A Working RouterOS Firewall Input Chain, Line by Line
Six rules that decide what can reach the router itself, in the order they must run — and the one rule every tutorial leaves out that makes the rest mean anything.
Networking · TIBCO · Unix
The settings that break your infrastructure never appear in the config.
Vendor defaults ship enabled and stay invisible. Every guide here is run against equipment I operate, with the commands, the actual output, and what to do when the documentation and the device disagree.
[admin@gw-edge] > /ip service print where disabled=no # NAME PORT 0 telnet 23 1 ftp 21 2 www 80 3 ssh 22 4 api 8728 FAILtelnet, ftp, www and api reachableenabled by default — plaintext credentials [admin@gw-edge] > /tool mac-server print FAILMAC-Telnet allowed on all interfacesbypasses every firewall rule you wrote [admin@gw-edge] > /ip neighbor discovery-settings print FAILdiscovery advertising on the WANmodel, RouterOS version, identity — to anyone [admin@gw-edge] > /tool bandwidth-server print FAILbandwidth-test server accepting sessionsa CPU exhaustion primitive, on by default 4 findings. None appear in /export. NET · MikroTik RouterOS · Cisco IOS
Networking
Hardening, firewall design, and the defaults that ship enabled but never appear in an export.
RouterOS /import Stops at the First Error and Says Nothing
A failed import leaves everything before the bad line applied and abandons the rest. The error tells you a line number and nothing about what landed.
CVE-2018-14847: Is Your MikroTik Still Backdoored?
Patching RouterOS closed the door but never removed what came through it. Six checks that find the accounts, scripts and proxies a compromise leaves behind.
Two articles a month
New guides go out the day they publish. No digest, no roundup, no forwarding other people's links.
Unsubscribe in one click. The list is never shared or sold.