Web proxy enabled: when your router becomes an open proxy

What the audit found

The HTTP proxy under IP → Web Proxy is enabled on your router. This is a built-in caching web proxy that dates from a time when RouterOS was commonly used to cache web pages for slow links. Today it is rarely configured on purpose.

The audit rates this critical when the proxy port is reachable from the internet, because the router is then an open proxy that anyone can use. When the firewall blocks the port from the WAN side, the finding is reported as medium: it is not exposed, but you should confirm that you enabled it yourself.

Why it matters

This finding sits in the "signs of compromise" group for a reason. When MikroTik routers were taken over in large numbers after 2018, one of the most common things the attackers did was enable the web proxy. Two uses were typical. The first was injecting content — the proxy was pointed at your users' web traffic and a cryptomining script or advert was added to every page they visited. The second was relaying: an open proxy on a residential or business address is a valuable way for criminals to hide where their traffic comes from, and lists of such proxies are bought and sold.

If you did not enable the proxy yourself, assume the router may have been compromised. Look at the rest of your audit report for other indicators (unknown scripts, scheduler entries, new users, changed DNS), check the RouterOS version, and be prepared to reset the device and rebuild the configuration from a known-good export.

If you did enable it on purpose — some people still use it for a transparent cache or a simple content filter — the open-to-the-internet part remains a problem. An open proxy will be found and used within days. Your address will end up on abuse blacklists, your bandwidth will be consumed by strangers, and any illegal activity routed through it will be traced back to you first.

What it looks like in Winbox

Open IP → Web Proxy. The Enabled checkbox is ticked and the Port field (usually 8080) is set. Also open IP → Web Proxy → Access to see any access rules, and check IP → Firewall → NAT for redirect rules that send port 80 traffic into the proxy — that is the transparent-proxy setup attackers use.

How to fix it

Disable the proxy: untick Enabled under IP → Web Proxy. Then open IP → Firewall → NAT and look for rules with the redirect action that send web traffic into the proxy port; disable any you do not recognise. Both halves of a transparent proxy need to go.

Then look for the wider picture. If you cannot account for the proxy being enabled, treat it as evidence of a break-in. Go through System → Scripts and System → Scheduler for entries you did not create, System → Users for accounts you do not recognise, and IP → DNS (including the static entries) for changed servers. Upgrade RouterOS to a current version under System → Packages. If in doubt, back up what you need, reset the configuration, and rebuild from a clean export with new passwords.

Disabling the proxy does not affect Winbox or SSH access, so Safe Mode is not required for this step, but use it if you go on to edit firewall rules in the same session.

Afterwards, from a machine outside your network, point a browser at your public address on the proxy port (8080 by default) as its proxy and try to load any page; it should fail. Confirm in IP → Web Proxy that the service is off, then re-run the audit: the finding should be gone, and if other signs of compromise were listed, make sure those are gone too.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

I use the proxy on purpose for caching. Can I keep it?

You can, but only for your own network. Restrict the proxy with access rules that allow your LAN sources only, and make sure the input chain of the firewall drops connections to the proxy port from the WAN side. The audit will then report the finding at a lower level. Also consider whether the cache still earns its keep — on modern links it usually does not.

The proxy is enabled but the firewall blocks it from the internet. Why report it at all?

Because the question is not only whether it is exposed, but who turned it on. On a router where nobody remembers enabling the proxy, it is one of the clearest indicators that someone else has had administrative access. The audit reports it so that you check.

Could a firewall rule alone solve this?

Blocking the port from the WAN removes the open-proxy problem but leaves the proxy running. If it was enabled by malware, the injection of content into your users' traffic continues. Disable it and investigate.