No brute-force protection for internet-facing management

What the audit found

One or more management services on your router — SSH, Winbox, Telnet, WebFig or the API — are reachable from the internet, and the firewall contains nothing that slows down or blocks an address after repeated connection attempts. The report names the exposed services.

The audit reports this only when management is actually reachable from outside; a router that already drops WAN traffic to those ports does not get this finding. It is rated medium on its own, but it usually appears alongside a higher-rated finding about the exposed service itself, and that one is the root cause.

Why it matters

Every MikroTik router with a management port open to the internet receives a steady stream of login attempts — not from anyone targeting you in particular, but from botnets that scan whole address ranges and try lists of user names and passwords against anything that answers. The attempts arrive at a rate of several per second and never stop.

A strong password holds against this indefinitely. But "strong" has to be true for every account on the router, including the ones created years ago for a contractor or a monitoring tool. Brute-force protection limits the damage when that assumption fails: instead of unlimited attempts, an address gets a handful and is then blocked for a day. It also keeps the log readable and saves CPU on small devices.

Be clear about what this is, though: a safety net, not a fix. A botnet with many addresses still gets attempts from each one, and a future bug in the service itself does not need a password at all. The recommended order is: stop exposing management to the internet; then add this protection as an extra layer for whatever must remain reachable.

What it looks like in Winbox

Open IP → Firewall → Filter Rules. On a router with brute-force protection you will see a group of input rules whose Action is add src to address list, working in stages, plus one drop rule that references the resulting list. If no input rule uses an address list this way, the protection is missing. The lists themselves appear under IP → Firewall → Address Lists once they start filling.

How to fix it

First, prefer the real fix: restrict the exposed services to your management network in the Available From field under IP → Services, and make sure the input chain of the firewall ends with a rule dropping everything from the WAN that an earlier rule did not allow. Manage the router over a VPN from outside.

If some management access must stay open, add staged brute-force protection in the input chain under IP → Firewall → Filter Rules. The principle is a ladder of address lists: the first new connection to a management port puts the source on a first-stage list for a minute; a second within that minute promotes it to a second stage; a third promotes it to a blacklist for a day; and a rule at the top of the group drops everything from blacklisted addresses. Three connections in a minute is more than a person needs and far less than a scanner uses. The rules match on the ports of the exposed services the report names.

Place these rules above your accept rules for those ports, and above the final drop. Make the change with Safe Mode on: if you open three sessions quickly while testing you will blacklist yourself, and Safe Mode undoes it when the connection drops. An address can be unblocked manually under IP → Firewall → Address Lists.

Afterwards, from an outside address, open and close a connection to the port four times within a minute; the fourth should hang, and your address should appear on the blacklist. Remove the entry, then re-run the audit; the finding should be gone.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

Does this replace a strong password?

No. It buys time and reduces noise, but a botnet with thousands of addresses gets thousands of tries, and a vulnerability in the service bypasses passwords entirely. Use it together with strong, unique passwords and, preferably, with management not exposed at all.

I keep locking myself out. What am I doing wrong?

Probably opening several sessions in quick succession — Winbox plus SSH plus a script, for example — from the same address. Add an accept rule for your own trusted addresses above the staged rules, or exempt a trusted address list from them. And keep Safe Mode on while you tune the rules.

Why not just change the ports?

Because scanners check every port and identify the service by its response. A non-standard port reduces the volume of attempts slightly but does not stop them. Restrict by address and add this protection instead.