SNMP still uses the default community "public"

What the audit found

Your router still has the default SNMP community named public. Every RouterOS device ships with this community, and it stays there until somebody renames or removes it — even if SNMP itself was never deliberately switched on.

The audit reports this as high when UDP port 161 is reachable from the internet, and as low when the firewall limits it to the internal network. The community string is effectively a password, and "public" is the one every monitoring tool and every scanner knows.

Why it matters

SNMP with the default community gives a read-only view of the router to anyone who can send a packet to it. Read-only sounds harmless, but consider what is readable: the full interface list with names and MAC addresses, every IP address on the device, the ARP table (so the addresses and MAC addresses of every host behind the router), routing information, the RouterOS version and model, and live traffic counters for each interface.

For an attacker this is reconnaissance for free. The version number tells them which exploit to try; the address list tells them where your internal networks are; the ARP table tells them which hosts are worth attacking next. Internet-wide scans for SNMP public run constantly, and MikroTik devices are a popular target because the returned data is so detailed.

There is a second problem. SNMP v1 and v2c send the community string in cleartext, so even a non-default string can be captured by anyone on the same network segment. That is why the real fix is SNMPv3, which authenticates and encrypts each request.

If the port is blocked from the internet, this is mainly a hygiene issue for your internal network — but "public" is still the first thing malware on an infected PC will try.

What it looks like in Winbox

Open IP → SNMP and click Communities. You will see a row named public with Addresses set to ::/0 (any address) and Security set to none. That is the default. The IP → SNMP dialog itself shows whether the service is enabled at all.

How to fix it

The minimum change is to rename the default community and limit it to the address of your monitoring server. Under IP → SNMP → Communities, give the public entry a long random name and set its Addresses field to the single address of your monitoring host, so that nobody else may use it even if they guess the string. Update the community string in your monitoring software at the same time.

The better fix is SNMPv3, which adds authentication and encryption. Create a new community with Security set to private, choose an authentication protocol (SHA1) with a password and an encryption protocol (AES) with a second password, restrict it to the monitoring host's address, and then disable the old default community. Most monitoring tools (Zabbix, LibreNMS, PRTG) support SNMPv3 without difficulty.

If you do not use SNMP at all, simply untick Enabled under IP → SNMP. Whichever route you take, make sure the input firewall drops UDP 161 from the WAN side, so the service is never reachable from the internet in the first place. None of these changes touches your own management access, so Safe Mode is optional here — though it never hurts when editing firewall rules.

Afterwards, from a host that is not your monitoring server, run an SNMP walk against the router with community "public": it should time out. From the monitoring server, with the new community, it should still answer. Check that the community list no longer contains an entry named public, then re-run the audit.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

My monitoring system needs SNMP. Won't this break it?

No — SNMP stays enabled. You are only changing the community string (and, ideally, moving to v3). Update the same string in your monitoring tool and it will keep polling. Do both changes in the same maintenance window so you do not lose data points.

Is renaming the community enough if the port is still open to the internet?

It is better than "public", but with v1/v2c the string can still be guessed or captured. Treat the rename as step one; blocking UDP 161 on the WAN side and moving to SNMPv3 are steps two and three.

I never turned SNMP on. Why is the community there?

The public community exists in the default configuration whether SNMP is enabled or not. It only matters once the service is enabled, but disabling or renaming it now means you will not forget it later.