Cannot access MikroTik router from external network. SSH/Winbox/FTP - nothing works

RouterOS Beginner Basics
1

I’ve got a MikroTik map 2n router connected to internet via USB 3G modem.
What I’m trying to do is to connect to the device via ssh from a computer located in another network.

I’ve added new Filter Rule accepting port 22 on TCP protocol, which was suppose to help, but it doesn’t do the trick.

The way I try to connect to ssh is by checking the IP on whatsmyip.org site from a computer connected to MikroTik router and then typing a command in a terminal of a computer I need to connect from:

ssh admin@<ip_address>

What I recieve back is:

ssh: connect to host <ip_address> port 22: Bad file number

SSH is not the only service that’s not available.

    • Entereing http:// in the web browser doesn’t work (website unavailable)
  • Connecting to FTP on port 21 - it throws connection timed out error.
  • Trying to remotely connect via WinBox 3.0rc9 results in "ERROR: could not connect to

All the services in IP>Services are enabled (except for www-ssl).
SSH works when connecting from a local computer using local IP address.

Here are my settings:
ppp.png
nat.png
filter_rules.png
Can you help me find a way to connect to my router remotely?

2

First thing I would do is changing the SSH service port (IP>Services), leaving port 22 open to the Internet is a BAD idea (have a look at your log!). Of course change the port accordingly in the firewall filter.

Second, which ROS version are you using? 6.25 had a problem with SSH process eating 100% CPU (and not letting you connect).

3

I’ve changed ssh port to 2299 and updated filter rules, but when I try to connect:

ssh admin@<ip_address>:2299

it throws this error:

connect to host <ip_address>:2299 port 22: Bad file number

I’m not an expert on ssh, but it seems it tries to connect on port 22 regardless of the port I provided after IP

I’m using RouterOS 6.18

EDIT:
I’ve just upgraded to 6.28. The problem still occurs

4

What SSH client are you using? It seems you aren’t supposed to specify the port like :, but are instead supposed to specify them separately somehow.

If you’re using the RouterOS’ SSH client (from a remote RouterOS…), then you are supposed to use

/system ssh address=<ip> user=<user> port=<port>
5

I was connecting to ssh via Bash terminal on Windows.

But I also just checked on Putty, specifying the new port, but it throws “Network error: Connection timed out” no matter if I put or admin@ as a Host Name.

6

I’ve just figured out what’s wrong…
As it turns out my mobile operator doesn’t assign public IPs and blocks all the incomming connections with it’s firewall.

I’ve heard this can be somehow bypassed using VPN.
Does anybdy know what kind of VPN do I need for that and how to configure it in RouterOS?

7

Depends. What kind of VPN are you looking for? Also, this may/may not work depending on your carrier.

You’d have to setup a VPN client on the AP and a VPN server on the other side. This will ‘bridge’ the two networks and in theory, should be able to route between them.

8

The kind that would enable me access to my router remotely :slight_smile: That’s the only thing I need. I know next to nothing regarding VPNs.

9

Well, I was asking if you needed encryption or any particular mode… but since it doesn’t really matter in this scenerio, then a PPP tunnel should do the job.

What do you have on the other end to act as a VPN server? Also, does it have a static ip or DDNS setup?

10

Right now I don’t have anything. I just figured out few minutes ago that my mobile carrier doesn’t assign public IPs and a quick google search pointed me in the direction of VPNs. I really know nothing about them and I’m asking for help in choosing right VPN for my needs that will work with MikroTik router and enable the possibility of remote SSH connection to my device.
It doesnt have to be static IP, I can work with DDNS.

11

What better than to have another mikrotik on the other end? :wink:

A simple RB750 or Hap Lite will do the job as you’re not looking to put all traffic over the vpn, just enough to Winbox or SSH into the AP.

Will this vpn server (hopefully a mikrotik) be mobile, or always at a specific location?

12

If I were to set up my own VPN server, it would be always in specific location. I don’t know if thats relevant, but I have few dozens of mobile devices with no public IPs I need to be able to connect to.

13

Should be no problem. You should probably invest in a higher end RB if you’re going to have a few dozen tunnels open at once. The RB850Gx2 is probably the best choice / value.

There’s a new RB coming out later this year (in a month or 2), the RB3011. An update to the RB2011, with all 10 Gbit ether ports and a dual core cpu. Supposedly more than 2x the processing power than the current RB2011.

14

I only need to be able to access one device at the time and switch between them at any given moment.
Do you know of any tutorial of how to do it with MikroTik routers on both ends?

15

It’s not so much the using only 1 connection at one time, but you have to keep the tunnel up all the time for the connection to work (since your mobile provider doesn’t provide any kind of public address. If you mobile provider ‘could’ provide you a public address, then you could connect/disconnect the tunnel as needed since the AP would be the VPN server instead of the client). Keeping a few dozen tunnels open at once will take some cpu usage. You could test with an RB750 and see how far you’re able to push it, but just wanted to give a warning ahead of time.

a quick google search brought this up.
http://mikrotikroutersetup.blogspot.com/2011/10/mikrotik-router-site-to-site-pptp-vpn-server-configuration.html

Your HQ would be your main router and remote would be the access points connected via the mobile provider.

16

Thank you for your help! I hope I can get it to work.

17

Give a whirl. If you have problems we can test between your main router and mine.

18

One more thing:
Is it possible to configure remote routers in such a way that only SSH traffic would be directed through VPN tunnel and all the other kinds of traffic would go as it normally would?
I simply don’t have good enough internet connection where the main device would be kept to manage all the traffic from all of the devices.

19

Yep, pretty simple. On the ‘client side/ ap’…Make sure the tunnel doesn’t setup a additional default route. As long as the default route is left alone, literally no unwanted traffic should traverse the tunnel.

Once the tunnel is established to the main router, just ssh from the main router to the access points (using their tunnel terminating IPs) from the terminal and voila.

As a newbie myself, I’m still working on how to have a PC traverse the VPN tunnel without using nat (so you can just winbox to any AP as long as you’re at your main place).

Give me a few days to test/play.

20

Ok, took some time to test and it seems to work. I can winbox over a vpn tunnel to another Mikrotik device.

Here are the steps I took. (This assumes you disable your filter drop rules during the VPN creation process so you then know how to filter out unwanted inbound internet traffic later, I’ll explain why in a minute. )

Main Router (VPN Server)
IP>Cloud>DDNS Enabled Checked>Update Time Checked>Copy and paste the DNS name somewhere easy to get to. You’ll need it later. >Click OK.
PPP>Profiles>Add profile>Name= vpnServerProfile> local address= 10.10.20.1>Click OK
PPP>Secrets>Add Secret>Name= (however you will identify this particular access point)>password=(you get the hint, use something standardized for your vpn users)>profile=vpnServerProfile>RemoteAddress=10.10.20.51(this will be the static IP for your first access point that will be connecting)>Click OK
PPP>InterfaceTab>PPTP Server>Check Enabled, make sure your max mtu/mru are at 1450.>Default Profile=vpnServerProfile>Check MsChap2 & MsChap1>Click OK.

Your VPN server is live and should be able to accept VPN connections that match your profile & secret.

Remote Router (VPN Client)
PPP>Profiles>Add profile>Name= vpnClientProfile> Click OK
PPP>Interface>Add PP2P Client>Name=PP2PClient>Dial Out Tab>Connect To:user=password=Profile=vpnClientProfile. DO NOT CHECK ADD DEFAULT ROUTE. >Check MsChap2 & MsChap1>Click OK.

With any luck, your VPN connection should be live. You can verify this on the VPN sever>PPP>Active Connections

Now, if you want to be able to Winbox into that remote VPN Client, and your laptop is connected on the lan of the vpn server. You’ll need to add a static return route.

On the VPN Client router>IP>Routes>Add New Route>Dst Address should be the LAN address of your VPN Server (Mine is 192.168.88.0/24 for example).Gatway=PP2PClient>Click Apply and you should see ‘reachable’>Click OK

At this point, you should be able to Winbox to the VPN Client via the VPN Client IP (10.10.20.51). Voila.

Repeat the Secrets on the VPN server as many times as you have remote access points, and then just follow the Remote Router (VPN Client) setup.


Now here’s a security warning. A) PPTP isn’t the greatest encryption, but that doesn’t matter to me for the most part for a scenerio where I’m only connecting to mikrotik devices for ‘routine checkups’. B) Your firewall rules. You need to have something. However because your mobile provider doesn’t give you public IPs, you’re going to have to use DDNS. Turn on the built in DDNS on each AP. You’ll need to put all those DDNS names in a spreadsheet/text file and use a script to resolve them every 30 minutes via the VPN Server router. Once resolved, those IPs would be added to a Firewall Address list with a timeout of 00:29:58. This way every 30 minutes, the address would time out and then new resolve the name and start the process over again. You can multiple IPs in the same address list name (multiple separate entries). You would then add this Address list to the Input Drop Rule (In Interface=Wan ether) > Advanced Tab>Src Address List= address list name>Tick the box to the left of it. This is a ‘not’ or exception box. >Action Tab>Action=Drop>Click OK Only Do this if you’re DIRECTLY connected to the router, because if you miss a step or fat finger in THIS specific drop rule, you risk the chance of blocking yourself So basically in your input drop rule would drop everything inbound via the Internet will be blocked EXCEPT for your Address list (which is dynamically being updated by a script which is being called by the scheduler.)

I don’t have the script available. However, I have scene a few resolve>address list scripts around. If I find one, I’ll post it.