Manual

You cannot reach the router any more

The script is pasted and nothing answers any more. There are four ways back, in this order.

You pasted the script, the session dropped, and it never came back. The old management address does not answer, WinBox shows an empty list, and the device is at the other end of the building.

Annoying, but rarely serious. A MikroTik is still reachable at layer 2, and next to your script there is a rollback script that undoes exactly what was added. Do that before you go looking for the reset button.

Always paste scripts with Safe Mode on, Ctrl+X in the terminal. If the session then drops, the router undoes everything by itself. See Safe Mode.

The way back, in this order

  1. Find the device by MAC address. Open WinBox and look at the Neighbors tab. A good answer: the device is listed with a MAC address and maybe no IP. Double-click the MAC address, not the IP. MAC WinBox works without a valid IP and is on by default for the LAN interfaces.
  2. Are you in the right port? If the port your laptop is in became an access port of a VLAN, you get an address from a different range than the one you are looking on. Try another port before going further.
  3. Use the offbridge port. If you switched it on, there is a port that deliberately stays out of the bridge and the VLANs, with its own address and its own DHCP server. Plug a laptop in and open WinBox or SSH to the address written in your script.
  4. Paste the rollback script. If you do get in but a lot is wrong, the rollback script removes what the script added and leaves you on a blank device.
  5. Reset. Holding the button during boot clears the device. Then start again, with a configuration you have corrected.

Once you are in, find out why it went wrong straight away: /ip address print for the address you expected, /ip service print for the services and their address field, and /interface bridge port print for the question of whether your port is in the bridge at all.

The usual causes

  • VLAN filtering on with no way back. No VLAN with an address and no port untagged on the bridge: every frame then belongs to a VLAN that has no layer-3 interface, and the router is unreachable over IP.
  • Management limited to a network you are not on. The field Management allowed from becomes address= on every service. Fill in the management VLAN while your laptop sits on the guest network and you got exactly what you asked for.
  • Management VLAN only. The same idea in the firewall: the input chain accepts the management VLAN and nothing else.
  • The router's address changed. If your device went from 192.168.88.1 to 10.0.10.1, you are knocking on the old address.
  • WinBox on another port. If you moved the WinBox port, you have to add it behind the address.

What the configurator does about it

The worst version is refused. Switching VLAN filtering on while no VLAN has an address and no port is untagged on the bridge is an error, not a warning: after applying this the router is no longer reachable over IP. It comes with the fix as well: give a VLAN an address, mark one as the management VLAN, or set a port to "bridge (untagged, no VLAN)". See Checks about VLANs.

If no VLAN is marked as management VLAN you get a warning with the reminder that MAC WinBox on LAN keeps working. The fields that can shut you out, such as Management allowed from, Management VLAN only and SSH: keys only, carry a warning under the field itself.

The offbridge port exists for nothing else. Switch it on and the script tells you literally where to plug in and which address to connect to, and the tool checks that the port is not also the WAN port or a bond member, and that its subnet does not clash with a network you already have. Turn it on before you configure a device remotely; see Bridge and ports.

What the tool cannot know is which network your laptop is on at the moment you paste. That is why most lockouts get through.

When it is not your router

  • The switch in between. A managed switch between you and the router can hold back the management VLAN. Plug a cable in directly to rule that out.
  • Your own firewall. A laptop with a strict profile sometimes blocks outbound traffic to port 8291.
  • WinBox version. An old WinBox sometimes does not see newer RouterOS versions in the neighbour list. Update it before concluding the device is gone.

Further reading: Management access, WinBox and Using the script.

Want to try it right away? Open the configurator