Quick IT Help: We protect home MikroTik routers from access attempts by former coworkers or insider threats. Remote audit and patching (AnyDesk/SSH) in 30–40 minutes.

30–40 min security check 📞 +359 2 958 6535

How to Protect a Home MikroTik from Former Coworker Access

A practical guide to blocking access when a former coworker has seen your IP, configuration, or has old VPN keys. Includes sample commands, firewall/NAT, logging, and Zero-Trust hardening.

⚠ Scenario: a former coworker had access to company information, saw your home IP, or used a VPN tunnel while working. After they leave, that access must be fully revoked on your home MikroTik.

Protecting a home MikroTik from ex-colleague access attempts (Zero-Trust, firewall, VPN)

Home routers are often left with old corporate settings. But even a single stale peer entry or known public IP can be used for access by a former coworker. Here’s how to secure it quickly and effectively.

1) What’s the risk

When a former coworker has seen details about your home network (IP, VPN configuration, shared passwords, or a settings backup), they may:

attempt login via WinBox, SSH, or WebFig with known passwords;
reuse a saved VPN tunnel or old WireGuard key;
scan for open ports and services in your home network;
exploit devices such as NAS, cameras, or smart plugs.

Even without malicious intent, leftover access is a risk — it must be removed completely.

2) Immediate actions

Change all passwords on the MikroTik and internal devices. Use long, unique passphrases.
Restrict access to WinBox, SSH, and WebFig to the local network or a trusted IP only.
Remove all VPN clients and peer entries used for work (L2TP, WireGuard, OpenVPN).
Add the company IP ranges to a block list if you know them.
Update RouterOS to the latest stable version.
Create a backup before making major changes.

3) Core MikroTik configuration

# Backup configuration

/export file=backup-before-change

# Change password

/user set admin password="NewStrongPassword!2025"

# Restrict service access to local network only

/ip service set [find name=winbox] address=192.168.88.0/24

/ip service set [find name=ssh] address=192.168.88.0/24

/ip service set [find name=www] address=192.168.88.0/24

# Add company IP to block list

/ip firewall address-list add list=BlockOffice address=46.55.253.0/24 comment="Blocked office access"

# Block access from that list

/ip firewall filter add chain=input src-address-list=BlockOffice action=drop comment="Block office IPs"

# Disable VPN interfaces

/interface disable [find name~"l2tp-client"]

/interface wireguard peers remove [find comment~"office"]

4) How to detect access attempts

Enable logs and watch for failed attempts or suspicious IP addresses:

# Enable logs for inbound attempts

/system logging add topics=firewall,info action=memory

# Review access attempts

/log print where message~"failed" or message~"input"

# Add suspicious IPs to a list

/ip firewall address-list add list=Suspicious address=1.2.3.4 comment="Access attempt by former coworker"

5) Long-term measures

Use SSH keys instead of passwords whenever possible.
Rate-limit login attempts (rate-limit rules).
Periodically review firewall rules and VPN configurations.
Remove unnecessary port forwards and comments with personal data.
Regularly update RouterOS and firmware.

6) Example scenario: “Mitko” (ex-coworker)

Assume a former coworker — let’s call him “Mitko” — once had access to company configs and saw your home IP. After leaving, he decides to check whether your router still “responds.” In the logs, you might notice:

multiple SSH login attempts;
scans on ports 22, 8291, or 80;
connections from a known office IP range.

That’s why the first steps — blocking, rotating passwords, and disabling VPNs — are critical. They take effect immediately, even if the IP changes.

7) FAQ

Is blocking the company IP enough? Not entirely — IPs can change. It’s safest to remove all tunnels and company peers.
Do I need to change the public IP? With dynamic IPs, rebooting the modem often changes it. For static IPs — contact your ISP or use a protected tunnel (VPN/Cloudflare).
Can I restore old settings? Yes — if you made an /export file=backup, you can safely restore everything.

8) Concrete defense (Zero-Trust Hardening)

This is an “all-in-one” hardening set: new protected account, disable admin, turn off unused services, port-scan traps, brute-force blocking for WinBox/SSH, stop VPN clients/peers, hide MAC access, and a final default DROP.

# Variables

:local LAN "192.168.88.0/24"

:local NEWUSER "secureadmin"

:local NEWPASS "Ultra!Secure#2025"

# 1) Backup & new account; disable "admin"

/export file=pre-hardening-backup

/user add name=$NEWUSER group=full password=$NEWPASS

/user disable admin

# 2) Restrict/disable services

/ip service set winbox address=$LAN

/ip service set ssh address=$LAN

/ip service set www address=$LAN

/ip service set api disabled=yes

/ip service set api-ssl disabled=yes

/ip service set telnet disabled=yes

/ip service set ftp disabled=yes

# 3) MAC access (hide from LAN scans)

/tool mac-server set allowed-interface-list=none

/tool mac-server mac-winbox set allowed-interface-list=none

/ip neighbor discovery-settings set discover-interface-list=none

# 4) Reset temporary lists + base rules

/ip firewall address-list remove [find list=ssh_stage1]

/ip firewall address-list remove [find list=ssh_stage2]

/ip firewall address-list remove [find list=ssh_stage3]

/ip firewall address-list remove [find list=ssh_blacklist]

/ip firewall address-list remove [find list=portscan-blacklist]

/ip firewall filter add chain=input connection-state=invalid action=drop comment="Drop invalid"

/ip firewall filter add chain=input connection-state=established,related action=accept comment="Allow established/related"

/ip firewall filter add chain=input src-address=$LAN action=accept comment="Allow LAN"

/ip firewall filter add chain=input protocol=icmp action=accept comment="Allow ICMP (ping)"

# 5) Port-scan honeypot (Telnet/8080/8291 from WAN)

/ip firewall filter add chain=input protocol=tcp dst-port=23,8080,8291 src-address-list=!LAN action=add-src-to-address-list address-list=portscan-blacklist address-list-timeout=7d comment="Honeypot: scanners -> blacklist"

/ip firewall filter add chain=input src-address-list=portscan-blacklist action=drop comment="Drop scanners"

# 6) Brute-force protection for SSH/WinBox (stages -> blacklist 24h)

/ip firewall filter add chain=input protocol=tcp dst-port=22,8291 src-address-list=ssh_blacklist action=drop comment="Drop brute-force"

/ip firewall filter add chain=input protocol=tcp dst-port=22,8291 connection-state=new src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1d comment="Stage3 -> blacklist"

/ip firewall filter add chain=input protocol=tcp dst-port=22,8291 connection-state=new src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m comment="Stage2 -> Stage3"

/ip firewall filter add chain=input protocol=tcp dst-port=22,8291 connection-state=new src-address-list=ssh_stage1 action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m comment="Stage1 -> Stage2"

/ip firewall filter add chain=input protocol=tcp dst-port=22,8291 connection-state=new action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m comment="New -> Stage1"

# 7) Final DROP

/ip firewall filter add chain=input action=drop comment="DROP everything else"

# 8) Stop/remove VPN clients and peers (if any remain)

/interface disable [find where name~"l2tp|pptp|sstp|ovpn|wg"]

/interface wireguard peers remove [find]

/certificate remove [find comment~"office"]

# 9) Log access attempts

/system logging add topics=firewall,info action=memory

/log print where message~"login" or message~"failed"

⚠ Warning: after applying “Concrete defense,” external access is blocked by default (LAN only). For remote access, use a secure tunnel (e.g., WireGuard to a jump host) and update the rules.

Want a professional check?

Full security check of your home MikroTik
Audit of open services, VPN peers, and firewall rules
Guidance for safe backup and restore

Write to office@ntg.bg or book a consultation.

Tip: block access immediately — don’t wait for proof of a breach. Prevention saves headaches later.

Comments

Loading…

Only registered and logged-in users can comment.