Community discussions

MikroTik App
 
User avatar
kiler129
Member
Member
Topic Author
Posts: 352
Joined: Tue Mar 31, 2015 4:32 pm
Location: IL, USA
Contact:

[Feature Request] Changing SNMP port

Sun Apr 09, 2017 4:58 am

I'm REALLY surprised that RouterOS lacks ability to change SNMP service port (or I just couldn't spot that). I hope it will not be hard to add.

I know I can easily just do NAT rule, but in my opinion it just creates unnecessary clutter:
/ip firewall nat add 
	action=dst-nat 
	chain=dstnat 
	comment="Direct CACTI_SERVER to SNMP"
	dst-port=1234
	protocol=udp 
	src-address= CACTI_IP
	to-addresses=INTERNAL_ROUTER_IP
	to-ports=161

/ip firewall filter add
	action=accept
	chain=input
	comment="Allow SNMP from DSTNAT"
	connection-nat-state=dstnat
	dst-port=161
	log-prefix=SNMP
	protocol=udp
 
thepresident
just joined
Posts: 2
Joined: Sun Jul 22, 2018 5:06 am

Re: [Feature Request] Changing SNMP port

Sun Jul 22, 2018 5:58 am

I was surprised, too. many ISPs block port 161 for residential users, aiming to prevent misconfigured routers amplify DDoS attacks. However, it is not always possible to have a dedicated link without locks, so it is necessary to change the snmp port. with other vendors and Linux for example, I can easily change the snmp port to a high port (example: 15061), but in Mikrotik, it has no option to change the snmp port. I had to use the rule above, which is a lousy taste alternative.

I also have cloud monitoring, and some clouds block port 161 as well. and it is complex to request the release of that UDP port. for this and other reasons is a necessary feature in an upcoming version of ROS.

in general monitoring systems such as Zabbix, Librenms, PRTG allow configuration of SNMP's distinctive listening ports easily. only Mikrotik is missing this feature.
 
jo2jo
Forum Guru
Forum Guru
Posts: 1003
Joined: Fri May 26, 2006 1:25 am

Re: [Feature Request] Changing SNMP port

Wed Jan 23, 2019 10:41 am

I agree, i have a handful of locations where the ISP blocks udp 161. It would be nice if we could change this in the winbox interface directly. but do keep in mind you can accomplish this same thing via a NAT rule (depending upon your setup/layout). here is what im using for a MT that has a public ip dirct from ISP:
add action=dst-nat chain=dstnat comment=\
    "redirect THIS MTs SNMP bc xxx seems to be blocking udp 161 - jul 11 2018" dst-address=my.pub.ip.here \
    dst-port=1610 protocol=udp src-address-list=adminIPs to-addresses=10.7.20.1 to-ports=161
10.7.20.1 is the ip of this mikrotik

Who is online

Users browsing this forum: anav, Bing [Bot], Google [Bot], raiod and 84 guests