The dynamic list includes dynamic interfaces, such as VPN interfaces and PPPoE. The same effect can be achieved using the command /ip service disable ftp. I recommend opening only SSH and Winbox from certain addresses and disabling everything else. Disable unnecessary services in the menu IP → Services. If the configuration of your services and firewall is correct, the router can work for years without updates.

Potential vulnerabilities in MikroTik devices pose real threats only if the admin hasn’t taken the basic precautions. those not included in routeros-platformname) can be completely removed from the system. Note that only the additional packages (i.e. If you don’t use IPv6, disable it if you don’t need Wi-Fi, disable the entire module using the same menu: System → Packages. However, you may try to use The Dude or handmade scripts for that purpose. If you have several MikroTik routers, keep in mind that it is impossible to upgrade them at once using the standard means. Thoroughly review the Changelog prior to the installation: sometimes, entire parts of the OS are replaced as a result, it cannot work with old settings anymore (as it was with bridge in version 6.41). Other branches can be used only for experiments on your home router. Devices that can be allowed to freeze for a few minutes during the update deserve the Stable version. I strongly recommend installing the Long-term version to critically important systems. To update your system, go to: System → Packages → Check For Updates → Download and Install.Īlternatively, you can type in the router console: /system package update install.įour software development branches are available for download: Long-term, Stable, Testing, and Development. Actual versions of the operation system and individual packages are available on the official MikroTik website in the Software Section.

The OS is not updated automatically so, you have to check for new releases on a regular basis. Therefore, the first thing you should pay attention to is the RouterOS version installed on your device. Many bugs are patched even before the public release of a new OS version, while others, within a day or two after it. To the credit of MikroTik engineers, they promptly issue patches fixing newly-discovered bugs. Today, I will explain how to protect your network against known and yet-unknown vulnerabilities in RouterOS. However, it is not enough just to find a bug – it must be neutralized. Firmware of popular routers often contains errors identified by security researchers on a regular basis.

Mikrotik bridge firewall