Turn off unused services, limit Winbox/SSH to the admin network, close router access from the WAN.

Most hacked MikroTik routers are open from the internet: Winbox, API or FTP can be reached by anyone. This script makes WAN/LAN interface lists, turns off rarely used services, limits management access and adds input firewall rules. Keep RouterOS updated to the latest stable version too.

• Turn on Safe Mode (Ctrl+X in the terminal) before pasting, so if you lose access every change is undone automatically.
• The firewall rules are added below the existing ones. An accept rule from the WAN above them still applies: check the order in IP > Firewall > Filter.
• If the router is a VPN server reachable from the internet (L2TP, SSTP, WireGuard, …), add an accept rule for the VPN port above the "tolak akses router dari WAN" rule.

How to use: Copy the script, open Winbox → New Terminal, paste. Or Download .rsc, upload it in Files, then run /import file-name=secure-router.rsc.

RouterOS v6.41+ / v7 · added 10 November 2026