RoMON is enabled without a secret

What the audit found

RoMON (Router Management Overlay Network) is enabled under Tools → RoMON, but no secret is configured. RoMON builds a small layer-2 management network between MikroTik devices so that Winbox can reach any of them through any other, regardless of IP configuration or VLANs. The secret is what stops a device you do not own from participating.

The audit reports this as medium severity. RoMON does not by itself let anyone log in — you still need a valid user name and password on the target router — but without a secret it opens a management path that bypasses your IP firewall entirely.

Why it matters

RoMON is genuinely useful: when a router loses its IP configuration, or when a device sits behind several hops of VLANs, you can still reach it in Winbox by connecting to a neighbouring RouterOS device and using RoMON. It works at the Ethernet level, so IP addressing, routing and — crucially — the firewall input chain play no part.

That last point is the problem. All of the work you do to restrict Winbox to a management subnet and drop WAN traffic assumes that connections arrive as IP packets. A RoMON connection does not. If RoMON is enabled without a secret, any device that runs RouterOS and is connected to the same layer-2 segment — a port on your switch, a spare socket in a meeting room, the far end of a point-to-point link — can join your RoMON overlay and present a Winbox login prompt for every router in it.

The secret works like a shared key between all RoMON participants. With it set, a foreign device cannot join the overlay, and your RoMON network contains only the devices you intended. Without it, your management plane is as open as your patch panel.

To keep the scale honest: an attacker still needs to guess a password, and still needs physical or layer-2 access to your network. This finding is about not undoing the firewall work you have already done.

What it looks like in Winbox

Open Tools → RoMON. If Enabled is ticked and the Secrets field is empty, this is the finding. The Ports tab shows which interfaces take part; by default, all of them do, including WAN and wireless.

The Winbox login screen's RoMON button is where you would normally use the feature.

How to fix it

If you use RoMON, set a long random secret on every router that participates, in the Secrets field under Tools → RoMON. Use the same secret on each device in the overlay; devices with a different secret (or none) are ignored. Generate something long and random — at least 20 characters — and store it in your password manager. The field accepts several secrets separated by commas, which lets you run old and new side by side during a migration and remove the old one once every device is updated.

Also review Tools → RoMON → Ports and remove WAN-facing and wireless interfaces from RoMON, so the overlay only spans the links between your own devices. If you do not use RoMON at all, simply untick Enabled in the same dialog.

Setting a secret does not affect your normal IP-based Winbox session, so Safe Mode is not strictly needed. If you rely on RoMON to reach a remote device, change the secret on the far device first (while you can still reach it) and on the near device second, otherwise you will cut the path you are using — Safe Mode on the near device is a sensible precaution for that step.

Afterwards, click RoMON on the Winbox login screen, connect through one of your routers and check that the discovered list contains only your devices; a RouterOS device without the secret connected to the same segment should not see them. Confirm that Tools → RoMON shows either RoMON disabled or a non-empty Secrets field, then re-run the audit.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

Does RoMON without a secret let anyone log in to my router?

Not directly — they still need a user name and password. What it gives them is a path to the login prompt that your IP firewall cannot see, from any point on the same layer-2 network. Combined with a weak password or a future Winbox bug, that path becomes a takeover.

I only have one router. Do I need RoMON at all?

No. RoMON is for managing several MikroTik devices through each other. On a single router it does nothing useful, and disabling it is the simplest fix.

Is the secret encrypted on the wire?

The secret authenticates participants; it is not a full encryption layer. Treat RoMON as a management channel for trusted links between your own devices, keep it off untrusted ports, and continue to rely on Winbox's own session security for the login itself.