Many ISP routers have WinBox (port 8291), SSH (22), API (8728, 8729) and WebFig (80, 443) open to the internet so staff can manage them remotely. Every open port is a door for password guessing and attacks, and one compromised core router can take down a whole network.
The safer way: manage through a tunnel
Keep management closed to the internet and the LAN, and reach your routers only through a private, encrypted tunnel. Purple Router links each MikroTik over WireGuard, which makes this simple.
Lock mode in Purple Router
Lock mode is one recommended switch. When it is on:
- WinBox, SSH, API and WebFig are blocked from the internet and LAN.
- All four logins are allowed only through the Purple Router tunnel, for your team.
- Your staff still get secure WebFig access online and WinBox remote access from the dashboard.
Good habits that still matter
- Keep RouterOS up to date.
- Give each staff member their own login and remove access when they leave.
- Keep a safe way to reach your routers in an emergency.