hey friends thanks for the discussions; i have the same issue i configured my mikrotik 951v and my WAN ip is local IP from TP link router and i need it to access from another internet without public IP addess, i need to access and i want use it with local IP address so is that possible frinds thanks
how to access multi router board (winbox) in same internet connection. i am also using single winbox access anywhere on other internet by using this port forward settings
/ip firewall filter add action=accept chain=input disabled=no dst-port=8291 protocol=tcp
know i am using multi router board… i want to access multi winbox access on same domain how to configuration
Hi, im using the 3.9 version.
Sadly im not able to access throw cloud service.
Can you guys recomend me any topic for setup the remote access?
My primary router is a Mikrotik Rb2011 UIAS-RM conected by PPPOE to my ISP (Dynamic IP service).
Have some Ubiquiti antenas and ip cameras… its all working good in my local network my problem is to access from my office.
I would like to access my 3011 mikrotik device remotely wiht only my personal laptop . Do you know how to achieve this ?
I may have solutions for this thread. I posted the link below and I can now successfully access all my Mikrotik devices on my home network through the internet.
http://forum.mikrotik.com/t/can-i-configure-wlan-wap-ac-through-router-hex/108448/8
below is what I used as a guideline, its from this link https://shop.duxtel.com.au/article_info.php?articles_id=6
Access “hidden” mikrotik device by Winbox by Mike Everest
inShare
Here’s the scenario:
Mikrotik Router as a hotspot gateway running on the wireless network (the Gateway).
A second device is connected by WDS to the gateway used as a network range extender (the Booster).
We can connect to the Gateway using winbox by connecting to the public IP address.
How to connect to the Booster with Winbox too?
To acheive this task, we will map connections to the Gateway device on port 8292 to the winbox port (8291) on the Booster. The following steps will assume that the Booster is a simple WDS slave with no IP address assigned to any iterface.
STEP 1: Add an DHCP client address to the Booster device on the hotspot cell.
This can be done easily using winbox, but you can’t access with winbox, right? Not a problem. We can use the mac-telnet tool from the Gateway device to add the dhcp client on the Booster:
First log in to the Gateway using winbox
Click on the Telnet menu item, and select the MAC Telnet option, and notice that the IP address field now changes to a drop-down select field
If your Booster device doesn’t show up in the list, you can type it in manually, then click Connect
Enter the username and password for the Booster, then execute the following command:
/ip dhcp-client add add-default-route=yes comment=“” default-route-distance=0 disabled=no interface= use-peer-dns=yes use-peer-ntp=yes
Note that you will need to change the interface to suit your configuration. If you are not sure what is the name of the right interface, execute:
/interface wireless print
and look for the value of the wds-default-bridge setting.
Now check that there is an ip address
/ip address print
And make a note of the IP address assigned
Try to ping the Gateway
/ping
Change (of course) the to the actual address of your gateway device. Note that ping time-out is expected, but pinging the gateway will cause the Booster host to be added to the device list under the Gateway hotspot service.
STEP 2: Make the Booster DHCP lease permanent in the Gateway DHCP Server.
Back on the Winbox session to the Gateway, click on the IP menu item, then select DHCP Server
Select the Leases tab, and then click on the entry containing the IP address observed in point 11 of STEP 1 above
STEP 3: Add a bypass rule in the Gateway hotspot for the Booster device.
Still in the Gateway Winbox session, click on IP and then select Hotspot
Select the Hosts, then double click on the entry containing the Booster device. If it is not there, go back to point 12 in STEP 1 above
When the host entry details panel opens, click the button labelled Make Binding
In the New Hotspot Binding dialog, set the Type to Bypassed, then click OK
STEP 4: Create a destination NAT rule to map incoming port 8292 to the Booster on port 8291.
Now click IP in the menu, and choose Firewall
Select the NAT tab, then click the red ‘+’ icon near the top left
On the General tab, enter:
Chain: dstnat
Dst. Address: (i.e. the address you are connecting to with the current winbox session)
Protocol: tcp
Dst. Port: 8292
On the Action tab, enter:
Action: dst-nat
Dst. Addresses: (i.e. the address from 11 of STEP 1 above)
Dst. Port: 8291
Click OK
STEP 5: Connect to the Booster in Winbox.
Now, if everything is set up right, you can now connect to the remote device using winbox by specifying the IP address of the Gateway, and specifying the port defined in 3 of STEP 4 above, using this notation:
:
For example, if you connect to the Gateway device on adress 192.168.1.1, then you will connect to the Booster using 192.168.1.1:8291
NOTE: Older versions of the Winbox loader do not support this port specification. Always make sure that you have the latest version downloaded from the Mikrotik web site.
You can repeat these steps multiple times if you have several Booster devices inside your hidden network, by simply changing the destination port each time; 8293, 8294, etc.
Actually if you want to get access to your Mikrotik from a remote network, you should have a look to Cloutik
Very simple to use, tested with several routerboards
@scampbell Trainer my ass, go back to security school!
This whole thread seems to ignore the huge security implications (or infractions if for a business) that are being apparently openly discussed.
Access to the router in any plain mode is let me put it in simple terms - STUPID.
The best way to access the RouterOS remotely is through VPN. This is actually not that difficult for example using the RouterOS IOS or Android app on the smart phone via an
IKEv2 secure connection is fairly easy(one of many options). If that is too daunting at least look at port knocking which is discussed in many threads.
As a minimum, any wanker that is still using the default winbox port, needs to be drawn and quartered (UK euphemism for getting a good spanking… hmm some here might like that)
(Ip services - set winbox port and narrow down allowed access)
(System - users, narrows down access)
(input chain - narrow down users with access to router)
You’re responding to post from 2012. That was long before the most ugly WinBox bug. It’s possible that WinBox was completely secure back then, but it’s hard to tell, since changelogs from that time were a little sparse.
What?? Its 2019… where did the time go! 
If I enabled the default firewall in the Quick Config screen and I then went to IP->Cloud and setup a CNAME on my domain what rule to I need to add to the firewall to allow myself to access the router with WinBox remotely from (xxx.xxx.xx.xxx - my office IP)
You don’t because it is highly unwise. If you really need access to any services locally, use VPN.
Red your post again, you have to add the address to your rule
Nothing to worry about, with Thor’s Hammer he will be able to repel any hackers. No need for proper config security.
I would assume you have a dynamic wan ip so i would enable ddns under ip cloud then if the router is not the one with the public address run ip cloud advanced use-local-address that will make ur routers ip be linked to the dns name that is publicly routable. From there set up a sstp or l2tp-ipsec server so that you can make clients connect to the dns name ip cloud gave you. From there sort our ur firwall by adding rules to accept input from ur lan and from the tunnel ports as well as to the ip could servers that the ips can be found at https://wiki.mikrotik.com/wiki/Manual:IP/Cloud#Advanced
Basic firewall rules and security can be found here https://wiki.mikrotik.com/wiki/Manual:Securing_Your_Router
L2tp config can be found here https://wiki.mikrotik.com/wiki/Manual:Interface/L2TP#Basic_L2TP.2FIpSec_setup
Do that then once all that is set up connect a client to the tunnel server and do a ping -l (packet size) -f from a cmd at eithet and and ping the other end. Start at lik 1472 and work ur way down by like 10-20 each time till it works then go up till it doesnt. Find the largest size u can ping through at and go to ur vpn servrr config and put that in the mtu configuration section. Oh also enable proxy arp on ur lan bridge interface if u want the clients to be able to connect to ur lan.
Sorry for the low quality post im on my phone atm :]
I’m trying to access routerboard from the android app, wan side.
Could the RoMON agent be used for this? If so, please redirect me to a setup page for dummies, or explain how it is done,
Do I still need some kind of dyndns?
Use case: Kid control at work. Homework & dishes done before play…
Thanks in advance!
Just want to jump in
what if you want to have remote access but from a different ethernet port ?
and a vlan ?
I just followed these instructions on WebFig and I am still unable to winbox into my MikroTik. Is there something else I am doing wrong?
I tried to create the firewall rule using the instructions:
IP → Firewall → Filter Rules → Add new
action = accept
protocol = tcp
chain = input
dst-port = 8291
I also placed it at the top of my firewall rules list, but still Winbox will not remote into my MikroRik using the WAN IP address.
Anything I am missing?
Sorry Wrong thread
DO NOT ACCESS ROUTER VIA WINBOX AND WAN directly.
Use VPN to access router securely and then use winbox.
Wireguard is easy and works well for this.
If you don’t have a public IP, or ISP router does but cannot forward a port to MT device, then use BTH wireguard VPN on mikrotik. ( allows both MT router and single devices (remote laptop/smartphone) to connect to MT cloud relay server.
If you don’t believe me, look at MTs default configuration, WAN access to the config or the input chain is NOT permitted, and the only thing people add here are services on the router like VPN!
Finally if there are no other options, then at least use port knocking. Which MT does include in their documentation. Do you know whats not in their documentation, recommending using winbox over the external www.
A paid option is get a chr license from MT and then rent server space in the cloud $7 per month.