If you are paranoid, to always assign 192.168.88.1/30 to the MGMT port, labeling it or using always the higher port number is introducing a vulnerability anyway by artificially limiting the range of possible connections.
Using a random number generator for the /30 subnet in the 10.0.0.0/8 much larger range, would be safer, i.e. 10.4.2.13/30 on ether4 will be more difficult to connect to, the choice of the port is also random : https://xkcd.com/221/
Further ideas:
camouflage, put an ethernet cable in that port anyway (with a loop on the other side, stashed away among the jungle of ethernet cables or connected to an unused port of a switch, etc. so that the led blinks)
the port should not always respond to pings, but from time to time it should, so you should have a script running that enables and disables ICMP at a few seconds intervals.
I know you are not suggesting it here but there is another quite obvious reason to not use that subnet.
Don’t use the same subnet as Mikrotik’s default settings. You might run into a conflict sooner or later. Especially when you are moving around quite a bit.
Same reason why one should avoid using 192.168.0.x, 192.168.1.x, … Those are too commonly used.
This one is labeled “read about it, initially ignored it, then it got back to me in a nasty way, so I learned my lesson”.
All devices I have in my backpack for whatever reasons have separate subnets not conflicting with any of the networks I normally manage.
This topic leads nowhere. It’s disccusion on “sparkling water vs. still water”.
The most equipped device has just 48 RJ45ports to check.
Leave any port off-the-bridge, do not configure it except assigning it to MAC-Winbox and/or MAC telnet. Period.
If you have a habit to make the last physical port the emergency one …good.., if the first one … good … not better, not worse … just the same “good”. It’s enough to be consistent. No one could prove that tha last, the middle or the first port is better. They are equal.
If you want to assign IP, just do it in a consistent way.
E.g. assigning Identity to routers falls into the same problem category . Ones prefer to include the localization, others local subnets, another others both information in the idenity, another another others do use part of serial etc.. What is better … you have to judge yourself.
Experience comes with failures and long-long-time hard work.
When you start skiing: You won’t learn until you fall. Some people fall rarely as they have that “something”, others often, even under supervision
Allow me to disagree, strictly speaking it seems to me more like a discussion on the “best technique to cork sparkling water bottles (containing still water) to avoid thiefs stealing all the CO2”.
quote:" I will say that you did make me realize that it would be wise to enable MAC WINBOX on those offbridge ports. That appears to require adding the OffBridge port to the admin/management/trusted/manage interface list (and making sure that MAC WINBOX is enabled for that interface list)." unquote.
I am still not convinced that you realize that RoS is based on logic and rules and not black magic??
In other words, one has to be at least a little curious, at least a little self-motivated, and do some basic research/education vice praying that it works.
…
…
Its basically a repeat of this line stated differently:
“In other words, one has to be at least a little curious, at least a little self-motivated, and do some basic research/education vice praying that it works”
Methinks you have trouble with the english language as well as RoS language??
If I may, only the emperor didnt see the problem with his new clothes!!
I think it is more of a problem of digesting stuff in a totally different way then most of us do… and most of us don’t understand or master that other way.
J, have you ever been diagnosed for such a thing ?
Honest question…
Please consider that it’s users’ forum most of the time operated by volunteers and most of us could write that
I sneak some time here and there to work on and play with and learn MT networking, often pre-dawn, or at random times when life’s responsibilities give me a break. There are about 20 other things that I’m trying (and not succeeding well) at learning, including other tech stuff (like Home Assistant)
so if some of us decided to help others just to fulfill own internal needs, then the “others” might take into consideration that some level of homework done is expected without asking about obvious or unrelated things.
You should remeber that there are some limits of help. We, the Users, are not coaches for free. We sail in the same boat but rookies have to work harder as they have less experience and the first storm shows their commitment. That’s life
(*) Sorry if my English fluency is not good enough to express my thoughts properly but i try.
You have Seas in Poland? Drats, tis true you have some romantic Baltic Sea beaches!!! I though the only clear fluids in poland was schnapps
Wow they are nice, and river cruises too. Lots to do there!!
I will stand by my original response after all that. The question was unusual but so what?
Using a single port in known and easily remembered relation to others, having also a non-stock IP address so I can use the port normally and not just for Winbox, all make sense on the simple proviso that use is at home. If someone breaks into my house then I suspect that “sit down and try to break into the router, having first broken into the computer or brought one with them” is not terribly high on their priority list, nor even very important to me. In that respect much of the blowback Josephny has received has been as pointless as anything else suggested.
Anyone not strictly complying with the arbitrary set of unwritten rules that a few members have established, let alone anyone using an even slightly diverging vocabulary or attempting to think laterally is deemed to be bullied, attacked personally, ridiculized or however bashed.
There is a not so fine line that is often crossed between being a tad bit harsh (with the intent to push the interlocutor to reason or study more on the discussion topic ) and being downright abusive.
But as the saying goes, you cannot have old dogs learn new tricks, these toxic personalities won’t likely change.
:
