In the past several days I have noticed the following in my mikrotik log:
Obviously, two unknown mikrotik devices outside my local network are trying to connect to my CAPsMAN.
I found one of them on arp list:
How to prevent this?
It seems firewall rules on your router are a bit too permissive from WAN side. The old CAPsMAN manual mentions
Note: CAPsMAN uses UDP port 5246 for manager traffic and UDP port 5247 for data traffic
So if your CAPsMAN receives connection attempts via WAN interface, it seems like firewall is leaky (default firewall rules block these connection attempts). The other possibility (less likely but impossible to rule out without seeing full config of your router) is that CAPsMAN is set to be L2 discoverable via WAN interface as well.
For security reasons specify on which interfaces to listen to CAPs
/caps-man manager interface
set [ find default=yes ] forbid=yes
add disabled=no interface=bridge
>