routeros-management-tools
Installation
SKILL.md
RouterOS management tools
Every management path is also an attack surface. Enable the ones you use, restrict them in /ip/service and the firewall (routeros-initial-setup,
routeros-system-utilities), and prefer keys and VPNs over exposing ports.
| Tool | Reaches the router by | Notes |
|---|---|---|
| WinBox v4 (Windows, Linux, macOS) | IP (TCP 8291) or MAC | Signed binary; ECSRP authentication; the GUI mirrors the CLI and has a terminal. v3 is the legacy Wine/Windows build |
| WebFig | IP, HTTP/HTTPS | Same layout as WinBox in a browser. Use HTTPS (www-ssl with a certificate) |
| SSH | IP, TCP 22 | Server on by default; client /system/ssh, scripts use /system/ssh-exec |
| Serial console | RS232 cable | For first setup and recovery; null-modem cable and a terminal program, port settings (/port/set serial0 baud-rate=... data-bits=8 parity=none stop-bits=1) must match the device |
| MAC Telnet / MAC WinBox / MAC ping | MAC on the same L2 segment | Needs no IP configuration; allowed on the LAN interface list by default |
| RoMON | MAC-layer overlay between routers | Independent of L2 and L3 configuration; unencrypted, so use SSH or WinBox on top |
| API, REST API | IP | routeros-api |
| CMR | Fleet server and clients | Monitoring, upgrades, alerts, scripts on many devices |
| TR-069 client | ACS over HTTP(S) | /tr069-client (acs-url, username, password, periodic-inform-interval, client-certificate) |