SNMP reachable from the internet without an address restriction

What the audit found

SNMP is enabled on your router, at least one community under IP → SNMP → Communities has no address restriction (or is open to 0.0.0.0/0), and nothing in the firewall blocks UDP port 161 from the WAN side. Anyone on the internet who knows or guesses the community name can query the router.

The audit rates this medium. When the community is limited to a monitoring server's address, or the firewall drops SNMP from WAN, the finding is not reported.

Why it matters

SNMP is the protocol monitoring systems use to read statistics from network devices: interface counters, CPU load, uptime, routing tables, ARP and neighbour lists, wireless clients, and the names and addresses of everything attached. That is exactly the information an attacker wants before choosing how to break in, and with SNMP version 1 or 2c the only protection is the community name — a password sent in plain text, and very often still the default public.

There is a second problem that affects you even if the community is secret. SNMP runs over UDP, and a small request can produce a large reply. Attackers send requests with a forged source address to thousands of open SNMP devices, and all of them send their replies to the victim. Your router becomes part of an amplification DDoS attack against someone else, your uplink fills with outgoing traffic, and your address ends up on abuse lists that ISPs act on. Open SNMP is one of the classic sources of this kind of traffic.

If the community is writable, the situation is worse still: an attacker can change settings on the router, not just read them. But even read-only access to a device that describes your whole network is more than the internet should have.

What it looks like in Winbox

Open IP → SNMP. The Enabled box is ticked. Click Communities: each row has a Name and an Addresses field. An empty Addresses field, or 0.0.0.0/0, means any source may use that community. Also note the Security column — none means SNMP v1/v2c with no encryption.

How to fix it

Restrict every community to the address of your monitoring server. Under IP → SNMP → Communities, the Addresses field of each community takes the server's address — several can be listed — and after that the router ignores SNMP requests from any other source. If you monitor from a server on the internet, use its fixed public address, or better, reach the router over a VPN and use the VPN address.

Then block SNMP from the WAN in the firewall as well, so that a mistake in the community settings cannot expose it again. If your input chain already ends with a rule that drops everything not from the LAN, you are covered. Otherwise add a specific rule in the input chain, above your final accept rules, that drops UDP traffic to the SNMP port arriving on the WAN interface list.

While you are there, also rename the community away from public, and if your monitoring tool supports it, move to SNMPv3 with authentication and encryption — the Security column of the community then no longer reads none. None of these changes affects Winbox or SSH access, so Safe Mode is not required for the SNMP settings; use it if you are also editing firewall rules.

Afterwards, from a machine outside your network, try an SNMP walk against your public address — it should time out — while from the monitoring server it should return data as before. Check that every community now shows an address, then re-run the audit; the finding should disappear.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

My monitoring provider polls from changing addresses. How do I restrict SNMP then?

Ask them for the address range they poll from; most publish one. If they truly cannot give you fixed addresses, put a VPN between the router and the monitoring system and allow the VPN subnet. Leaving SNMP open to the whole internet is not an acceptable workaround.

I changed the community name to something long and random. Is that enough?

It stops casual reading, but not the amplification problem — the router still answers with an error to any request, and some versions reply with enough data to be useful to an attacker. Restrict the addresses and filter the port regardless of the community name.

Is SNMP itself dangerous? Should I just disable it?

If nothing polls the router, disable it by unticking Enabled under IP → SNMP. If you do monitor it, SNMP restricted to the monitoring server and blocked from WAN is perfectly reasonable, and SNMPv3 makes it good.