Security deep dive
How attacks really work and how to defend against them: tested live in the lab, with RouterOS rules to copy.
Image generated locally with ComfyUI from randomly selected elements. How the images are created
Block DNS over HTTPS and DNS over TLS with MikroTik
Encrypted DNS bypasses the router's filter: how to close DoT and DoH on RouterOS 7 with port 853, an address list of names, the tls-host matcher and Firefox's canary domain, all tested in the lab.
DojoPort knocking on MikroTik: WinBox opens only to those who knock
The router's management port stays closed to everyone and opens for one hour only to whoever touches three ports in the right sequence. The RouterOS 7 firewall rules, three ways to knock from Linux (knock, nc and pure bash), and how much you can trust it.
DojoBasic hardening of a MikroTik router with RouterOS 7
A MikroTik just reset with no-defaults=yes has no firewall: perfect on the bench for learning, but never put it on a network like that. Before installing it you need seven hardening steps: update RouterOS, replace the admin user, turn off the services you don't use and limit the others to the authorized addresses, close the service ports on the external interfaces, a minimal firewall that blocks everything coming from the internet, and a VPN for remote management.
DojoUnauthorized DHCP server: how to detect and block it with MikroTik
An unauthorized DHCP server, often a shopping-mall Wi-Fi router plugged in "backwards", can throw a LAN into chaos in minutes. With MikroTik you spot it with /ip dhcp-server alert, which warns you when a server other than the valid one answers, and you block it with the bridge's DHCP snooping, which in RouterOS 7 accepts DHCP replies only from the trusted ports.
DojoHow to hide your network’s MikroTik routers from traceroute
A traceroute launched from a client shows your network's routers one by one, with their addresses. With a mangle rule that increments the TTL (action=change-ttl new-ttl=increment:1) every MikroTik router becomes invisible to traceroute, because the packet crosses it without "spending" a hop. The rule must be limited to client traffic and placed with care, so it doesn't complicate troubleshooting.
DojoMikroTik hotspot: how to protect the LAN from WiFi clients
On a MikroTik hotspot the guest clients must not be able to reach the customer's network (servers, printers, NAS). A single firewall rule using the hotspot=from-client matcher does the job; and if the network to protect isn't known in advance, because the WAN gets its address over DHCP, a DHCP client script keeps it up to date in an address list.