Community discussions

MikroTik App
 
gnarl
just joined
Topic Author
Posts: 13
Joined: Thu Aug 30, 2018 12:04 pm

Locked Out of Mikrotik

Thu Aug 30, 2018 12:11 pm

Hi everyone!
I'm stupid and i have disabled all the services ports, including winbox (8291) and ssh.

The MikroTik is working well, but I can't connect to it. What can I do to restore access? I also have a physical access to device.

The model is MikroTik RB951Ui-2HnD there is no physical Serial port to connect through it and restore access. Resetting the device is my last last resort because i don't have a backup config and i have allot of stuff configured inside that i cant configure them again!

Is there any solution for this case?

Neighbors shows my router mac address but when i try to connect i get an ERROR: Could not connect message.
 
User avatar
BartoszP
Forum Guru
Forum Guru
Posts: 1819
Joined: Mon Jun 16, 2014 1:13 pm
Location: Poland

Re: Locked Out of Mikrotik

Thu Aug 30, 2018 12:23 pm

Winbox via MAC address.
Open Winbox ... click "Neighberhood" ... wait for your router ... click MAC address in the MAC column ... fill user + password ... connect
Real admins use real keyboards.
 
gnarl
just joined
Topic Author
Posts: 13
Joined: Thu Aug 30, 2018 12:04 pm

Re: Locked Out of Mikrotik

Thu Aug 30, 2018 12:26 pm

Winbox via MAC address.
Open Winbox ... click "Neighberhood" ... wait for your router ... click MAC address in the MAC column ... fill user + password ... connect
As i already have written in my post i have already tried to connect via Winbox >> Neighbors with no success when i try to connect i get an ERROR: Could not connect.
 
User avatar
BartoszP
Forum Guru
Forum Guru
Posts: 1819
Joined: Mon Jun 16, 2014 1:13 pm
Location: Poland

Re: Locked Out of Mikrotik

Thu Aug 30, 2018 12:36 pm

Do you have MAC address in the field "Connect to:" specified?
You do not have the required permissions to view the files attached to this post.
Real admins use real keyboards.
 
gnarl
just joined
Topic Author
Posts: 13
Joined: Thu Aug 30, 2018 12:04 pm

Re: Locked Out of Mikrotik

Thu Aug 30, 2018 12:46 pm

Do you have MAC address in the field "Connect to:" specified?
Yes i have look at the attached picture
winboxproblem.jpg
You do not have the required permissions to view the files attached to this post.
 
User avatar
ADahi
Member Candidate
Member Candidate
Posts: 217
Joined: Thu Sep 21, 2017 7:16 pm
Location: Iraq, Ninavah
Contact:

Re: Locked Out of Mikrotik

Thu Aug 30, 2018 2:49 pm

try mac-telnet from other connected routerboard
 
gnarl
just joined
Topic Author
Posts: 13
Joined: Thu Aug 30, 2018 12:04 pm

Re: Locked Out of Mikrotik

Thu Aug 30, 2018 3:18 pm

try mac-telnet from other connected routerboard
Unfortunately i don't have other Mikrotik router
 
proximus
Member Candidate
Member Candidate
Posts: 114
Joined: Tue Oct 04, 2011 1:46 pm

Re: Locked Out of Mikrotik

Thu Aug 30, 2018 3:26 pm

Are you using WinBox on a Windows VM?

Asking because I have not been able to make MAC connections work from a Windows VM on Fusion. Have to use WinBox directly on the Mac OS X host system.
 
freemannnn
Long time Member
Long time Member
Posts: 683
Joined: Sun Oct 13, 2013 7:29 pm

Re: Locked Out of Mikrotik

Thu Aug 30, 2018 3:45 pm

try mac-telnet from other connected routerboard

if you can wait 1-2 hours i can go office and close all services in my main router and try to connect to it with mac-telnet from another hap lite that i have spare.
what do u think? should i try?
Last edited by freemannnn on Thu Aug 30, 2018 5:16 pm, edited 1 time in total.
 
gnarl
just joined
Topic Author
Posts: 13
Joined: Thu Aug 30, 2018 12:04 pm

Re: Locked Out of Mikrotik

Thu Aug 30, 2018 4:06 pm

try mac-telnet from other connected routerboard

if you can wait 1-2 hours i can go home and close all services in my main router and try to connect to it with mac-telnet from another hap lite that i have spare.
what do u think? should i try?
Yes please <3
 
gnarl
just joined
Topic Author
Posts: 13
Joined: Thu Aug 30, 2018 12:04 pm

Re: Locked Out of Mikrotik

Thu Aug 30, 2018 4:07 pm

Are you using WinBox on a Windows VM?

Asking because I have not been able to make MAC connections work from a Windows VM on Fusion. Have to use WinBox directly on the Mac OS X host system.
The computer i am using winbox is a physical windows 7 computer connected on the same network as my router
 
gnarl
just joined
Topic Author
Posts: 13
Joined: Thu Aug 30, 2018 12:04 pm

Re: Locked Out of Mikrotik

Thu Aug 30, 2018 4:11 pm

try mac-telnet from other connected routerboard
i have installed RouterOs on a VirtualBox and i have tried to use tools >> Telnet >> mac telnet

when i have inserted my Mikrotik router Mac address it asked me for a Login and password but when inserted the correct credentials it was not connecting and just showed Disconnected.

I have attached an image for you to see.
routerostelnet.jpg
You do not have the required permissions to view the files attached to this post.
 
mkx
Forum Guru
Forum Guru
Posts: 4472
Joined: Thu Mar 03, 2016 10:23 pm

Re: Locked Out of Mikrotik

Thu Aug 30, 2018 4:18 pm

I'd say that mac-telnet client (=sw run on your Windows machine) asks about credentials even before it tries to connect to the other end.

There are settings for MAC servers (telnet and winbox), which by default limit access to connections coming in through interfaces members of LAN interface list. If you forget to update that list, then you might well get locked out of using MAC connectivity even though that was not intentionally. This lock-out is specially easy to achieve when VLANs are in use.
BR,
Metod
 
freemannnn
Long time Member
Long time Member
Posts: 683
Joined: Sun Oct 13, 2013 7:29 pm

Re: Locked Out of Mikrotik

Thu Aug 30, 2018 5:15 pm

try mac-telnet from other connected routerboard

if you can wait 1-2 hours i can go office and close all services in my main router and try to connect to it with mac-telnet from another hap lite that i have spare.
what do u think? should i try?
Yes please <3
sorry same result as "gnarl". shows disconnected.
 
draid
Frequent Visitor
Frequent Visitor
Posts: 61
Joined: Wed Aug 22, 2018 5:42 pm

Re: Locked Out of Mikrotik

Fri Aug 31, 2018 7:41 am

Hey amte I managed to achieve the same thing but in a different way. Still I couldn't connect to the router via web or winbox including winbox mac so a the end I just made a reset of the device. I guess it'll be a bit paintful if you have a lot of settings but it's always an option.
 
gnarl
just joined
Topic Author
Posts: 13
Joined: Thu Aug 30, 2018 12:04 pm

Re: Locked Out of Mikrotik

Fri Aug 31, 2018 9:27 am

Hey amte I managed to achieve the same thing but in a different way. Still I couldn't connect to the router via web or winbox including winbox mac so a the end I just made a reset of the device. I guess it'll be a bit paintful if you have a lot of settings but it's always an option.
Making a reset is my last last resort because i have so many firewall rules and some vpn connections. Unfortunately because i am beginner in Mikrotik i have made all these settings by trial and error and i cant reproduce them again after the reset. I am that stupid i didn't even made a backup.

This router i have installed it in my company so it will be allot of problem to just make a reset.

The router is working perfect i was just experimenting with the winbox service port because i have read about the vulnerability. Now i am locked out of the router and i cant even go inside to make an update to patch the vulnerability problem.

Please is anyone out there that can suggest something ?
This router doesn't have Serial port only one USB port.
Is it possible to do something using the USB Port to gain console access ?

I am so sad and frustrated please someone help me :(
 
User avatar
ADahi
Member Candidate
Member Candidate
Posts: 217
Joined: Thu Sep 21, 2017 7:16 pm
Location: Iraq, Ninavah
Contact:

Re: Locked Out of Mikrotik

Fri Aug 31, 2018 10:20 am

not sure if this can help
https://mikrotik.com/product/woobm
Image
 
User avatar
cliffordjames
just joined
Posts: 11
Joined: Mon Jun 25, 2018 4:23 pm
Contact:

Re: Locked Out of Mikrotik

Fri Aug 31, 2018 11:32 am

If the router you're using is essential for the companies business they should have a backup router pre-configured and ready to go in case of failure.
If they don't have one get them to get one.
Configure that one and when it's ready plan some downtime.
Swap.
 
gnarl
just joined
Topic Author
Posts: 13
Joined: Thu Aug 30, 2018 12:04 pm

Re: Locked Out of Mikrotik

Fri Aug 31, 2018 11:41 am

If the router you're using is essential for the companies business they should have a backup router pre-configured and ready to go in case of failure.
If they don't have one get them to get one.
Configure that one and when it's ready plan some downtime.
Swap.
Hello, as i previously stated unfortunately i cant recreate fully the settings i have done due to the settings have been achieved through trial and error.
 
gnarl
just joined
Topic Author
Posts: 13
Joined: Thu Aug 30, 2018 12:04 pm

Re: Locked Out of Mikrotik

Fri Aug 31, 2018 11:43 am

not sure if this can help
https://mikrotik.com/product/woobm
Image
Hello, this looks very interesting can some one confirm that it will work with MikroTik RB951Ui-2HnD which i have mistakenly closed all service ports including winbox port ?
 
Sob
Forum Guru
Forum Guru
Posts: 5705
Joined: Mon Apr 20, 2009 9:11 pm

Re: Locked Out of Mikrotik

Fri Aug 31, 2018 3:56 pm

I don't have Woobm, but it should appear as serial port to router. So it would solve your problem with closed port, because it doesn't care about network at all.

But when I tested regular USB to serial cable, it was recognized as serial port by router, but console didn't automatically attach to it. I don't know if Woobm is perhaps treated differently.
People who quote full posts should be spanked with ethernet cable. Some exceptions for multi-topic threads may apply. Not intended as incentive for masochists.
 
CsXen
Frequent Visitor
Frequent Visitor
Posts: 93
Joined: Wed Sep 10, 2014 8:31 pm
Location: Budapest - Hungary

Re: Locked Out of Mikrotik

Fri Aug 31, 2018 5:47 pm

Hi.
For a last chance, try to boot into an OpenWRT image over tftp, and try to find and recover your scripts/firewall settings/etc. phisically from the filesystem.

Best regards: CsXen
 
User avatar
ADahi
Member Candidate
Member Candidate
Posts: 217
Joined: Thu Sep 21, 2017 7:16 pm
Location: Iraq, Ninavah
Contact:

Re: Locked Out of Mikrotik

Fri Aug 31, 2018 5:59 pm

Hey amte I managed to achieve the same thing but in a different way. Still I couldn't connect to the router via web or winbox including winbox mac so a the end I just made a reset of the device. I guess it'll be a bit paintful if you have a lot of settings but it's always an option.
Making a reset is my last last resort because i have so many firewall rules and some vpn connections. Unfortunately because i am beginner in Mikrotik i have made all these settings by trial and error and i cant reproduce them again after the reset. I am that stupid i didn't even made a backup.

This router i have installed it in my company so it will be allot of problem to just make a reset.

The router is working perfect i was just experimenting with the winbox service port because i have read about the vulnerability. Now i am locked out of the router and i cant even go inside to make an update to patch the vulnerability problem.

Please is anyone out there that can suggest something ?
This router doesn't have Serial port only one USB port.
Is it possible to do something using the USB Port to gain console access ?

I am so sad and frustrated please someone help me :(
yes try USB to Serial
this print from plugged usb-to-rs232 (USB-SERIAL CH340)
/port print detail 
Flags: I - inactive 
 0   name="usb1" used-by="" device="1:2" channels=1 baud-rate=9600 data-bits=8 parity=none stop-bits=1 flow-control=none

in crs3xx the baud-rate was 115200 not 9600
so use putty and try both until get success
 
gnarl
just joined
Topic Author
Posts: 13
Joined: Thu Aug 30, 2018 12:04 pm

Re: Locked Out of Mikrotik

Fri Aug 31, 2018 8:25 pm

Hello guys thank you all for the nice solutions. I have ordered Woobm-USB and it will arrive tuesday or wednesday and i will test it and tell you how it goes. If this doesn't work i will try the USB to serial suggestion and if nothing of these works i will try the OpenWRT suggestion.

@CsXen can you please give me a guide or something on how to boot into an OpenWRT image over tftp ?

P.S if anyone else has other suggestions please share them so i can try them and see if something works. I refuse to just reset my router and loose all the settings i have done.
 
User avatar
BartoszP
Forum Guru
Forum Guru
Posts: 1819
Joined: Mon Jun 16, 2014 1:13 pm
Location: Poland

Re: Locked Out of Mikrotik

Mon Sep 03, 2018 2:43 am

Tested on 962 ...
I've inserted it directly to 962 and connected via terminal as described in the manual but when you restart/power-on router then Woobm is restarted as USB power is cycling.
Try to connect Woobm with USB dock station with external power supply to prevent resseting during router reset.
Real admins use real keyboards.
 
CsXen
Frequent Visitor
Frequent Visitor
Posts: 93
Joined: Wed Sep 10, 2014 8:31 pm
Location: Budapest - Hungary

Re: Locked Out of Mikrotik

Tue Sep 04, 2018 10:33 pm

Hi.
@CsXen can you please give me a guide or something on how to boot into an OpenWRT image over tftp ?

Try to start here.
https://wiki.openwrt.org/toh/mikrotik/common

You will need some server with tftp and dhcp.
Best regards: CsXen
 
gnarl
just joined
Topic Author
Posts: 13
Joined: Thu Aug 30, 2018 12:04 pm

Re: Locked Out of Mikrotik

Wed Sep 05, 2018 1:43 pm

Hello again,

I have tried Woobm-USB plugged it in directly on USB port of router (RB951Ui-2HnD) i connected my laptop at Woobm-USB WIFI and opened the webpage and clicked on telnet TAB. Telnet TAB said successfully connected but terminal was blank and was not accepting any commands. I also tried this with Putty but no success also there was not connecting.

My router (RB951Ui-2HnD) firmware is 6.37

Can someone tell me what i must do in order to connect to console and reactivate winbox port 8291 ?
 
Sob
Forum Guru
Forum Guru
Posts: 5705
Joined: Mon Apr 20, 2009 9:11 pm

Re: Locked Out of Mikrotik

Wed Sep 05, 2018 4:00 pm

You might be out of luck, it depends on how is RouterOS supposed to interact with newly added serial port. It didn't automatically enable console on my usb to serial cable. But I do remember that recently someone complained about how gps (which also looks like serial port) was claimed by console automatically. So I don't know what exactly is the right behaviour.
People who quote full posts should be spanked with ethernet cable. Some exceptions for multi-topic threads may apply. Not intended as incentive for masochists.
 
CsXen
Frequent Visitor
Frequent Visitor
Posts: 93
Joined: Wed Sep 10, 2014 8:31 pm
Location: Budapest - Hungary

Re: Locked Out of Mikrotik

Sun Sep 09, 2018 7:46 am

Hi.
You can see RX and TX testpoints on the router's mainboard (lower right area, near EJTAG and the wireless antenne):
Image

Try to connect there over a proper level translator (probably 3.3V or 5V TTL levels there). If it works, you can reach the CLI.

Best regards: CsXen
 
gnarl
just joined
Topic Author
Posts: 13
Joined: Thu Aug 30, 2018 12:04 pm

Re: Locked Out of Mikrotik

Thu Sep 13, 2018 12:22 am

Hi.
You can see RX and TX testpoints on the router's mainboard (lower right area, near EJTAG and the wireless antenne):
Image

Try to connect there over a proper level translator (probably 3.3V or 5V TTL levels there). If it works, you can reach the CLI.

Best regards: CsXen
Hello,

I saw the TX & RX you are referring to but what should i solder there ? You mean serial cable ?

Who is online

Users browsing this forum: No registered users and 53 guests