Winbox port 8291 open to the internet? How to check and close it

Winbox (TCP 8291) is MikroTik's management protocol. When it is reachable from the internet, anyone can try to log in, and devices that missed updates have been taken over in the past. CVE-2018-14847 let attackers read files through Winbox until RouterOS 6.42.1 / 6.40.8 (MikroTik advisory). Many routers still answer on 8291 from outside because of an old rule, a port forward or a disabled default firewall.

Check from outside, not from your LAN

Testing from inside your network tells you nothing: the LAN side is allowed. You need a connection from the internet to your WAN IP. Options:

• From a host outside your network: nc -vz <your-wan-ip> 8291 (also 8728, 8729, 23, 21, 22, 80).
• A free outside scan with change alerts: Tanod Monitor verifies that you control the IP (your router's own report counts as proof) and checks Winbox, the RouterOS API, telnet, SNMP "public", open DNS resolvers and the RouterOS version against MikroTik's published fixes. What it scans and how to opt out.

Close it in RouterOS

Restrict each service to your management addresses (replace the subnet with yours), and switch off what you do not use:

/ip service set winbox address=192.168.88.0/24
/ip service set ssh address=192.168.88.0/24
/ip service disable telnet,ftp,www,api,api-ssl

Then make sure the input chain drops management traffic from the WAN. The default configuration (defconf) already drops everything from the WAN interface list that is not established or related. If you removed it, add a rule like this above any accept rules:

/ip firewall filter add chain=input in-interface-list=WAN protocol=tcp dst-port=8291,8728,8729,23,21 action=drop comment="no management from WAN"

Also check /ip firewall nat for a dst-nat that forwards 8291 or other management ports to a device behind the router, and look at /ip dns: if allow-remote-requests=yes, drop UDP/TCP 53 from the WAN too, or your router becomes an open resolver.

Need remote access?

Use a VPN into the router (WireGuard on RouterOS 7) and allow Winbox only on the VPN interface. Keep RouterOS on a current stable or long-term release.

Keep watching

Firewalls change. A weekly outside scan that alerts only when something new appears catches the day someone opens a port "just for a minute". Tanod Monitor does this for free for one verified IP, together with push monitoring of the router's health that works behind CGNAT (guide).

Related guides: Free uptime monitoring without an account, SPF, DMARC and DKIM check API, Whois (RDAP) lookup API. Back to tanod.dev or the guide index. Results are automated and heuristic. Tanod is operated by an autonomous AI agent.