Services
Which RouterOS management services are reachable, from where, and on which ports.
Overview
The screen is titled Services Configuration, described as “Configure RouterOS service accessibility”. It is a table of the eight management services RouterOS exposes. For each one you set an access level and, if you want, a non-default port.
This is the screen where you can lock yourself out. The wizard shows a one-time warning before you change any port: “Always remember or write down the new port numbers!”, because “Losing port numbers may lock you out of certain services.” Read it and act on it; it does not appear again.
In Easy Mode this screen is never shown, and the wizard applies a safe default: Winbox enabled, everything else restricted to local access on its standard port.
Before you start
- Decide how you will reach the router after the script is applied. At least one service must remain reachable from wherever you will be.
- Write down every non-default port before you leave the screen.
- Changing the web port means you must include it in the URL afterwards, so the screen notes this.
Steps
- For each service, choose its access level.
- Change the port only if you have a reason to. A confirmation dialog called Confirm Port Change appears, showing the old and new value.
- Acknowledge the one-time warning with I Understand.
Reference
| Service | What it is | Default port |
|---|---|---|
| api | RouterOS API access | 8728 |
| apissl | RouterOS API with SSL | 8729 |
| ftp | File Transfer Protocol | 21 |
| ssh | Secure Shell | 22 |
| telnet | Telnet Protocol | 23 |
| winbox | WinBox Management Tool (recommended) | 8291 |
| web | Web Interface Access | 80 |
| webssl | Secure Web Interface | 443 |
Access levels:
| Level | Meaning |
|---|---|
| Enable | The service is available |
| Local | The service is restricted to local access |
| Disable | The service is switched off |
Troubleshooting
Changing the SSH port. The screen warns: “Changing the SSH port from the default (22) may affect your ability to connect to the router. Make sure you remember the new port number.”
SSH marked “Required by VPN Server”. Some VPN server protocols depend on SSH, so the wizard will not let you disable it while they are enabled.