Going over a device once more

The script did most of this already. This round is the check afterwards: you look at the running device to see whether it is as you meant it, and whether anything has been added since. It is the only way you find out that a colleague enabled Telnet last month.

What is open

Start with the services. On the device:

/ip service print

You should see back what you ticked in Management access. The tool enables only WinBox (8291) and SSH (22) by default and sets the rest explicitly to disabled=yes, so a service that is on anyway was turned on by hand later. If FTP or Telnet are on, passwords go over the wire in the clear; the tool already warns about that while generating.

In the same output, look at the address column. That is the Management allowed from field: every enabled service carries that list, so traffic from outside those networks never reaches the service. If the column is empty, management is reachable from any address. That is the one item in this whole round you really have to act on.

The API ports (8728 and 8729) cannot be moved in the tool; WinBox, SSH, HTTP and HTTPS can. Another port stops nobody who scans, but it does cut noise from the log of a device that faces the internet.

Passwords and users

/user print

This is who can get in. Under System you set the admin password and can rename that user; the tool warns when the password is shorter than twelve characters, and deliberately puts the password line last in the script, so an error earlier on never leaves a half configured router with a new password.

Extra users get a group in the tool (full, write or read) and optionally an address they may come from. The rule is dull and it works: a monitoring system only reads, so it gets read. full is for the people who actually change the configuration.

SSH keys are written to a file on the router and imported. Password login keeps working unless you enable SSH: keys only, no password; confirm your key works first, or SSH is closed.

Management only from where it belongs

There are two locks and they do different things. The address field above works per service. The switch router manageable only from the management VLAN in Firewall works on the input chain: everything from the LAN aimed at the router is dropped, except DNS, DHCP and NTP so clients keep working, and except the management VLAN itself. That is the stronger of the two, and also the one you lock yourself out with more easily. If you enabled an offbridge port under Bridge and ports, its subnet is allowed in automatically.

Check with /ip firewall filter print that the input chain is what you expect, and test it from an ordinary workstation.

Switching off what you do not use

The tool sets a few things tighter than RouterOS itself does, so after pasting they are already right. Look them over:

• MAC telnet server is off. RouterOS enables it on every interface by itself.
• MAC WinBox is limited to LAN. Leave it there: this is your lifeline when an IP address is wrong.
• Neighbor discovery is limited to LAN. On all interfaces your router introduces itself to your ISP too. Check with /ip neighbor discovery-settings print.
• Bandwidth test server is off. Useful during a measurement, a nuisance afterwards. See Measuring.
• Disable unused ports is a separate switch under Bridge and ports. An empty socket in the meter cupboard is the easiest way in.

Look at /system package print as well. A package you do not use is flash space and code that may or may not hold up. See Packages.

Keeping RouterOS current

Under System you pick the update channel (stable, long-term or testing) and can switch on automatic updates, which creates a script and a scheduler that checks and installs every Sunday at 04:00. The router reboots when it does, so only enable it where a reboot at four in the morning bothers nobody. On RouterBOARD hardware upgrade RouterBOOT automatically is on by default, so the bootloader follows the version.

By hand it is:

/system package update check-for-updates
/system package update install

Take a backup first and read the changelog. Skipping a version is rarely a problem, skipping a year is.

Hardening and paranoia

Not everything that sounds strict buys you something, and some of it costs you an evening later. A few we do not recommend:

• Turning MAC WinBox off. Only do this if you can reach the device physically. You are removing your own safety net.
• Blocking ping from WAN. It is a switch in the tool and it works, but ICMP is needed for path MTU and error messages. It does not make you invisible; the ports that are open stay open.
• Hiding the SSID and filtering MAC addresses. Both cost effort and neither stops anyone who knows what they are doing. WPA2 or WPA3 with a decent passphrase does the real work.
• Brute-force protection as your only measure. The escalating address lists only help when management really is reachable from the internet. And because the rules match new TCP connections, someone with a spoofed source address can put an address on the ban list, including yours.

What counts: a long password, management restricted to one network, nothing exposed to the internet that does not need to be, and a RouterOS that is up to date. In that order.

All of it at once

If you want only this round as a script, the wizard has the role Harden only (baseline): password, management services, brute-force protection, NTP and logging, and nothing that touches your network.

Read on: Management access for the fields themselves, Checks about security for what the tool tells you about them, and Logs to see whether anyone is trying.