How to set up a WireGuard VPN on MikroTik for remote employees
Give staff secure access to office files and 1C from home — without opening RDP or Winbox to the internet.
Read articleMikroTik routers are powerful and affordable, which is why they are in so many offices. But a router left with factory settings and open management is an easy target — several RouterOS vulnerabilities were actively exploited in 2026. This guide gives a secure baseline for a typical office: one internet connection, an office network and guest Wi-Fi.
Before you start: the commands are for RouterOS v7 with the default configuration (interface lists
LAN and WAN, office network 192.168.88.0/24). Adjust addresses to your network. Work from the office LAN, and turn on Safe Mode (Ctrl+X in the terminal or the Safe Mode button in Winbox) before changing the firewall — if you lose access, the changes roll back automatically. Make a backup first.Step 1. Update RouterOS and the firmware
Install the latest version from the stable or long-term channel, then upgrade the RouterBOOT firmware.
/system package update check-for-updates
/system package update install
# after the router restarts:
/system routerboard upgrade
/system rebootStep 2. Replace the default admin user
Create your own administrator with a long unique password, log in with it and disable admin.
/user add name=netadmin group=full password="Long-Unique-Password"
# log in again as netadmin, then:
/user disable adminStep 3. Close unnecessary services and limit management
Turn off services you do not use and allow Winbox and SSH only from the office network. Also limit MAC access and neighbour discovery to the LAN.
/ip service disable telnet,ftp,www,api,api-ssl
/ip service set winbox address=192.168.88.0/24
/ip service set ssh address=192.168.88.0/24
/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN
/ip neighbor discovery-settings set discover-interface-list=LAN
/tool bandwidth-server set enabled=no
/ip proxy set enabled=no
/ip socks set enabled=no
/ip upnp set enabled=noStep 4. Firewall: protect the router and the network
If the default firewall was removed, restore these rules. The router accepts management only from the LAN, and new connections from the internet are dropped unless you created a port forward.
/ip firewall filter
add chain=input action=accept connection-state=established,related,untracked comment="accept established"
add chain=input action=drop connection-state=invalid comment="drop invalid"
add chain=input action=accept protocol=icmp comment="accept ICMP"
add chain=input action=drop in-interface-list=!LAN comment="drop everything not from LAN"
add chain=forward action=fasttrack-connection connection-state=established,related hw-offload=yes
add chain=forward action=accept connection-state=established,related,untracked
add chain=forward action=drop connection-state=invalid
add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN comment="drop new from WAN not port-forwarded"Step 5. Separate guest Wi-Fi
Create a separate bridge (here bridge-guest) with its own subnet and DHCP server for the guest Wi-Fi (Quick Set or /ip dhcp-server setup help with this). Then block guests from reaching the office network:
/ip firewall filter add chain=forward in-interface=bridge-guest out-interface-list=LAN action=drop comment="guests cannot reach office LAN" place-before=0Step 6. Time, backup and logs
Correct time is needed for logs and certificates. Save an encrypted backup and a readable export, and keep both off the router. If you have a log server, send logs there with /system logging.
/system clock set time-zone-name=Asia/Yerevan
/system ntp client set enabled=yes
/system ntp client servers add address=pool.ntp.org
/system backup save name=office-router password="Backup-Password"
/export file=office-router-configWhat not to do
- Do not forward Winbox (8291), SSH or WebFig to the internet. For remote administration use a VPN — see our WireGuard guide.
- Do not open ports with UPnP.
- Do not keep old RouterOS versions “because it works”.
A router is configured once, but it must be maintained all the time: updates, backups and a look at the logs.
Need help with this? Contact CySec for a free consultation.
Frequently asked questions
Which RouterOS version should a small office use?
The latest release of the stable or long-term channel. Long-term changes less often and suits offices that prefer stability; stable gets new features and fixes sooner. Never stay on a version with known exploited vulnerabilities.
Is it safe to manage MikroTik with Winbox over the internet?
No. Winbox, SSH and WebFig should be reachable only from the office network or through VPN. Several RouterOS flaws were exploited exactly through exposed management services.
Do I need to reset the router to apply this baseline?
Usually not. If the router came with the default configuration, you mostly tighten services and users. If the configuration history is unknown or the router may have been compromised, a clean reset and reconfiguration is safer.
How often should I back up the MikroTik configuration?
After every change and at least monthly. Keep an encrypted backup and a text export outside the router — for example in your password manager or documentation system.