SSH reachable from the whole internet

What the audit found

The ssh service under IP → Services is enabled, has no address restriction, and nothing in the firewall stops connections to it from the WAN side. Anyone on the internet can open an SSH login prompt on your router.

The audit reports this as medium severity. SSH is encrypted and has a good security record, so this is a different situation from Telnet or plain-HTTP WebFig. When SSH is restricted to certain addresses or only reachable from the LAN, the audit does not report it at all.

Why it matters

SSH on a MikroTik gives full command-line access — the same power as Winbox. It sends nothing in the clear, so eavesdropping is not the concern. Exposure is.

Any SSH server on a public address receives continuous login attempts from botnets that scan the whole internet. They are not looking for you specifically; they try common user names (admin first) and lists of passwords against every device that answers on port 22. Look at your router's log after a day online and you will see them. If any account on the router has a weak or reused password, it will be found. The result is complete control of the device: firewall rules, DNS, routing, and a foothold inside your network.

The second, smaller risk is the software itself. RouterOS's SSH implementation has had fewer serious problems than Winbox or the web interface, but any service that listens to the whole internet is one undiscovered bug away from trouble, and there is no benefit that offsets that.

Because SSH is the tool you rely on when Winbox is unavailable, the goal is not to switch it off but to make sure only you can reach it.

What it looks like in Winbox

Open IP → Services. Find the ssh row: it is enabled, Port is 22 (or whatever you changed it to), and Available From is empty. Then open IP → Firewall → Filter Rules and check whether the input chain has a rule dropping traffic that arrives on the WAN interface; if not, every listed service is open.

How to fix it

Restrict the service to the networks you administer from. Under IP → Services, the Available From field of the ssh row takes your LAN, your VPN range, or the fixed address of your office — several networks can be listed. After this, the router refuses SSH connections from anywhere else, before the firewall is even consulted.

Then make sure the firewall does its part too. The input chain should keep established and related sessions alive, drop invalid packets, allow ICMP, and finish with a rule that drops everything that does not arrive from your LAN interface list. That last rule protects every other service on the router too. It assumes your LAN interfaces are members of an interface list under Interfaces → Interface List; create it first if it does not exist. Use Safe Mode in Winbox for this step: if the address restriction or the drop rule cuts you off, the router reverts when the session ends.

If you need SSH from outside, set up WireGuard (RouterOS 7) and include its subnet in the Available From field. If a VPN is not an option, at least allow SSH only from an address list of known sources, and add staged brute-force rules. Also consider key-based login: an SSH public key imported for your account under System → Users lets you disable password login entirely.

Afterwards, try an SSH connection to your public address from a phone on mobile data; it should time out, while from your management network it should still prompt for a password. Then re-run the audit; the finding should disappear.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

I moved SSH to port 2222. Isn't that enough?

No. Scanners walk the whole port range and recognise SSH from its banner. A different port thins out the noise in the log; it does not reduce the risk. Restrict by address and filter WAN in the firewall.

Should I disable SSH entirely and use only Winbox?

Keep it. SSH restricted to your management network is the safest fallback when Winbox is blocked, misbehaving, or unavailable on the machine you happen to have. Having exactly one way into a router is how people end up locked out.

My ISP gives me a CGNAT (private) address. Am I exposed?

Not to the entire internet, but to every other customer in the same ISP segment, and that is still thousands of unknown devices. Apply the same fix.