CIS MikroTik RouterOS Benchmark

This recommendation verifies that default admin account is disabled on the MikroTik RouterOS network router operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the MikroTik RouterOS network router operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check admin users:
/user print detail

# Check user groups:
/user group print

# Create named admin accounts and disable default admin:
/user add name=netadmin group=full password=StrongPass123!
/user set admin disabled=yes

# Create read-only group:
/user group add name=monitoring policy=read,api,winbox,web

This setting ensures that management services are restricted by address on the MikroTik RouterOS network router operating system. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the MikroTik RouterOS network router operating system is essential for defense in depth.

# Check SSH and API access:
/ip service print

# Check allowed addresses:
/ip service print detail where name=ssh or name=api or name=winbox

# Restrict management services to management VLAN:
/ip service set ssh address=10.0.0.0/24 port=2222
/ip service set api address=10.0.0.0/24 disabled=no
/ip service set api-ssl address=10.0.0.0/24 disabled=no

# Disable unused services:
/ip service set telnet disabled=yes
/ip service set ftp disabled=yes
/ip service set www disabled=yes

This recommendation verifies that input chain has default drop policy on the MikroTik RouterOS network router operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MikroTik RouterOS network router operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check firewall filter rules:
/ip firewall filter print

# Check for default drop rule:
/ip firewall filter print where action=drop and chain=input

# Configure input chain firewall:
/ip firewall filter
add chain=input connection-state=established,related action=accept
add chain=input connection-state=invalid action=drop
add chain=input src-address=10.0.0.0/24 action=accept comment="mgmt"
add chain=input protocol=icmp action=accept
add chain=input action=drop comment="default drop input"

This recommendation verifies that forward chain is properly configured on the MikroTik RouterOS network router operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MikroTik RouterOS network router operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check forward chain rules:
/ip firewall filter print where chain=forward

# Check NAT rules:
/ip firewall nat print

# Configure forward chain:
/ip firewall filter
add chain=forward connection-state=established,related action=accept
add chain=forward connection-state=invalid action=drop
add chain=forward src-address=192.168.0.0/16 out-interface=ether1 action=accept comment="LAN to WAN"
add chain=forward action=drop comment="default drop forward"

# Masquerade NAT:
/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade

This recommendation verifies that DDoS and port scan protection is enabled on the MikroTik RouterOS network router operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MikroTik RouterOS network router operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check raw firewall rules (DDoS protection):
/ip firewall raw print

# Check connection tracking:
/ip firewall connection tracking print

# Add basic DDoS protection:
/ip firewall raw
add chain=prerouting protocol=tcp tcp-flags=syn limit=200,5:packet action=accept
add chain=prerouting protocol=tcp tcp-flags=syn action=drop comment="SYN flood protection"

# Port scan detection:
/ip firewall filter
add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list=port-scanners address-list-timeout=2w
add chain=input src-address-list=port-scanners action=drop

This recommendation verifies that DNS resolver is secured on the MikroTik RouterOS network router operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MikroTik RouterOS network router operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check DNS settings:
/ip dns print

# Check if router allows remote DNS requests:
/ip dns print where allow-remote-requests=yes

# Configure secure DNS:
/ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=no

# If DNS caching is needed, restrict to LAN:
/ip dns set allow-remote-requests=yes
/ip firewall filter add chain=input dst-port=53 protocol=udp src-address=!192.168.0.0/16 action=drop
/ip firewall filter add chain=input dst-port=53 protocol=tcp src-address=!192.168.0.0/16 action=drop

This recommendation verifies that NTP is configured on the MikroTik RouterOS network router operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MikroTik RouterOS network router operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check NTP client:
/system ntp client print

# Check NTP server:
/system ntp server print

# Configure NTP client:
/system ntp client set enabled=yes
/system ntp client servers add address=pool.ntp.org

# Disable NTP server if not needed:
/system ntp server set enabled=no

This recommendation verifies that SNMP uses v3 with authentication on the MikroTik RouterOS network router operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MikroTik RouterOS network router operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SNMP configuration:
/snmp print
/snmp community print

# Configure SNMPv3 and disable v2c public community:
/snmp set enabled=yes trap-version=3
/snmp community remove [find name=public]
/snmp community add name=monitoring security=authorized \
  read-access=yes write-access=no addresses=10.0.0.0/24 \
  authentication-protocol=SHA1 authentication-password=SecureAuth123 \
  encryption-protocol=AES encryption-password=SecurePriv123

This setting ensures that MAC server access is restricted on the MikroTik RouterOS network router operating system. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the MikroTik RouterOS network router operating system is essential for defense in depth.

# Check MAC server access:
/tool mac-server print
/tool mac-server mac-winbox print
/tool mac-server ping print

# Restrict MAC server access:
/tool mac-server set allowed-interface-list=none
/tool mac-server mac-winbox set allowed-interface-list=none
/tool mac-server ping set enabled=no

# Or restrict to management interface:
/interface list add name=mgmt
/interface list member add interface=ether1 list=mgmt
/tool mac-server set allowed-interface-list=mgmt

This setting ensures that neighbor discovery is restricted on the MikroTik RouterOS network router operating system. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the MikroTik RouterOS network router operating system is essential for defense in depth.

# Check neighbor discovery:
/ip neighbor discovery-settings print
/ip neighbor print

# Restrict neighbor discovery to internal interfaces:
/ip neighbor discovery-settings set discover-interface-list=none

# Or restrict to management interface list:
/ip neighbor discovery-settings set discover-interface-list=mgmt

This recommendation verifies that remote syslog logging is configured on the MikroTik RouterOS network router operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MikroTik RouterOS network router operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check logging configuration:
/system logging print
/system logging action print

# Configure remote syslog logging:
/system logging action add name=remote-syslog target=remote \
  remote=10.0.0.100 remote-port=514 src-address=10.0.0.1

/system logging add topics=critical action=remote-syslog
/system logging add topics=error action=remote-syslog
/system logging add topics=warning action=remote-syslog
/system logging add topics=info action=remote-syslog
/system logging add topics=firewall action=remote-syslog

This recommendation verifies that traffic accounting is enabled on the MikroTik RouterOS network router operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MikroTik RouterOS network router operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check accounting/traffic flow:
/ip accounting print
/ip traffic-flow print

# Enable traffic accounting:
/ip accounting set enabled=yes threshold=4096
/ip accounting web-access set accessible-via-web=no

# Configure NetFlow/IPFIX:
/ip traffic-flow set enabled=yes
/ip traffic-flow target add dst-address=10.0.0.100 port=2055 version=9

This recommendation verifies that SSH uses strong crypto settings on the MikroTik RouterOS network router operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MikroTik RouterOS network router operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SSH settings:
/ip ssh print

# Check host key:
/ip ssh print detail

# Harden SSH:
/ip ssh set strong-crypto=yes always-allow-password-login=no \
  forwarding-enabled=no host-key-size=4096

# Regenerate host key:
/ip ssh regenerate-host-key

This recommendation verifies that TLS certificates are configured for services on the MikroTik RouterOS network router operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MikroTik RouterOS network router operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SSL/TLS certificate:
/certificate print

# Check www-ssl service:
/ip service print where name=www-ssl

# Import and configure TLS certificate:
/certificate import file-name=router.crt passphrase=""
/certificate import file-name=router.key passphrase=""

/ip service set www-ssl certificate=router.crt_0 disabled=no
/ip service set api-ssl certificate=router.crt_0 disabled=no

# Disable non-SSL web/api:
/ip service set www disabled=yes
/ip service set api disabled=yes

This recommendation verifies that RouterOS is updated to latest stable version on the MikroTik RouterOS network router operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MikroTik RouterOS network router operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check RouterOS version:
/system resource print
/system package update check-for-updates

# Update RouterOS:
/system package update set channel=long-term
/system package update check-for-updates
/system package update download
/system reboot

# Schedule automatic update check:
/system scheduler add name=check-updates interval=1d \
  on-event="/system package update check-for-updates"

This recommendation verifies that encrypted backups are configured on the MikroTik RouterOS network router operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MikroTik RouterOS network router operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check backup configuration:
/system backup print
/export file=current-config

# Create encrypted backup:
/system backup save name=backup encryption=aes-sha256 \
  password=BackupPassword123!

# Schedule automated backups:
/system scheduler add name=daily-backup interval=1d \
  on-event="/system backup save name=auto-backup encryption=aes-sha256 password=BackupPw"

# Export configuration:
/export file=router-config compact