Bandwidth-test server reachable from the internet

What the audit found

The bandwidth-test server on your router is enabled — it is on by default in RouterOS — and nothing in your firewall stops connections to it from the WAN side. The service listens on TCP port 2000 and lets a remote client generate traffic to or from the router to measure link throughput.

The audit reports this as low when the server requires authentication, which is the default, and medium when authentication is switched off, because then anyone at all can start a test.

Why it matters

The bandwidth test is a useful tool between two routers you control. Reachable from the internet, it is a small liability in two ways.

The first is capacity. A bandwidth test does exactly what its name says: it pushes as much traffic as it can through your link. Someone who can start a test against your router can fill your uplink for as long as they like, with the router's full cooperation. If authentication is off, that takes no credentials at all. If it is on, it takes a valid router login — which brings us to the second point.

The second is that port 2000 is another door that accepts a RouterOS username and password. Every additional service that authenticates against the user database is another place to try guesses, and one that is less likely to be watched than Winbox or SSH. The audit for the default admin account and for weak passwords becomes more pressing when there are more ways to try them.

To be clear about scale: this is hygiene, not a hole. The service does not give configuration access and has no history of remote exploits. It is reported because it is on by default, almost never needed from the internet, and trivial to switch off.

What it looks like in Winbox

Open Tools → BTest Server. The window has three settings: Enabled, Authenticate and Max Sessions. If Enabled is ticked, the server is running; if Authenticate is unticked, anyone can use it. To see whether the internet can reach it, check IP → Firewall → Filter Rules for an input rule that drops WAN traffic, and IP → Services for context — port 2000 is not listed there because the bandwidth server is not part of the standard services list.

How to fix it

The simplest fix is to untick Enabled under Tools → BTest Server. Nothing else on the router depends on the server, and switching it off cannot lock you out. You can still run bandwidth tests from this router to another one under Tools → Bandwidth Test, because that uses the client side.

If you do use the server for tests from your own monitoring system or between your own sites, keep it enabled but make two things true. First, Authenticate must be ticked, so that starting a test requires a router login rather than being open to anyone who finds the port. Second, the firewall must limit who can reach port 2000. The general fix — a final input rule that drops everything not arriving from the LAN interface list — covers this together with every other service on the router; if tests need to come from a specific remote address, an accept for TCP 2000 from that address goes above the drop.

Use Safe Mode when adding or reordering firewall rules, as with any firewall change; the BTest Server setting itself carries no lock-out risk. Afterwards, a connection to TCP port 2000 on your public IP from outside your network should be refused or time out, while a quick test from another router on the LAN still works if you kept the server on for internal use. Then re-run the audit.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

My ISP uses the bandwidth test to check my line. Will disabling it break that?

Possibly, if they test against your router rather than their own equipment. Ask them. If they do need it, keep the server enabled with authentication on and allow TCP 2000 only from their stated source address in the input chain. Do not leave it open to the whole internet for the sake of an occasional support call.

Is this really worth fixing on a home router?

It takes one tick box and removes an unnecessary service, so yes. On its own it is a minor issue, which is why the audit rates it low. It is listed because every open service adds up, and because switching authentication off — which some tutorials suggest for convenience — turns it into a free traffic generator for anyone who finds it.

Does the final "drop from WAN" firewall rule make this unnecessary?

It makes the exposure go away, and the audit will no longer report the finding. Disabling the server is still the cleaner choice unless you use it: a service that is not running cannot be affected by a future firewall mistake.