Securing the Router · Topic 2 of 3

Secure Connections and Default Service Ports

Know the RouterOS management services and their default ports, and how to use HTTPS, SSH and WinBox securely with certificates and address limits.

4 min

In a nutshell

Default ports are ftp 21, ssh 22, telnet 23, www 80, www-ssl 443, winbox 8291, api 8728 and api-ssl 8729.
Telnet, FTP, www and api send data in clear text.
SSH, www-ssl and api-ssl are encrypted. The last two need a certificate.

What it is

RouterOS offers several ways to manage the router, and each one listens on a known port.

Some of these services are encrypted and some are not. A secure setup uses only the encrypted ones, and limits them to trusted addresses.

You must know the default ports for the exam. They also tell you how to read firewall rules and scan results.

How it works

You choose encrypted services, assign certificates where needed, and restrict every service by address.

Services and default ports

Service	Default port	Encrypted	Note
ftp	21	No	Disable it
ssh	22	Yes	Command line and file transfer
telnet	23	No	Disable it
www	80	No	Plain web interface
www-ssl	443	Yes	Needs a certificate
api	8728	No	Plain API
api-ssl	8729	Yes	Needs a certificate
winbox	8291	Yes, in current versions	WinBox tool

/ip service print

The listing shows each service, its port, its allowed addresses and any certificate. A disabled service is marked in the list.

The secure choices

For each clear text service there is a secure partner. Use the partner and disable the original.

Instead of	Use
telnet	ssh
ftp	ssh for file transfer
www	www-ssl
api	api-ssl

HTTPS

HTTPS needs a certificate on the www-ssl service. After you assign it, the web interface uses an encrypted session. You can also restrict the TLS version.

/ip service set www-ssl certificate=router-cert tls-version=only-1.2 disabled=no
/ip service disable www

Disabling the plain www service removes the unencrypted option. Newer versions have a tls-version setting that rejects older protocol versions, though some very old clients will no longer connect.

SSH

SSH encrypts the session and can use public keys. Use strong cryptography and keys, and keep password login only where you must.

/ip ssh set strong-crypto=yes
/user ssh-keys import public-key-file=admin-key.pub user=netops
/ip service set ssh address=192.168.88.0/24

WinBox

WinBox is the graphical tool and uses its own port. Newer WinBox versions use a safe password exchange and encrypt the session. Very old versions did not, so keep RouterOS and WinBox updated.

/ip service set winbox address=192.168.88.0/24
/tool mac-server mac-winbox set allowed-interface-list=LAN

The second line limits MAC level WinBox access to the LAN interface list. MAC access works at Layer 2 and does not use the IP firewall in the same way, so keep it limited.

Restrict by address

Every service has an address setting. If you set it, the service accepts connections only from those addresses.

/ip service set ssh address=192.168.88.0/24,198.51.100.25/32
/ip service set www-ssl address=192.168.88.0/24

This works together with the input chain rules. Use both layers.

Changing the port

You can change a service port. It hides the service from the most basic scans.

/ip service set ssh port=2222

This is not real protection, because a port scan finds the new port. If you change a port, update your firewall rules and your clients.

Exam tip

Memorise the six numbers 21, 22, 23, 80, 443 and 8291, then add 8728 and 8729 for the API.

What to remember for the exam

Eight facts cover this topic.

Default ports are ftp 21, ssh 22, telnet 23, www 80, www-ssl 443, winbox 8291, api 8728 and api-ssl 8729.
Telnet, FTP, www and api send data in clear text.
SSH, www-ssl and api-ssl are encrypted. The last two need a certificate.
Disable the clear text service when you use its secure partner.
Use the address setting of /ip service to limit who can connect.
Use /ip ssh set strong-crypto=yes and SSH keys for stronger SSH.
Changing a port only hides the service. It is not security.
/ip service print lists the services, ports and limits.

Common mistakes

Four mistakes are common.

Enabling www-ssl but leaving www on. Users and scripts can still use the plain version, so disable it.

Forgetting the certificate. The www-ssl and api-ssl services need one to work properly.

Changing the port and forgetting the firewall. The rule that allows the old port now blocks you.

Assuming MAC access is limited by the IP firewall. Limit it with the MAC server settings instead.

Watch out

Do not disable the only service that you are using at the moment. Open a second session first and test it.

Check yourself

Work through these three questions.

What are the default ports for SSH, HTTPS and WinBox?
SSH uses port 22, HTTPS on www-ssl uses port 443 and WinBox uses port 8291.
Which service should replace telnet and which should replace the plain API?
Use SSH instead of telnet and api-ssl instead of the plain API. Then disable the clear text services.
How do you allow SSH only from one subnet?
Set the address of the service, for example /ip service set ssh address=192.168.88.0/24. Use the input chain too.

Topic 2 of 3 in Securing the Router

Test yourself on Securing the Router

The full MikroTik MTCSE question bank has 446 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.