It’s not clear to me, what port needs to be forwarded for the MirotikApp to be able to connect remotely to the router using DDNS?
I have disabled the http and api services, leaving only https and api-ssl enabled.
I have also changed the default port values for this services, and created a self generated SSL certificate for the https connection.
From inside the LAN I have no problem using the Web Interface or the Mikrotik App. Both works with no issues.
I have port forwarded the https port in the firewall, and I can successfully connect from the outside with it using the web interface.
If I put the same DDNS address and port in the MikrotikApp, it says: Connecting… followed by 2 seconds later Logging In… and finally 5-10 seconds later Failed to establish secured connection.
If I port forward the api-ssl port, I get the same reply.
If I put any other port there, the response is instant: Connection refused.
I can see the packet counter increasing on any of this 2 ports (https or api-ssl) by 2 every single time I’m trying to make a connection from the outside using the Mikrotik App. So something is happening, but very probably not the correct stuff.
Do we have any walkthrough on how to set this properly?
Remote management through anything but VPN is bad practice. So I would like to advice you not to do any port forward while publicly connected except VPN.
Well to be frank and not xvo, the microtik app uses any port you tell it to use.
I don’t use the standard winbox port and I use IKEV2 VPN in conjunction with the MT app (and not the default winbox port - keeps russian hackers with beards away ).
And how do you do it, when you have 3 sites in the saved list?
You make a VPN on your phones and PCs for each one of them? That would be more than annoying and defeats the purpose of the app, I might as well not use it at all and still use the web interface with the current setup. Have yet to see being hacked with a random DDNS address and a random port, accessed once a month or even less; it’s similar chance to hacking the VPN tunnel
I rekon the easiest and safest thing for us to have would be for the App and router to have a key pair type, and let you to authenticate on the port you instruct, only with the correct SHA-256 key. And in this case you would require no VPN, as security would be similar.
Thank you for your suggestions, I’ll look into seeing if forwarding the winbox port works, although I’m not really happy about it, I wouldn’t want to share that port.
).