WinBox, WebFig and the terminal | MikroTik Configurator

A MikroTik has no app and no cloud account. You reach the device yourself, over the network, with one of a handful of tools. They all talk to the same RouterOS underneath, so what you can do in one you can do in the others. The difference is convenience, and what still works when something is broken.

The ways in

WinBox: A small program from MikroTik's download page. It shows the whole configuration in windows and lists and is what most people use day to day. It is a Windows binary; MikroTik also publishes builds for Linux and macOS, and it runs under Wine.
WebFig: The same menus in a browser, served by the router itself. Nothing to install, so this is the one you use on a borrowed laptop or a phone. It is plain HTTP until you give the router a certificate, so on a network you do not fully trust, treat it as such.
SSH: A terminal from any machine that has an SSH client, which is every machine. This is where you paste a script, where you run /export, and where anything repeatable happens.
The terminal inside WinBox or WebFig: The same command line, in a window of the graphical tool. Useful when you are clicking around and want to check one thing, or paste a block of configuration without opening a second program.
The serial console: On models with a serial port, a console that keeps working when the network does not. It is the last door before Netinstall.

The menus in WinBox and WebFig are named after the commands. /ip address in the terminal is IP, then Addresses in the window. Once you notice that, a command from a forum post is quick to find in the interface, and the other way round.

The neighbour list, and finding a device by MAC address

RouterOS devices announce themselves on the local segment with MikroTik's own discovery protocol, and they listen for CDP and LLDP as well. WinBox shows what it hears under Neighbors: identity, MAC address, IP address, version and board. Other vendors' equipment can show up there too, which is a quick way to see what is actually plugged in.

That list is what saves you when the address does not match. A factory device is on 192.168.88.1, your laptop is on something else, and nothing routes between them. In the neighbour list you click the MAC address column instead of the IP column, and WinBox connects over layer 2, without any IP agreement between the two sides. There is a terminal version of the same thing, MAC telnet.

It has limits, and they are worth knowing before you rely on it:

It works within one broadcast domain. Through a router, it is not going to find anything.
A MAC session uses broadcasts and is less reliable than an IP session. MikroTik's advice, and ours, is to use it to get in and give the device a reachable address, not to do an evening of work over it.
Your own network card still needs an IP configuration of some kind, otherwise the discovery packets never reach the tool.
A local firewall on your laptop is the usual reason the Neighbors tab stays empty.
A hardened configuration can limit or switch off MAC access. That is deliberate, and it is why a physically separate way in matters.

Which brings up the cheapest insurance there is: an offbridge port. Our scripts can leave one port out of the bridge and out of every VLAN, with its own address, so there is always a port where a laptop gets in. See Using the script.

Which one to use when

Looking around, changing one setting: WinBox. You see the state of everything at once.
Pasting a generated configuration: a terminal, in one go, over SSH or in the WinBox terminal window. Not the script editor, which behaves differently.
No software allowed on the machine you are on: WebFig.
The device is on the wrong subnet, or you locked yourself out: the neighbour list and a MAC connection, or the offbridge port.
A device behind another MikroTik: RoMON, which carries management traffic between MikroTik devices at layer 2, so a switch without an address is still reachable. It is off by default and it deserves its own password.
Nothing responds at all: the serial console if the model has one, then a reset, then Netinstall.

Keep the doors in order

Each of these is a service you can switch off, move to another port, or limit to a source address. There is no reason for WinBox, SSH or the web interface to answer from the internet, and every reason for them not to. What we generate closes the unused ones for you; the thinking behind it is in Management access.

Before you change anything on a device you are connected through, switch on safe mode. If your session drops, RouterOS puts the configuration back. See Safe mode.