Connecting to MT

MikroTik RouterOS provides multiple connection methods including the graphical WinBox interface, command-line SSH access, web-based management, and MAC-layer protocols for initial setup and ongoing administration.

RouterOS offers several management interfaces suitable for different scenarios, from initial setup to remote administration and scripting automation.

Default credentials

You can find default credentials, including the MAC address, on the MikroTik device label typically located at the bottom. Here's an example:

Using WinBox

Download & Install WinBox

You can download latest version of WinBox from official website.

First things first you will need snap package manager, you can install it using:

sudo apt update
sudo apt install snapd

Then you can simply install WinBox using snap:

sudo snap install winbox

And you are ready to go

Connect WinBox to MT

You can enter either your IP or MAC address with user and password manually or you can click on Neighbors Tab and find your MT and just enter user and password.

Start configuring

When you connect for the first time you will be prompt to change the password.

Connection methods overview

Available connection methods

Graphical interfaces:

WinBox - Native Windows/Linux/Mac management tool
WebFig - Web-based configuration interface
QuickSet - Simplified web setup wizard
Mobile apps - Android/iOS MikroTik applications

Command line interfaces:

SSH - Secure Shell for encrypted terminal access
Telnet - Unencrypted terminal access (not recommended)
Serial console - Direct hardware connection
MAC-Telnet - Layer-2 protocol for initial access

API interfaces:

REST API - HTTP-based programming interface
API - Native MikroTik programming protocol
SNMP - Network monitoring protocol

SSH Connection

Using SSH from different platforms

Built-in SSH client (Windows 10+):

# Connect using default port
ssh admin@192.168.88.1

# Connect using custom port
ssh admin@192.168.88.1 -p 2222

# Connect with specific identity file
ssh -i ~/.ssh/mikrotik_key admin@192.168.88.1

Using PuTTY:

Download PuTTY from putty.org
Enter router IP address and port 22
Set connection type to SSH
Click "Open" and login with credentials

Terminal SSH connection:

# Basic connection
ssh admin@192.168.88.1

# Connection with custom port
ssh admin@192.168.88.1 -p 2222

# Connection with key authentication
ssh -i ~/.ssh/mikrotik_private_key admin@192.168.88.1

# Connection with specific cipher (for older RouterOS)
ssh -o KexAlgorithms=+diffie-hellman-group14-sha1 admin@192.168.88.1

Generate SSH keys for key-based authentication:

# Generate new SSH key pair
ssh-keygen -t rsa -b 4096 -f ~/.ssh/mikrotik_key

# Copy public key content
cat ~/.ssh/mikrotik_key.pub

SSH key authentication setup

Configure SSH keys for passwordless authentication:

# On RouterOS - import SSH public key
/user ssh-keys import public-key-file=mikrotik_key.pub user=admin

# Or add key directly via command line
/user ssh-keys add key-data="ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC..." user=admin comment="Management workstation"

# Verify imported keys
/user ssh-keys print

# Test connection from client
ssh -i ~/.ssh/mikrotik_key admin@192.168.88.1

SSH security hardening

Secure SSH access configuration:

# Change SSH port from default
/ip service set ssh port=2222

# Restrict SSH access to specific networks
/ip service set ssh address=192.168.1.0/24,10.0.0.0/8

# Disable password authentication (keys only)
/ip ssh set strong-crypto=yes always-allow-password-login=no

# Set SSH timeout
/ip ssh set forwarding-enabled=no host-key-size=2048

# Check SSH configuration
/ip ssh print
/ip service print where name=ssh

Web interface access

WebFig configuration interface

Access the web interface for graphical configuration:

# Default web interface access
http://192.168.88.1

# Secure HTTPS access (if configured)
https://192.168.88.1:8443

# Configure HTTPS certificate
/certificate add name=webfig-cert common-name=router.local days-valid=3650 key-size=2048
/certificate sign webfig-cert
/ip service set www-ssl certificate=webfig-cert disabled=no port=8443

# Restrict web access to LAN only
/ip service set www address=192.168.88.0/24
/ip service set www-ssl address=192.168.88.0/24

QuickSet initial configuration

Use QuickSet for rapid initial setup:

Access QuickSet: Navigate to router IP in web browser
Choose mode: Home AP, Router, Bridge, etc.
Configure basics: WiFi, passwords, internet connection
Apply settings: QuickSet applies comprehensive configuration

MAC-Telnet connection

Using MAC-Telnet for layer-2 access

MAC-Telnet allows connection without IP configuration:

# From Linux with mactelnet package
sudo apt install mactelnet-client
mactelnet -u admin MAC-ADDRESS

# From Windows using WinBox
# Use "Neighbors" tab in WinBox to discover devices by MAC

# From another RouterOS device
/tool mac-telnet MAC-ADDRESS

# Enable MAC-Telnet server on RouterOS
/ip neighbor discovery-settings set discover-interface-list=LAN
/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN

MAC-based discovery

Discover MikroTik devices on the network:

# From Linux
mndp-scan

# From RouterOS device
/ip neighbor discovery print

# Check MAC server status
/tool mac-server print
/tool mac-server mac-winbox print

Serial console connection

Physical serial connection

Direct hardware connection for recovery:

Connection parameters:

Baud rate: 115200
Data bits: 8
Parity: None
Stop bits: 1
Flow control: None

# Linux serial connection
screen /dev/ttyUSB0 115200

# Or using minicom
minicom -D /dev/ttyUSB0 -b 115200

# Windows using PuTTY
# Set connection type to "Serial"
# Enter COM port and baud rate 115200

Console cable requirements

RB series devices: DB9 serial cable (null-modem) CCR series: RJ45 console cable USB-to-serial adapters: Use FTDI or similar reliable chips

API access

REST API usage

Modern HTTP-based API access:

# Enable REST API
/ip service set api disabled=no port=8728
/ip service set api-ssl disabled=no port=8729

# Example REST API calls
curl -k -u admin:password https://192.168.88.1:8729/rest/interface
curl -k -u admin:password https://192.168.88.1:8729/rest/ip/address

# Python example using requests
import requests
response = requests.get('https://192.168.88.1:8729/rest/interface', 
                       auth=('admin', 'password'), verify=False)

Native API protocol

Binary API for custom applications:

# Python example using librouteros
from librouteros import connect

api = connect(host='192.168.88.1', username='admin', password='password')
interfaces = api('/interface/print')
for interface in interfaces:
    print(interface['name'], interface['type'])

Connection troubleshooting

Common connection issues

# Issue: Cannot connect to router
# Check network connectivity
ping 192.168.88.1

# Check if services are enabled
/ip service print

# Verify firewall rules allow management
/ip firewall filter print where chain=input

# Issue: SSH connection refused
# Check SSH service status
/ip service print where name=ssh

# Verify SSH is not blocked by firewall
/ip firewall filter print where protocol=tcp and dst-port=22

# Issue: Forgotten password
# Reset using reset button or serial console
# Hold reset button for 10+ seconds after power on

Reset and recovery procedures

# Software reset via terminal
/system reset-configuration

# Hardware reset button sequence
# 1. Power off device
# 2. Hold reset button
# 3. Power on while holding reset
# 4. Wait for LED sequence (varies by model)
# 5. Release reset button

# Netinstall recovery (for serious issues)
# 1. Download Netinstall from MikroTik website
# 2. Boot device in Netinstall mode
# 3. Use Netinstall to reflash RouterOS

Network discovery tools

# Discover MikroTik devices on network
# Using nmap to scan for RouterOS
nmap -sS -O 192.168.1.0/24 | grep -B 5 "MikroTik"

# Using MikroTik discovery protocol
# From Linux with mactelnet
mndp-scan

# From Windows
# WinBox Neighbors tab
# Use "..." -> "Discovery" in WinBox

Advanced connection scenarios

Connection through VPN

Access router through VPN tunnels:

# SSH through OpenVPN tunnel
ssh admin@10.8.0.1

# WinBox through IPSec tunnel  
# Connect to tunnel endpoint IP
# Use WinBox with router's tunnel IP

# WebFig through WireGuard
# Access via WireGuard interface IP
https://10.13.13.1:8443

Jump host connections

SSH through intermediate servers:

# SSH through jump host
ssh -J jumphost@gateway.example.com admin@192.168.88.1

# SSH with port forwarding
ssh -L 8291:192.168.88.1:8291 user@jumphost
# Then connect WinBox to localhost:8291

# ProxyCommand method
ssh -o ProxyCommand='ssh user@jumphost nc 192.168.88.1 22' admin@192.168.88.1

Automated connections

Script connections for automation:

# SSH with expect script
#!/usr/bin/expect
spawn ssh admin@192.168.88.1
expect "Password:"
send "mypassword\r"
expect ">"
send "/system identity print\r"
expect ">"
send "quit\r"

# SSH with key authentication for scripts
ssh -i ~/.ssh/mikrotik_key -o StrictHostKeyChecking=no admin@192.168.88.1 '/system resource print'

# Batch commands via SSH
echo "/system resource print; /interface print" | ssh admin@192.168.88.1

Show complete connection troubleshooting guide

# Complete connection troubleshooting checklist

# 1. Physical connectivity
ping 192.168.88.1                    # Test basic IP connectivity
arp -a | grep 192.168.88.1           # Check ARP table entry
netstat -an | grep :8291              # Check if WinBox port is reachable

# 2. Service status verification
/ip service print                     # Check enabled services
/interface print brief                # Verify interface status
/ip address print                     # Check IP configuration

# 3. Firewall verification
/ip firewall filter print where chain=input    # Check input rules
/log print where topics~"firewall"             # Check firewall logs

# 4. User account verification
/user print                           # Check user accounts
/user active print                    # Check active sessions

# 5. Certificate issues (HTTPS/API-SSL)
/certificate print                    # Check certificate status
/certificate sign-verify cert-name    # Verify certificate

# 6. Network discovery
mndp-scan                            # Scan for MikroTik devices (Linux)
nmap -p 8291,22,80 192.168.88.1     # Scan management ports

# 7. Recovery procedures
# Hardware reset: Hold reset 10+ seconds after power on
# Software reset: /system reset-configuration
# Netinstall: For complete firmware recovery

# 8. Advanced diagnostics
/tool torch interface=ether1         # Monitor traffic
/system logging print               # Check system logs
/system resource monitor            # Check system resources
/ip neighbor print                  # Check ARP entries

Connection best practices

Security recommendations

Use strong passwords - Never use default credentials in production
Enable SSH keys - Disable password authentication when possible
Restrict access - Limit management to trusted networks
Use HTTPS - Enable SSL certificates for web access
Monitor access - Log and review connection attempts

Performance optimization

Choose appropriate method - WinBox for GUI, SSH for scripting
Use local connections - Direct connection when possible
Optimize SSH settings - Configure proper ciphers and timeouts
Limit concurrent sessions - Avoid too many simultaneous connections
Use compression - Enable SSH compression for slow links

Operational procedures

Document access methods - Maintain inventory of connection details
Test backup access - Ensure alternative connection methods work
Plan for recovery - Know reset procedures and recovery options
Automate routine tasks - Use scripts for repetitive operations
Monitor connections - Watch for unauthorized access attempts

PreviousWelcome NextChecking for updates

Last updated 3 months ago

Was this helpful?

Good morning

hashtagDefault credentials

hashtagUsing WinBox

hashtagDownload & Install WinBox

hashtagConnect WinBox to MT

hashtagStart configuring

hashtagConnection methods overview

hashtagAvailable connection methods

hashtagSSH Connection

hashtagUsing SSH from different platforms

hashtagSSH key authentication setup

hashtagSSH security hardening

hashtagWeb interface access

hashtagWebFig configuration interface

hashtagQuickSet initial configuration

hashtagMAC-Telnet connection

hashtagUsing MAC-Telnet for layer-2 access

hashtagMAC-based discovery

hashtagSerial console connection

hashtagPhysical serial connection

hashtagConsole cable requirements

hashtagAPI access

hashtagREST API usage

hashtagNative API protocol

hashtagConnection troubleshooting

hashtagCommon connection issues

hashtagReset and recovery procedures

hashtagNetwork discovery tools

hashtagAdvanced connection scenarios

hashtagConnection through VPN

hashtagJump host connections

hashtagAutomated connections

hashtagConnection best practices

hashtagSecurity recommendations

hashtagPerformance optimization

hashtagOperational procedures