Will running the audit change my router?

No. It performs read requests only. The suggested fixes are printed for you to run, and nothing is sent unless you type it yourself.

Is this a vulnerability scanner?

No. It does not probe for exploits or test credentials. It reads the router's own configuration and reports where it differs from a hardened one.

Why is telnet critical even when I have restricted it?

An allowed-address list limits who may connect, but the password still crosses the network in the clear for anyone positioned between you and the router.

Can I keep a copy of the report?

Yes. The whole audit copies out as plain text for a ticket or a handover note, findings and suggested commands included.

Security audit for MikroTik routers

Seventeen checks across the parts of a router that are usually left as they shipped. Every finding says what was actually found, explains why it matters, and — where a single command fixes it — gives you that command to run yourself.

What it looks at

Services carrying credentials in the clear and services reachable from any address. Accounts still called admin, and full-access logins with no address restriction. An input chain with nothing that drops, and DNS recursion left open behind it. Neighbour discovery and the MAC servers offered on every interface, WAN included. Certificates near expiry, RouterBOARD firmware waiting to be applied, and a clock that is not synchronized.

It reads, and stops there

Every check is a GET, and no remedy is ever applied. That is deliberate rather than cautious: dropping the input chain or restricting a service to one prefix can lock you out of the very router you are auditing, and that is not a decision a tool should take on its own.

An incomplete audit never looks like a clean one

A CHR has no RoMON; some builds have no SNMP. When the router will not return a menu, the checks that needed it are reported as not run — never as passed — and the report names them.

/ip firewall filter

/ip service disable telnet/ip firewall filter add chain=input \    action=drop in-interface-list=WAN/ip neighbor discovery-settings \    set discover-interface-list=LAN

The hardening audit, worst findings first

Questions

Will running the audit change my router?: No. It performs read requests only. The suggested fixes are printed for you to run, and nothing is sent unless you type it yourself.
Is this a vulnerability scanner?: No. It does not probe for exploits or test credentials. It reads the router's own configuration and reports where it differs from a hardened one.
Why is telnet critical even when I have restricted it?: An allowed-address list limits who may connect, but the password still crosses the network in the clear for anyone positioned between you and the router.
Can I keep a copy of the report?: Yes. The whole audit copies out as plain text for a ticket or a handover note, findings and suggested commands included.

Get Mikro Manager

Distributed through the Mac App Store — sandboxed, signed, and updated automatically.

Coming soon to the Mac App Store.

Requires macOS 14 or later, and a RouterOS v7 device with the REST API enabled.