Page 1 of 1

Locked Out of Mikrotik

Posted: Thu Aug 30, 2018 12:11 pm
by gnarl
Hi everyone!
I'm stupid and i have disabled all the services ports, including winbox (8291) and ssh.

The MikroTik is working well, but I can't connect to it. What can I do to restore access? I also have a physical access to device.

The model is MikroTik RB951Ui-2HnD there is no physical Serial port to connect through it and restore access. Resetting the device is my last last resort because i don't have a backup config and i have allot of stuff configured inside that i cant configure them again!

Is there any solution for this case?

Neighbors shows my router mac address but when i try to connect i get an ERROR: Could not connect message.

Re: Locked Out of Mikrotik

Posted: Thu Aug 30, 2018 12:23 pm
by BartoszP
Winbox via MAC address.
Open Winbox ... click "Neighberhood" ... wait for your router ... click MAC address in the MAC column ... fill user + password ... connect

Re: Locked Out of Mikrotik

Posted: Thu Aug 30, 2018 12:26 pm
by gnarl
Winbox via MAC address.
Open Winbox ... click "Neighberhood" ... wait for your router ... click MAC address in the MAC column ... fill user + password ... connect
As i already have written in my post i have already tried to connect via Winbox >> Neighbors with no success when i try to connect i get an ERROR: Could not connect.

Re: Locked Out of Mikrotik

Posted: Thu Aug 30, 2018 12:36 pm
by BartoszP
Do you have MAC address in the field "Connect to:" specified?

Re: Locked Out of Mikrotik

Posted: Thu Aug 30, 2018 12:46 pm
by gnarl
Do you have MAC address in the field "Connect to:" specified?
Yes i have look at the attached picture
winboxproblem.jpg

Re: Locked Out of Mikrotik

Posted: Thu Aug 30, 2018 2:49 pm
by ADahi
try mac-telnet from other connected routerboard

Re: Locked Out of Mikrotik

Posted: Thu Aug 30, 2018 3:18 pm
by gnarl
try mac-telnet from other connected routerboard
Unfortunately i don't have other Mikrotik router

Re: Locked Out of Mikrotik

Posted: Thu Aug 30, 2018 3:26 pm
by proximus
Are you using WinBox on a Windows VM?

Asking because I have not been able to make MAC connections work from a Windows VM on Fusion. Have to use WinBox directly on the Mac OS X host system.

Re: Locked Out of Mikrotik

Posted: Thu Aug 30, 2018 3:45 pm
by freemannnn
try mac-telnet from other connected routerboard

if you can wait 1-2 hours i can go office and close all services in my main router and try to connect to it with mac-telnet from another hap lite that i have spare.
what do u think? should i try?

Re: Locked Out of Mikrotik

Posted: Thu Aug 30, 2018 4:06 pm
by gnarl
try mac-telnet from other connected routerboard

if you can wait 1-2 hours i can go home and close all services in my main router and try to connect to it with mac-telnet from another hap lite that i have spare.
what do u think? should i try?
Yes please <3

Re: Locked Out of Mikrotik

Posted: Thu Aug 30, 2018 4:07 pm
by gnarl
Are you using WinBox on a Windows VM?

Asking because I have not been able to make MAC connections work from a Windows VM on Fusion. Have to use WinBox directly on the Mac OS X host system.
The computer i am using winbox is a physical windows 7 computer connected on the same network as my router

Re: Locked Out of Mikrotik

Posted: Thu Aug 30, 2018 4:11 pm
by gnarl
try mac-telnet from other connected routerboard
i have installed RouterOs on a VirtualBox and i have tried to use tools >> Telnet >> mac telnet

when i have inserted my Mikrotik router Mac address it asked me for a Login and password but when inserted the correct credentials it was not connecting and just showed Disconnected.

I have attached an image for you to see.
routerostelnet.jpg

Re: Locked Out of Mikrotik

Posted: Thu Aug 30, 2018 4:18 pm
by mkx
I'd say that mac-telnet client (=sw run on your Windows machine) asks about credentials even before it tries to connect to the other end.

There are settings for MAC servers (telnet and winbox), which by default limit access to connections coming in through interfaces members of LAN interface list. If you forget to update that list, then you might well get locked out of using MAC connectivity even though that was not intentionally. This lock-out is specially easy to achieve when VLANs are in use.

Re: Locked Out of Mikrotik

Posted: Thu Aug 30, 2018 5:15 pm
by freemannnn
try mac-telnet from other connected routerboard

if you can wait 1-2 hours i can go office and close all services in my main router and try to connect to it with mac-telnet from another hap lite that i have spare.
what do u think? should i try?
Yes please <3
sorry same result as "gnarl". shows disconnected.

Re: Locked Out of Mikrotik

Posted: Fri Aug 31, 2018 7:41 am
by draid
Hey amte I managed to achieve the same thing but in a different way. Still I couldn't connect to the router via web or winbox including winbox mac so a the end I just made a reset of the device. I guess it'll be a bit paintful if you have a lot of settings but it's always an option.

Re: Locked Out of Mikrotik

Posted: Fri Aug 31, 2018 9:27 am
by gnarl
Hey amte I managed to achieve the same thing but in a different way. Still I couldn't connect to the router via web or winbox including winbox mac so a the end I just made a reset of the device. I guess it'll be a bit paintful if you have a lot of settings but it's always an option.
Making a reset is my last last resort because i have so many firewall rules and some vpn connections. Unfortunately because i am beginner in Mikrotik i have made all these settings by trial and error and i cant reproduce them again after the reset. I am that stupid i didn't even made a backup.

This router i have installed it in my company so it will be allot of problem to just make a reset.

The router is working perfect i was just experimenting with the winbox service port because i have read about the vulnerability. Now i am locked out of the router and i cant even go inside to make an update to patch the vulnerability problem.

Please is anyone out there that can suggest something ?
This router doesn't have Serial port only one USB port.
Is it possible to do something using the USB Port to gain console access ?

I am so sad and frustrated please someone help me :(

Re: Locked Out of Mikrotik

Posted: Fri Aug 31, 2018 10:20 am
by ADahi
not sure if this can help
https://mikrotik.com/product/woobm
Image

Re: Locked Out of Mikrotik

Posted: Fri Aug 31, 2018 11:32 am
by cliffordjames
If the router you're using is essential for the companies business they should have a backup router pre-configured and ready to go in case of failure.
If they don't have one get them to get one.
Configure that one and when it's ready plan some downtime.
Swap.

Re: Locked Out of Mikrotik

Posted: Fri Aug 31, 2018 11:41 am
by gnarl
If the router you're using is essential for the companies business they should have a backup router pre-configured and ready to go in case of failure.
If they don't have one get them to get one.
Configure that one and when it's ready plan some downtime.
Swap.
Hello, as i previously stated unfortunately i cant recreate fully the settings i have done due to the settings have been achieved through trial and error.

Re: Locked Out of Mikrotik

Posted: Fri Aug 31, 2018 11:43 am
by gnarl
not sure if this can help
https://mikrotik.com/product/woobm
Image
Hello, this looks very interesting can some one confirm that it will work with MikroTik RB951Ui-2HnD which i have mistakenly closed all service ports including winbox port ?

Re: Locked Out of Mikrotik

Posted: Fri Aug 31, 2018 3:56 pm
by Sob
I don't have Woobm, but it should appear as serial port to router. So it would solve your problem with closed port, because it doesn't care about network at all.

But when I tested regular USB to serial cable, it was recognized as serial port by router, but console didn't automatically attach to it. I don't know if Woobm is perhaps treated differently.

Re: Locked Out of Mikrotik

Posted: Fri Aug 31, 2018 5:47 pm
by CsXen
Hi.
For a last chance, try to boot into an OpenWRT image over tftp, and try to find and recover your scripts/firewall settings/etc. phisically from the filesystem.

Best regards: CsXen

Re: Locked Out of Mikrotik

Posted: Fri Aug 31, 2018 5:59 pm
by ADahi
Hey amte I managed to achieve the same thing but in a different way. Still I couldn't connect to the router via web or winbox including winbox mac so a the end I just made a reset of the device. I guess it'll be a bit paintful if you have a lot of settings but it's always an option.
Making a reset is my last last resort because i have so many firewall rules and some vpn connections. Unfortunately because i am beginner in Mikrotik i have made all these settings by trial and error and i cant reproduce them again after the reset. I am that stupid i didn't even made a backup.

This router i have installed it in my company so it will be allot of problem to just make a reset.

The router is working perfect i was just experimenting with the winbox service port because i have read about the vulnerability. Now i am locked out of the router and i cant even go inside to make an update to patch the vulnerability problem.

Please is anyone out there that can suggest something ?
This router doesn't have Serial port only one USB port.
Is it possible to do something using the USB Port to gain console access ?

I am so sad and frustrated please someone help me :(
yes try USB to Serial
this print from plugged usb-to-rs232 (USB-SERIAL CH340)
/port print detail 
Flags: I - inactive 
 0   name="usb1" used-by="" device="1:2" channels=1 baud-rate=9600 data-bits=8 parity=none stop-bits=1 flow-control=none

in crs3xx the baud-rate was 115200 not 9600
so use putty and try both until get success

Re: Locked Out of Mikrotik

Posted: Fri Aug 31, 2018 8:25 pm
by gnarl
Hello guys thank you all for the nice solutions. I have ordered Woobm-USB and it will arrive tuesday or wednesday and i will test it and tell you how it goes. If this doesn't work i will try the USB to serial suggestion and if nothing of these works i will try the OpenWRT suggestion.

@CsXen can you please give me a guide or something on how to boot into an OpenWRT image over tftp ?

P.S if anyone else has other suggestions please share them so i can try them and see if something works. I refuse to just reset my router and loose all the settings i have done.

Re: Locked Out of Mikrotik

Posted: Mon Sep 03, 2018 2:43 am
by BartoszP
Tested on 962 ...
I've inserted it directly to 962 and connected via terminal as described in the manual but when you restart/power-on router then Woobm is restarted as USB power is cycling.
Try to connect Woobm with USB dock station with external power supply to prevent resseting during router reset.

Re: Locked Out of Mikrotik

Posted: Tue Sep 04, 2018 10:33 pm
by CsXen
Hi.
@CsXen can you please give me a guide or something on how to boot into an OpenWRT image over tftp ?

Try to start here.
https://wiki.openwrt.org/toh/mikrotik/common

You will need some server with tftp and dhcp.
Best regards: CsXen

Re: Locked Out of Mikrotik

Posted: Wed Sep 05, 2018 1:43 pm
by gnarl
Hello again,

I have tried Woobm-USB plugged it in directly on USB port of router (RB951Ui-2HnD) i connected my laptop at Woobm-USB WIFI and opened the webpage and clicked on telnet TAB. Telnet TAB said successfully connected but terminal was blank and was not accepting any commands. I also tried this with Putty but no success also there was not connecting.

My router (RB951Ui-2HnD) firmware is 6.37

Can someone tell me what i must do in order to connect to console and reactivate winbox port 8291 ?

Re: Locked Out of Mikrotik

Posted: Wed Sep 05, 2018 4:00 pm
by Sob
You might be out of luck, it depends on how is RouterOS supposed to interact with newly added serial port. It didn't automatically enable console on my usb to serial cable. But I do remember that recently someone complained about how gps (which also looks like serial port) was claimed by console automatically. So I don't know what exactly is the right behaviour.

Re: Locked Out of Mikrotik

Posted: Sun Sep 09, 2018 7:46 am
by CsXen
Hi.
You can see RX and TX testpoints on the router's mainboard (lower right area, near EJTAG and the wireless antenne):
Image

Try to connect there over a proper level translator (probably 3.3V or 5V TTL levels there). If it works, you can reach the CLI.

Best regards: CsXen

Re: Locked Out of Mikrotik

Posted: Thu Sep 13, 2018 12:22 am
by gnarl
Hi.
You can see RX and TX testpoints on the router's mainboard (lower right area, near EJTAG and the wireless antenne):
Image

Try to connect there over a proper level translator (probably 3.3V or 5V TTL levels there). If it works, you can reach the CLI.

Best regards: CsXen
Hello,

I saw the TX & RX you are referring to but what should i solder there ? You mean serial cable ?