traffic.

A router that works is not the same as a router that is secure. The default setup is a starting point, and you must close what you do not use.

A good way to remember the work is to follow the layers. Start with the software, then users, then services, then the firewall, and finally the records.

How it works

Each step removes one way in, and together they shrink the attack surface.

Keep the software current

New RouterOS releases fix security problems. Check for updates on a schedule and read the release notes before you upgrade.

/system package update check-for-updates
/system package update install
/system routerboard upgrade

The last command upgrades the firmware on a RouterBOARD device. It needs a reboot to take effect.

Protect the users

Every router needs a unique, strong password. Do not keep the factory password on the built in admin account, because some devices ship with an empty one.

/user add name=netops group=full password=UseALongPassphrase
/user disable admin

Give each person their own account, and use a group with fewer rights where full access is not needed. Test the new account before you disable the old one.

Close the services you do not use

RouterOS runs several management services. Turn off the ones that you do not need, and limit the others to trusted addresses.

/ip service disable telnet,ftp,www,api,api-ssl
/ip service set ssh address=192.168.88.0/24
/ip service set winbox address=192.168.88.0/24

Other services can leak information or offer an entry point if they are left on.

/tool bandwidth-server set enabled=no
/ip dns set allow-remote-requests=no
/ip proxy set enabled=no
/ip socks set enabled=no
/ip upnp set enabled=no

Only turn off DNS requests from outside if no client uses the router as a resolver.

Reduce discovery on untrusted ports

RouterOS can announce itself with neighbour discovery and can accept MAC level management. Limit both to your trusted interfaces.

/interface list add name=LAN
/interface list member add list=LAN interface=bridge
/ip neighbor discovery-settings set discovery-interface-list=LAN
/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN

Add a firewall and keep records

The firewall protects the router itself on the input chain and the clients on the forward chain. The next chapter covers the rules in depth.

Logs and backups let you notice problems and recover from them. Save a binary backup and a text export, and store them off the router.

/system backup save name=before-change
/export file=config-export
/system logging add topics=firewall action=memory

A binary backup restores the same device well. A text export is readable and can be edited and moved to another model.

Summary of the checklist

Area	Action
Software	Update RouterOS and firmware
Users	Strong unique passwords, disable unused accounts
Services	Disable what is not needed, limit by address
Discovery	Limit neighbour discovery and MAC server to a trusted list
Firewall	Protect the input and forward chains
Records	Backups and logging

Exam tip

Change one thing at a time and test after each change. Use safe mode so that a mistake rolls back when your session drops.

What to remember for the exam

Seven points make a good summary.

Update RouterOS and the RouterBOARD firmware regularly.
Replace the factory admin password and avoid shared accounts.
Disable every management service that you do not use.
Use the address parameter of /ip service to limit who can connect.
Limit neighbour discovery and the MAC server to trusted interface lists.
Turn off bandwidth server, proxy, socks and UPnP when they are not needed.
Keep both a backup and an export, and store them away from the router.

Common mistakes

Four mistakes appear most often in real deployments.

Disabling the only account you can still use. Create and test the new user first, then disable admin.

Locking yourself out with an address limit. If you restrict a service to a subnet that you are not in, the next connection fails. Check your own address before you save the change.

Updating RouterOS but not the firmware. The package upgrade and the firmware upgrade are two separate steps.

Keeping the backup on the router only. If the device fails or is wiped, the backup is lost with it.

Watch out

A binary backup may hold sensitive data and is meant for the same device. Keep it private and do not post it in a support forum.

Check yourself

Work through these three questions.

Which command limits the SSH service to one subnet?
Use /ip service set ssh address=192.168.88.0/24 with your own trusted subnet. Only addresses in that range can then connect.
Why are the package upgrade and the firmware upgrade separate steps?
RouterOS packages and the RouterBOARD firmware are different software. The firmware upgrade is done with /system routerboard upgrade and needs a reboot.
Why keep both a binary backup and a text export?
A binary backup restores the same device well. A text export is readable and can be edited and moved to another model.

Topic 3 of 3 in Introduction

Test yourself on Introduction

The full MikroTik MTCSE question bank has 446 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.