Michał SobczakArchitecture · IT infrastructure · DevOps · Security · AI/ML

MikroTik basic reconfiguration

By Updated 1 min read

In case you have access to MikroTik device without UI available, only CLI then you possibly would like to know how to do some basic reconfiguration to gain access to admin panel listening on local network. So… to change user password:

Bash
/user set admin password=mynewpassword

To see all the configuration:

Bash
export

To create PPTP VPN:

Bash
ip pool add name=PPTP-Pool ranges=192.168.99.10-192.168.99.200
ppp profile add change-tcp-mss=yes local-address=PPTP-Pool name=PPTP-Profile only-one=yes remote-address=PPTP-Pool use-encryption=yes dns-server=8.8.8.8,9.9.9.9
ppp secret add name=user1 password=YourPassword profile=PPTP-Profile
 interface pptp-server server set authentication=chap,mschap1,mschap2 default-profile=PPTP-Profile enabled=yes

To adjust firewall for PPTP VPN:

Bash
ip firewall filter add chain=input comment="PPTP VPN" dst-port=1723 protocol=tcp
ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade
interface pptp-server add name=pptp-user1 user=user1

To enable HTTP web configuration:

Bash
ip service print
ip service set www port=81
ip service www address=0.0.0.0/0

Now, once you connect thru PPTP VPN to the remote host, you can access UI. But if you set 0.0.0.0/0 as an address then you may also be able to connect to it using public address.

View as Markdown

All the content on this website is licensed under Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0). Cite as: Michał Sobczak, “MikroTik basic reconfiguration”, 14 November 2022, https://michalasobczak.pl/posts/mikrotik-basic-reconfiguration.html

Related articles

  1. Security1 min

    MikroTik RouterOS 7.5 change default DNS

    Want to change default DNS for the network in MikroTik’s RouterOS CLI? You can use web UI but it could have some issues preventing from configuration save, so it is nice to know how to use it via CLI.

  3. Security2 min

    DNS privacy issues

    Until recently I though that having DNS subdomain entries provides enough obscurity thus should it be secure. If your DNS server does not offer transfering domain to another place then any subdomains should be hidden from public sight.