I see on shodan.io that the following ports are open externally
80, 2000, 8291, 8728..
More info states that
80 / TCP
HTTP/1.1 200 OK
Cache-Control: max-age=31536000
Connection: Keep-Alive
Content-Length: 7063
Content-Type: text/html
Date: Tue, 08 Feb 2022 16:38:33 GMT
Expires: Wed, 08 Feb 2023 16:38:33 GMT
X-Frame-Options: sameorigin
MikroTik RouterOS:
Version: 7.1.1
-1538260461 | 2022-01-11T20:50:45.045237
2000 / TCP
MikroTik bandwidth-test server
\x01\x00\x00\x00
528309196 | 2022-02-04T02:41:25.385111
8291 / TCP
\x13\x02index\x00\x00\x00\x00\x00\x00\x02\x00\x80\x00\x00\x00\x00\x02
2142810711 | 2022-02-05T23:36:31.700023
8728 / TCP
MikroTik RouterOS API Service
\x05!done%=ret=8d93364563e0cf666d18be64b508d168\x00
This is my export config
# feb/09/2022 08:58:18 by RouterOS 7.1.1
# software id = Y7E5-SEZ7
#
# model = RB1100x4
# serial number = D8580E4D7A72
/interface bridge
add name=bridge1
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.1.0/24
/ip dhcp-server
add address-pool=dhcp interface=bridge1 name=dhcp1
/port
set 0 name=serial0
set 1 name=serial1
/queue simple
add limit-at=5M/5M max-limit=100M/100M name=queuebw5 target=192.168.1.0/24
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=ether6
add bridge=bridge1 interface=ether7
add bridge=bridge1 interface=ether8
add bridge=bridge1 interface=ether9
add bridge=bridge1 interface=ether10
add bridge=bridge1 interface=ether11
add bridge=bridge1 interface=ether12
add bridge=bridge1 interface=ether13
/interface detect-internet
set detect-interface-list=all
/interface list member
add interface=ether1 list=WAN
add list=LAN
add interface=bridge1 list=LAN
/ip address
add address=192.168.1.1/24 interface=bridge1 network=192.168.1.0
/ip arp
add address=192.168.1.234 interface=bridge1 mac-address=2C:76:8A:AD:27:86
add address=192.168.1.10 interface=bridge1 mac-address=00:25:90:4B:6B:4B
add address=192.168.1.16 interface=bridge1 mac-address=00:15:5D:01:EA:01
add address=192.168.1.33 interface=bridge1 mac-address=00:15:5D:01:EA:08
add address=192.168.1.35 interface=bridge1 mac-address=00:15:5D:01:EA:09
/ip dhcp-client
add interface=ether1
/ip dhcp-server lease
add address=192.168.1.5 client-id=1:8:55:31:c1:67:57 mac-address=08:55:31:C1:67:57 server=dhcp1
add address=192.168.1.30 mac-address=58:9E:C6:19:81:1D server=dhcp1
add address=192.168.1.100 mac-address=10:BF:48:89:F3:3C server=dhcp1
add address=192.168.1.10 client-id=1:0:25:90:4b:6b:4b mac-address=00:25:90:4B:6B:4B server=dhcp1
add address=192.168.1.40 mac-address=18:16:C9:D0:8B:B2 server=dhcp1
/ip dhcp-server network
add address=0.0.0.0/24 gateway=0.0.0.0 netmask=24
add address=192.168.1.0/24 gateway=192.168.1.1 netmask=24
/ip firewall filter
add action=fasttrack-connection chain=forward comment="fast-track for established,related" connection-state=established,related hw-offload=yes log=yes log-prefix="fast-track for established,related"
add action=accept chain=forward comment="accept established,related" connection-state=established,related log=yes
add action=drop chain=forward comment=invalid connection-state=invalid log=yes log-prefix=invalid
add action=drop chain=forward comment="drop access to clients behind NAT form WAN" connection-nat-state=!dstnat connection-state=new in-interface=ether1 log=yes log-prefix="drop access to clients behind NAT form WAN"
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=22022 in-interface-list=WAN log=yes log-prefix=sftp-inleed protocol=tcp src-address=5.150.195.195 to-addresses=192.168.1.22
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
/system clock
set time-zone-name=Europe/Stockholm
/system identity
set name=mt-ro-homered
/tool graphing interface
add allow-address=192.168.1.0/24 interface=bridge1
add allow-address=192.168.1.0/24
/tool graphing resource
add allow-address=192.168.1.0/24
Also I see logon attempts in my logs, but I missed to copy them and not sure how to restore those log entries.
I am seriously concerned about this and do not want it. Never had it before using Mikrotik. It was blank.
Advice?