MikroTik security findings, explained
Every finding the audit can report has its own page: what it means, why it matters, what it looks like in Winbox, and the exact RouterOS commands that fix it. Written for people who run a MikroTik router, not only for security specialists.
IPsec uses weak algorithms (DES, 3DES, MD5)
An IPsec proposal or profile on your router still allows DES, 3DES or MD5. These algorithms are decades old and no longer considered safe for protecting traffic. Moving to AES-256 with SHA-256 and a modern DH group is a one-line change.
L2TP client runs without IPsec
An L2TP client tunnel on your router is configured without IPsec. L2TP on its own carries traffic in the clear, so everything in the tunnel can be read by anyone on the path. Enabling IPsec fixes it.
L2TP server does not require IPsec
Your L2TP VPN server accepts clients that connect without IPsec. L2TP by itself provides no encryption, so such a client sends its login and all its traffic across the internet in the clear. Only use-ipsec=required enforces protection.
PPTP VPN client is configured
Your router connects out to a remote site or provider over PPTP. The encryption in PPTP has been broken since 2012, so anyone who records the tunnel can read what went through it and recover the password. Move the connection to WireGuard, IKEv2 or SSTP.
PPTP VPN server is enabled: a VPN that has been broken since 2012
PPTP was the easy VPN of the early 2000s. Its authentication and encryption were shown to be breakable in 2012, so a captured session can be decrypted and the password recovered. Here is how to replace it.
New article every other day · RSS