The Winbox/SSH ports are invisible from the internet; they only open for your IP after knocking on secret ports in order.

Each knock on a secret port puts the knocker's IP in the next stage's address list with a short timeout. Only an IP that knocks in the right order reaches the allow list, and only the allow list may open the protected ports. A scanner trying random ports never gets through.

• Do not apply it from outside (over the WAN) before trying the knock: stay logged in from the LAN first so you do not lock yourself out.
• Knocking from Windows (PowerShell): Test-NetConnection ROUTER-IP -Port 7311, then the next port, then open Winbox. From Linux/Mac: nc -z -w1 ROUTER-IP 7311; nc -z -w1 ROUTER-IP 8422.
• TCP knocks are easiest from a phone (a Port Knocker app). Keep the knock ports secret and avoid common ports.
• Access from the LAN is not affected, because the rules only apply to the WAN interface.

How to use: Copy the script, open Winbox → New Terminal, paste. Or Download .rsc, upload it in Files, then run /import file-name=port-knocking.rsc.

RouterOS v6 / v7 · added 11 November 2026