MAC-Telnet and MAC-Winbox available on all interfaces, including WAN
MAC-Telnet and MAC-Winbox let you manage a router by its hardware address instead of an IP address. When they are allowed on the WAN port, everyone in the ISP segment can try to log in, and the IP firewall cannot stop them.
/tool mac-server
What the audit found
The MAC server on your router — the service behind MAC-Telnet and MAC-Winbox — is allowed on all interfaces, including the one facing your internet provider. These tools let a client find and log into the router using only its MAC address, without any IP configuration at all. That is convenient on a workbench and a problem on a WAN port.
The audit reports this as medium on devices that have a WAN interface. On a switch or access point that lives entirely inside a trusted LAN, the same setting is not a significant concern.
Why it matters
MAC-layer management works on Ethernet frames, not IP packets. Two consequences follow. First, it can only be used by devices in the same layer-2 segment as the router. Second, and more importantly, it goes around the IP firewall: your carefully built input chain never sees it.
Who is in the same layer-2 segment as your WAN port? On a typical residential or business connection it is every other customer on the same access node or PON tree, plus the ISP's own equipment. On a shared uplink in an office building it is every other tenant. In a data centre it can be dozens of unrelated machines. None of those people should be able to open a Winbox login prompt on your router, yet with the MAC server open on WAN they can — they only need the Winbox neighbour list, which shows your router by name and MAC.
The exposure is limited compared to an internet-reachable service, which is why this is medium rather than high. But it is a full management login prompt, reachable by strangers, protected by nothing but the password, and invisible to your firewall logs.
What it looks like in Winbox
Open Tools → MAC Server. There are two buttons: MAC Telnet Server and MAC WinBox Server. Each has an Allowed Interface List field. If it reads all, or names a list that contains your WAN port, the service is reachable from the provider side. You can also see who is currently connected this way under Tools → MAC Server → Sessions.
How to fix it
The fix is to point both services at your LAN interface list instead of all. Each of the two servers — MAC-Telnet and MAC-Winbox — has its own Allowed Interface List field under Tools → MAC Server, and both need changing; it is easy to do one and forget the other. Once they name your LAN list, the router ignores MAC-layer login attempts arriving on any other port, and the provider segment no longer sees a login prompt.
The setting refers to an interface list, conventionally called LAN. Check under Interfaces → Interface List that it exists and contains your bridge or internal ports; if it is missing or empty, create and populate it first, because a restriction to an empty list is the same as switching the service off.
If you manage the router over IP from the LAN, this change cannot lock you out — it only affects MAC-based sessions. If your only access is MAC-Winbox over the WAN port (unusual, but it happens on lab devices), enable Safe Mode first so a mistake reverts itself. If you never use MAC-based access at all, choosing none disables it completely; most administrators keep it on the LAN, because it is the tool that gets you back in when you have broken the IP configuration.
Afterwards, the router should no longer appear as connectable by MAC in the Winbox neighbour list from the WAN side — plug a laptop into the WAN port to check — while MAC-Winbox from the LAN still works. Then re-run the audit.
The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.
FAQ
I use MAC-Winbox to recover the router when I misconfigure IP. Will I lose that?
No. Restricting the service to LAN keeps it available on your internal ports, which is where you would plug a laptop in for recovery. You only lose the ability to do that through the WAN port, which is where strangers are.
The WAN port is a PPPoE connection. Am I still exposed?
Yes. PPPoE runs on top of Ethernet, and the physical port still sees every frame in the access segment. MAC-Telnet works on the underlying interface regardless of the PPPoE session. Restrict the service as described.
Does the firewall rule that drops WAN input traffic cover this?
No. IP firewall rules act on IP packets; MAC-Telnet and MAC-Winbox are not IP. That is the whole point of this finding — the only control that applies is the Allowed Interface List on the MAC server itself.
This article explains the finding in general terms. Test any configuration change with Safe Mode enabled in Winbox. MKRouterKit analyses configuration exports only; it does not replace an external port scan or a professional penetration test.