MikroTik Firewall Hardening: Production Security Checklist

MikroTik Firewall Hardening Checklist

A newly configured MikroTik device — even with IP addresses and routing set up — is not secure by default. This post gives you a complete hardening checklist that you can apply to any MikroTik router.

1. Set a Strong Admin Password

TEXT

/user set [find name=admin] password=V3ryStr0ng!P@ss

Or create a new admin and disable the default:

TEXT

/user add name=netadmin password=V3ryStr0ng!P@ss group=full
/user disable admin

2. Disable Unused Services

Turn off every service you do not actively use:

TEXT

/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes       # WebFig HTTP — use HTTPS instead
set api disabled=yes
set api-ssl disabled=yes   # Enable only if you use API
set ssh port=2222          # Change from default 22
set www-ssl port=4443      # Change HTTPS port

3. Restrict Services to Management IP

Bind each active service to your management IP only:

TEXT

/ip service
set ssh address=192.168.88.0/24
set www-ssl address=192.168.88.0/24
set winbox address=192.168.88.0/24

4. Baseline Firewall Input Chain

This is the core protection for the router itself:

TEXT

/ip firewall filter

# Allow established/related (keep existing sessions working)
add chain=input connection-state=established,related action=accept

# Drop invalid packets
add chain=input connection-state=invalid action=drop

# Allow ICMP ping (optional — remove to hide the router)
add chain=input protocol=icmp action=accept

# Allow management from LAN only
add chain=input src-address=192.168.88.0/24 action=accept

# Drop everything else to input
add chain=input action=drop comment="Default deny input"

5. Baseline Firewall Forward Chain

Protect traffic forwarded through the router:

TEXT

/ip firewall filter
add chain=forward connection-state=established,related action=accept
add chain=forward connection-state=invalid action=drop
# Add specific allow rules here for your network
add chain=forward action=drop comment="Default deny forward"

6. Disable Neighbor Discovery (if not needed)

MikroTik's Neighbor Discovery Protocol (MNDP) announces the device on the network. Disable on WAN:

TEXT

/ip neighbor discovery-settings set discover-interface-list=LAN

7. Disable MAC Server on WAN

MAC-based Winbox access should only work on LAN:

TEXT

/tool mac-server set allowed-interface-list=LAN
/tool mac-server ping set enabled=no

8. Disable Bandwidth Test Server

TEXT

/tool bandwidth-server set enabled=no

9. Enable Firewall for Bridge Traffic

If using bridges, enable firewall processing for bridged packets:

TEXT

/bridge settings set use-ip-firewall=yes

10. Secure DNS

If not running a public DNS server, restrict DNS queries:

TEXT

/ip dns set allow-remote-requests=no

11. Protect Against Common Attacks

TEXT

/ip firewall filter
# Block port scanners
add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list=port-scanners address-list-timeout=2w
add chain=input src-address-list=port-scanners action=drop

# Block invalid TCP flags
add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!ack action=drop

12. Enable Strong Crypto for SSH and Winbox

TEXT

/ip ssh set strong-crypto=yes

Hardening Verification Checklist

After applying:

TEXT

/ip service print                    # Verify disabled services
/ip firewall filter print            # Verify filter rules
/tool mac-server print               # Verify MAC server restricted
/ip neighbor discovery-settings print # Verify discovery restricted
/ip dns print                        # Verify remote requests disabled

Save config immediately after hardening:

TEXT

/system backup save name=post-hardening