Most of these messages are about a door that is open wider than you probably meant. A few of them are about the opposite: a rule that does nothing because something else already blocks it. Neither shows up while you are testing, which is why the tool says it now.
An error means the configuration is unsafe or broken. A warning is a decision that can be right in your situation, as long as you took it on purpose.
No password, or a short one
No admin password is set., No administrator password is set for the site. and The admin password is shorter than 12 characters.
The first is an error, the others are warnings. A device without a password is open to anyone who reaches it, and a site without a shared password is a set of unrelated devices. The tool runs in your browser and sends nothing anywhere, so a long password here costs you nothing.
The firewall produces no protection
Default firewall rules are off: without an input drop the router is reachable from the internet. and Firewall is on but generates no rules.
The first is shown as an error, the second as a warning. Without the input drop every service on the router answers from the WAN side, and that is found by scanners within hours. Switch the default rules back on unless you are deliberately writing the whole rule set yourself.
Management open from the internet
SSH/WinBox are open from the internet without brute-force protection. Turn it on, or restrict the source addresses. and Brute-force protection is on, but management is not reachable from the internet: the default rule already drops WAN traffic. The lists then track addresses of packets that are dropped anyway.
The first is a warning about a real risk, the second a note that you are paying for a lock on a door that is already walled up. A VPN and management on the inside is the better answer than any brute-force list.
A port forward to a service that should not be public
A port forward on 3389/445/23/21 exposes a vulnerable service to the internet; prefer VPN.
A warning. Remote desktop, file sharing, telnet and FTP are the four ports that end up in ransomware reports. They are not safe to publish, whatever the password is. Put them behind a VPN and forward nothing.
Management VLAN only, without a management VLAN
"Management VLAN only" chosen, but no VLAN is marked as management; rule skipped.
A warning, and an important one because the protection you asked for is not in the script. Nothing was marked, so nothing could be allowed and the rule was left out rather than locking you out. Mark a VLAN as management and generate again.
Management reachable from every address
Management services are reachable from any address (no management network set). and SNMP is reachable from any address.
Warnings. Inside the LAN the firewall still protects the router, but every guest, every camera and every visitor with the Wi-Fi password can reach WinBox and SSH. Fill in the network you administer from, then only that network gets in.
Telnet and FTP
Telnet/FTP send passwords unencrypted.
A warning. Both send your administrator password over the network in plain text, where anyone on the same segment can read it. SSH replaces telnet, and SFTP over the same SSH replaces FTP. Only leave them on for equipment that knows nothing else.
UPnP opens ports by itself
UPnP lets LAN devices open firewall ports themselves.
A warning, and a deliberate choice for game consoles and some video calling. The point of UPnP is that a device on the inside opens a port without asking you, which includes a device you did not intend to trust. Switch it off and forward what you need by hand where you can.
IPv6 without a firewall
IPv6 without a firewall: every LAN device is directly reachable from the internet over IPv6.
Shown as an error, and it is the sharpest one in the tool. IPv6 has no NAT, so every device carries a routable address. Without filter rules, a NAS, a camera and a printer are all reachable from the whole internet. Switch on the IPv6 firewall, or switch off IPv6.
Rules that appear without you asking
The IPv6 firewall is always included, even when you do not use IPv6. A device with no IPv6 rules only becomes unsafe at the moment the stack comes up anyway, after a RouterOS update for instance, and then everything is open. The rules cost nothing while IPv6 is off., This is MikroTik's default firewall, copied from their own default configuration as the chosen RouterOS version ships it. The other firewall options are skipped. and IPv6 is off: the router does not speak it, does not route it, and the bridge and switch chip do not pass it.
Notes explaining what is in the script and why. The IPv6 rules are there for the day an update brings the stack up, and they cost nothing while IPv6 is off. If you pick the stock MikroTik firewall, your own firewall settings in the tool are not used.
The IPv6 rules come from the stock firewall
The IPv6 firewall comes from MikroTik's default rules, so this section does not add its own IPv6 rules on top.
A note about two sections that would otherwise do the same work twice. You chose the stock MikroTik firewall and switched the IPv6 firewall on as well. The stock rule set already carries the complete IPv6 table, so the IPv6 section keeps its hands off and the device gets one set of rules instead of two of everything. Your IPv6 traffic is filtered; the rules come from the other section. If you want your own IPv6 rules, pick a firewall style other than the stock one.
A tunnel without a reachable far end
Tunnel gw-01 wg1 ⟷ gw-02 wg1: neither router has a public address, so WireGuard does not know where to connect. Fill in the public IP or DNS name on at least one router., gw-02 has no public address, so gw-01 does not know where the tunnel goes. and Tunnel gw-01 gre1 ⟷ gw-02 gre1: GRE / IPsec needs an IP address as its destination, not a DNS name (vpn.example.com on gw-02).
Errors. At least one side has to be reachable, and the older tunnel types accept only an address, not a name. A related warning says the client configurations contain a placeholder if you left the public endpoint empty. Fill in the public address, or a DNS name where the type allows it.
WireGuard without keys
Tunnel gw-01 wg1 ⟷ gw-02 wg1: the WireGuard keys are missing. Create the tunnel again in a browser that supports X25519., WireGuard wg-office: no key pair generated; RouterOS will create one, but the client configs will lack the public key. and WireGuard peer laptop: no public key.
Warnings. Keys are generated in your own browser, which is why nothing about them ever leaves your machine, and why an old browser leaves you without them. The tunnel comes up only when both sides know each other's public key, so fix this before you go on site.
A placeholder in the client configurations
No public address/hostname given; the client configurations contain a placeholder.
A warning about remote access, not about a tunnel between two sites. A laptop or a phone has to know where to dial in, and the field for the public address or hostname of this line is empty, so the client configuration says <PUBLIC-IP-OR-HOSTNAME> where the address belongs. The configuration on the router is complete; only the part you hand to the user is not. Fill in the fixed address of the line, or the DNS name you keep pointing at it when the address changes.
A tunnel that carries traffic in the clear
Tunnel branch is unencrypted. and PPTP is broken (MS-CHAPv2/RC4); only use it for equipment that supports nothing else.
The first is a warning, the second is shown as an error. GRE, IPIP, EoIP and VXLAN have no encryption of their own: over a private line that is fine, over the internet it is not. Add an IPsec secret, or use WireGuard.
SSTP and HTTPS on the same port
SSTP and HTTPS (www-ssl) both use port 443.
Shown as an error. Two services cannot listen on one port: whichever starts first gets it and the other stays down. Move the web interface to another port, or use a different VPN type.
BGP without a password or an AS number
BGP session without a TCP MD5 password. and Tunnel gw-01 to gw-02: BGP is on, but gw-01 has no AS number.
The first is a warning, the second an error. Without an AS number no session can be built at all. Without an MD5 password anyone who can reach the port can try to speak BGP to your router. Agree on both with the other side before you generate.
Something still has to happen outside the script
Let's Encrypt: the certificate line requires the hostname to point at this WAN address and RouterOS 7.x ≥ 7.1. and ZeroTier: the new member still has to be authorised in ZeroTier Central.
Warnings about work the script cannot do for you. A certificate is only issued when the name resolves to this router, and a ZeroTier member stays outside the network until someone approves it in the web console.
Related: The firewall, Management access and Site to site tunnels.