# Services

> Which RouterOS management services are reachable, from where, and on which ports.

Source: https://joinnasnet.com/en/guides/nasnet-connect/extra-config/services/
Last updated: 2026-08-14

---

## Overview

The screen is titled **Services Configuration**, described as *"Configure RouterOS service
accessibility"*. It is a table of the eight management services RouterOS
exposes. For each one you set an access level and, if you want, a non-default
port.

This is the screen where you can lock yourself out. The wizard shows a one-time
warning before you change any port: *"Always remember or write down the new port
numbers!"*, because *"Losing port numbers may lock you out of certain
services."* Read it and act on it; it does not appear again.

In Easy Mode this screen is never shown, and the wizard applies a safe default:
Winbox enabled, everything else restricted to local access on its standard port.

## Before you start

- Decide how you will reach the router after the script is applied. At least one
  service must remain reachable from wherever you will be.
- Write down every non-default port before you leave the screen.
- Changing the web port means you must include it in the URL afterwards, so the
  screen notes this.

## Steps

1. For each service, choose its access level.
2. Change the port only if you have a reason to. A confirmation dialog called
   **Confirm Port Change** appears, showing the old and new value.
3. Acknowledge the one-time warning with **I Understand**.

## Reference

| Service | What it is | Default port |
| ------- | ---------- | ------------ |
| **api** | RouterOS API access | 8728 |
| **apissl** | RouterOS API with SSL | 8729 |
| **ftp** | File Transfer Protocol | 21 |
| **ssh** | Secure Shell | 22 |
| **telnet** | Telnet Protocol | 23 |
| **winbox** | WinBox Management Tool (recommended) | 8291 |
| **web** | Web Interface Access | 80 |
| **webssl** | Secure Web Interface | 443 |

Access levels:

| Level | Meaning |
| ----- | ------- |
| **Enable** | The service is available |
| **Local** | The service is restricted to local access |
| **Disable** | The service is switched off |

## Troubleshooting

**Changing the SSH port.** The screen warns: *"Changing the SSH port from the
default (22) may affect your ability to connect to the router. Make sure you
remember the new port number."*

**SSH marked "Required by VPN Server".** Some VPN server protocols depend on
SSH, so the wizard will not let you disable it while they are enabled.

## Related

- [Identity](/en/guides/nasnet-connect/extra-config/identity/)
- [VPN Server](/en/guides/nasnet-connect/lan/vpn-server/)