Summary

This page lists protocols and ports used by various MikroTik RouterOS services. It helps you to determine why your MikroTik router listens to certain ports, and what you need to block/allow in case you want to prevent or grant access to certain services. Please see the relevant sections of the Manual for more explanations.

The default services are:

Properties

Note that it is not possible to add new services, only existing service modifications are allowed.

Sub-menu: /ip service

Example

For example, allow API only from a specific IP/IPv6 address range

[admin@dzeltenais_burkaans] /ip service> set api address=10.5.101.0/24,2001:db8:fade::/64
[admin@dzeltenais_burkaans] /ip service> print 
Flags: X - disabled, I - invalid 
 #   NAME     PORT  ADDRESS                                       CERTIFICATE  
 0   telnet   23   
 1   ftp      21   
 2   www      80   
 3   ssh      22   
 4 X www-ssl  443                                                 none         
 5   api      8728  10.5.101.0/24                                
                    2001:db8:fade::/64                           
 6   winbox   8291 

Service Ports

Hosts behind a NAT-enabled router do not have true end-to-end connectivity. Therefore some Internet protocols might not work in scenarios with NAT.

To overcome these limitations RouterOS includes a number of NAT helpers, that enable NAT traversal for various protocols.

Sub-menu: /ip firewall service-port

Protocols and ports

The table below shows the list of protocols and ports used by RouterOS.