A router out of the box listens on more than you think. The Management access section switches off what you do not use and restricts the rest to the network you work from. It follows "Securing your router" from the MikroTik manual.
Where it sits
In the wizard this is the Management access step, with two questions: from which addresses, and which services. The rest lives in advanced. The emergency port sits under Bridge and ports, brute-force protection under Firewall; both belong to this story and are covered below.
From which addresses
Management allowed from is the most important field here. You enter networks separated by commas, for example 192.168.88.0/24,10.0.0.0/8. Every enabled service gets that as its address=, so traffic from anywhere else never reaches the service at all.
Leave the field empty and the configurator fills in the LAN subnet itself, plus the subnet of whichever VLAN you marked as the management VLAN. If there is neither, management is open from any address and you get a warning saying so. If you turned on an emergency port, its subnet is added automatically, but only when the list already restricted something: otherwise "reachable from anywhere" would quietly become "reachable from the emergency port only".
This is the field you lock yourself out with. Enter the subnet your laptop is in now, not only the network as it is meant to become.
Which services
By default only WinBox (8291) and SSH (22) are on. You can tick the rest: HTTP (80) and HTTPS (443) for WebFig, API (8728) and API-SSL (8729), and FTP (21) and Telnet (23). Anything not ticked is explicitly disabled in the script, not merely skipped.
Only turn FTP and Telnet on if you know why: they send your password in the clear, and you get a warning about it. WinBox, SSH, HTTP and HTTPS can be moved to another port. That stops no attacker who scans, but it does cut a lot of noise from the log of a device that faces the internet. The API ports cannot be changed in the tool; move those by hand if you need to.
SSH: strong crypto only is on and writes /ip ssh strong-crypto=yes. Very old SSH clients may struggle with it. HTTPS: create a self-signed certificate builds a CA and a server certificate on the router and binds it to www-ssl, and to api-ssl when that is on too. Your browser will still warn that it does not know the certificate, but the connection is encrypted.
Layer-2 access
These services work without an IP address, over MAC. That makes them both the safety net and a risk.
- MAC WinBox defaults to LAN interfaces only. This is your lifeline when you get an address wrong: you can still reach the router when IP does not work. Only switch it off if you can get to the device physically.
- MAC telnet server is off by default. RouterOS itself enables it on every interface, which is more than you need.
- MAC ping is off, and neighbor discovery (CDP/LLDP/MNDP) is limited to LAN. Discovery on all interfaces means your router introduces itself to your ISP as well.
- Bandwidth test server is off. Useful during a measurement, a nuisance afterwards.
- RoMON lets you reach a device that has no usable IP through another MikroTik. Give it a secret; the field is required as soon as you enable RoMON.
Extra users and SSH keys
You can add users with a group (full, write or read) and optionally an address they may come from. A monitoring system should get read, not full.
Public keys are written to a file on the router by the script and imported from there. Password login keeps working unless you switch on SSH: keys only, no password. Only do that once you have confirmed your key works, or SSH is closed.
IP Cloud
IP Cloud DDNS has the router report its public address to MikroTik and gives you a name like xxx.sn.mynetname.net. Handy for a VPN to a line without a fixed address. You can also let IP Cloud update the time and enable Back To Home. Do note that this puts something about your connection in MikroTik's hands.
Management VLAN only
If you use VLANs, the Firewall section has a switch called router manageable only from the management VLAN. The script then accepts input from the management VLAN, still lets DNS, DHCP and NTP through from the whole LAN so clients keep working, and drops the rest of the LAN traffic aimed at the router. If your configuration has an emergency port, that is allowed in as well. This is a stronger lock than the address field above, and also an easier one to lock yourself out with.
Brute-force protection
Also in the Firewall section: escalating address lists on the SSH and WinBox ports. A first attempt lands on connection1 for five minutes, a second on connection2 for fifteen, a third on connection3 for an hour, and after that on bruteforce_blacklist for a day, where it is dropped.
This only helps when management really is reachable from the internet. With the default firewall rules on and no forward to the management ports, that traffic is already dropped earlier and the lists only track addresses of packets that were gone anyway; the tool says so too. And note: the rules match on new TCP connections, so someone with a spoofed source address can put an address on the ban list, including yours.
The emergency port
Under Bridge and ports sits the offbridge port. It takes one port out of the bridge and out of the VLAN table and gives it an address of its own, 192.168.254.1/24 by default, with DHCP on it. If something goes wrong with the bridge or with VLAN filtering, every bridged port goes down at once; this one does not. You plug in a laptop, get an address, and open WinBox to that address. The tool picks the last copper port by default, because a laptop has an RJ45 socket and not an SFP cage. Pick a subnet that is not in use anywhere else: an overlap with a LAN or a VLAN is an error and blocks the script.
What the script makes of it
You recognise this section by a block of /ip service with disabled=no or disabled=yes per service, optionally port= and address=, followed by /tool mac-server, /ip neighbor discovery-settings, /tool bandwidth-server and, where relevant, /tool romon, /ip cloud, /certificate and /user.
If you end up outside
Try MAC WinBox: it works when IP does not. If that fails there is the rollback script, and after that the reset button. Check afterwards with /ip service print that the ports and addresses are what you meant.
Read on: System and time for the admin password, Firewall for the rules around this, and Using the script for applying it safely.