Locked Out of Mikrotik

gnarl · Thu Aug 30, 2018 12:11 pm

Hi everyone!
I'm stupid and i have disabled all the services ports, including winbox (8291) and ssh.

The MikroTik is working well, but I can't connect to it. What can I do to restore access? I also have a physical access to device.

The model is MikroTik RB951Ui-2HnD there is no physical Serial port to connect through it and restore access. Resetting the device is my last last resort because i don't have a backup config and i have allot of stuff configured inside that i cant configure them again!

Is there any solution for this case?

Neighbors shows my router mac address but when i try to connect i get an ERROR: Could not connect message.

Thu Aug 30, 2018 12:23 pm

Winbox via MAC address.
Open Winbox ... click "Neighberhood" ... wait for your router ... click MAC address in the MAC column ... fill user + password ... connect

gnarl · Thu Aug 30, 2018 12:26 pm

Winbox via MAC address.
Open Winbox ... click "Neighberhood" ... wait for your router ... click MAC address in the MAC column ... fill user + password ... connect

As i already have written in my post i have already tried to connect via Winbox >> Neighbors with no success when i try to connect i get an ERROR: Could not connect.

Thu Aug 30, 2018 12:36 pm

Do you have MAC address in the field "Connect to:" specified?

gnarl · Thu Aug 30, 2018 12:46 pm

Do you have MAC address in the field "Connect to:" specified?

Yes i have look at the attached picture

winboxproblem.jpg

ADahi · Thu Aug 30, 2018 2:49 pm

try mac-telnet from other connected routerboard

gnarl · Thu Aug 30, 2018 3:18 pm

try mac-telnet from other connected routerboard

Unfortunately i don't have other Mikrotik router

proximus · Thu Aug 30, 2018 3:26 pm

Are you using WinBox on a Windows VM?

Asking because I have not been able to make MAC connections work from a Windows VM on Fusion. Have to use WinBox directly on the Mac OS X host system.

freemannnn · Thu Aug 30, 2018 3:45 pm

try mac-telnet from other connected routerboard

if you can wait 1-2 hours i can go office and close all services in my main router and try to connect to it with mac-telnet from another hap lite that i have spare.
what do u think? should i try?

gnarl · Thu Aug 30, 2018 4:06 pm

try mac-telnet from other connected routerboard

if you can wait 1-2 hours i can go home and close all services in my main router and try to connect to it with mac-telnet from another hap lite that i have spare.
what do u think? should i try?

Yes please <3

gnarl · Thu Aug 30, 2018 4:07 pm

Are you using WinBox on a Windows VM?

Asking because I have not been able to make MAC connections work from a Windows VM on Fusion. Have to use WinBox directly on the Mac OS X host system.

The computer i am using winbox is a physical windows 7 computer connected on the same network as my router

gnarl · Thu Aug 30, 2018 4:11 pm

try mac-telnet from other connected routerboard

i have installed RouterOs on a VirtualBox and i have tried to use tools >> Telnet >> mac telnet

when i have inserted my Mikrotik router Mac address it asked me for a Login and password but when inserted the correct credentials it was not connecting and just showed Disconnected.

I have attached an image for you to see.

routerostelnet.jpg

mkx · Thu Aug 30, 2018 4:18 pm

I'd say that mac-telnet client (=sw run on your Windows machine) asks about credentials even before it tries to connect to the other end.

There are settings for MAC servers (telnet and winbox), which by default limit access to connections coming in through interfaces members of LAN interface list. If you forget to update that list, then you might well get locked out of using MAC connectivity even though that was not intentionally. This lock-out is specially easy to achieve when VLANs are in use.

freemannnn · Thu Aug 30, 2018 5:15 pm

try mac-telnet from other connected routerboard

if you can wait 1-2 hours i can go office and close all services in my main router and try to connect to it with mac-telnet from another hap lite that i have spare.
what do u think? should i try?
Yes please <3

sorry same result as "gnarl". shows disconnected.

draid · Fri Aug 31, 2018 7:41 am

Hey amte I managed to achieve the same thing but in a different way. Still I couldn't connect to the router via web or winbox including winbox mac so a the end I just made a reset of the device. I guess it'll be a bit paintful if you have a lot of settings but it's always an option.

gnarl · Fri Aug 31, 2018 9:27 am

Hey amte I managed to achieve the same thing but in a different way. Still I couldn't connect to the router via web or winbox including winbox mac so a the end I just made a reset of the device. I guess it'll be a bit paintful if you have a lot of settings but it's always an option.

Making a reset is my last last resort because i have so many firewall rules and some vpn connections. Unfortunately because i am beginner in Mikrotik i have made all these settings by trial and error and i cant reproduce them again after the reset. I am that stupid i didn't even made a backup.

This router i have installed it in my company so it will be allot of problem to just make a reset.

The router is working perfect i was just experimenting with the winbox service port because i have read about the vulnerability. Now i am locked out of the router and i cant even go inside to make an update to patch the vulnerability problem.

Please is anyone out there that can suggest something ?
This router doesn't have Serial port only one USB port.
Is it possible to do something using the USB Port to gain console access ?

I am so sad and frustrated please someone help me

ADahi · Fri Aug 31, 2018 10:20 am

not sure if this can help
https://mikrotik.com/product/woobm

cliffordjames · Fri Aug 31, 2018 11:32 am

If the router you're using is essential for the companies business they should have a backup router pre-configured and ready to go in case of failure.
If they don't have one get them to get one.
Configure that one and when it's ready plan some downtime.
Swap.

gnarl · Fri Aug 31, 2018 11:41 am

If the router you're using is essential for the companies business they should have a backup router pre-configured and ready to go in case of failure.
If they don't have one get them to get one.
Configure that one and when it's ready plan some downtime.
Swap.

Hello, as i previously stated unfortunately i cant recreate fully the settings i have done due to the settings have been achieved through trial and error.

gnarl · Fri Aug 31, 2018 11:43 am

not sure if this can help
https://mikrotik.com/product/woobm

Hello, this looks very interesting can some one confirm that it will work with MikroTik RB951Ui-2HnD which i have mistakenly closed all service ports including winbox port ?

Sob · Fri Aug 31, 2018 3:56 pm

I don't have Woobm, but it should appear as serial port to router. So it would solve your problem with closed port, because it doesn't care about network at all.

But when I tested regular USB to serial cable, it was recognized as serial port by router, but console didn't automatically attach to it. I don't know if Woobm is perhaps treated differently.

CsXen · Fri Aug 31, 2018 5:47 pm

Hi.
For a last chance, try to boot into an OpenWRT image over tftp, and try to find and recover your scripts/firewall settings/etc. phisically from the filesystem.

Best regards: CsXen

ADahi · Fri Aug 31, 2018 5:59 pm

Hey amte I managed to achieve the same thing but in a different way. Still I couldn't connect to the router via web or winbox including winbox mac so a the end I just made a reset of the device. I guess it'll be a bit paintful if you have a lot of settings but it's always an option.
Making a reset is my last last resort because i have so many firewall rules and some vpn connections. Unfortunately because i am beginner in Mikrotik i have made all these settings by trial and error and i cant reproduce them again after the reset. I am that stupid i didn't even made a backup.

This router i have installed it in my company so it will be allot of problem to just make a reset.

The router is working perfect i was just experimenting with the winbox service port because i have read about the vulnerability. Now i am locked out of the router and i cant even go inside to make an update to patch the vulnerability problem.

Please is anyone out there that can suggest something ?
This router doesn't have Serial port only one USB port.
Is it possible to do something using the USB Port to gain console access ?

I am so sad and frustrated please someone help me

yes try USB to Serial
this print from plugged usb-to-rs232 (USB-SERIAL CH340)

/port print detail 
Flags: I - inactive 
 0   name="usb1" used-by="" device="1:2" channels=1 baud-rate=9600 data-bits=8 parity=none stop-bits=1 flow-control=none

in crs3xx the baud-rate was 115200 not 9600
so use putty and try both until get success

gnarl · Fri Aug 31, 2018 8:25 pm

Hello guys thank you all for the nice solutions. I have ordered Woobm-USB and it will arrive tuesday or wednesday and i will test it and tell you how it goes. If this doesn't work i will try the USB to serial suggestion and if nothing of these works i will try the OpenWRT suggestion.

@CsXen can you please give me a guide or something on how to boot into an OpenWRT image over tftp ?

P.S if anyone else has other suggestions please share them so i can try them and see if something works. I refuse to just reset my router and loose all the settings i have done.

Mon Sep 03, 2018 2:43 am

Tested on 962 ...
I've inserted it directly to 962 and connected via terminal as described in the manual but when you restart/power-on router then Woobm is restarted as USB power is cycling.
Try to connect Woobm with USB dock station with external power supply to prevent resseting during router reset.

CsXen · Tue Sep 04, 2018 10:33 pm

Hi.

@CsXen can you please give me a guide or something on how to boot into an OpenWRT image over tftp ?

Try to start here.
https://wiki.openwrt.org/toh/mikrotik/common

You will need some server with tftp and dhcp.
Best regards: CsXen

gnarl · Wed Sep 05, 2018 1:43 pm

Hello again,

I have tried Woobm-USB plugged it in directly on USB port of router (RB951Ui-2HnD) i connected my laptop at Woobm-USB WIFI and opened the webpage and clicked on telnet TAB. Telnet TAB said successfully connected but terminal was blank and was not accepting any commands. I also tried this with Putty but no success also there was not connecting.

My router (RB951Ui-2HnD) firmware is 6.37

Can someone tell me what i must do in order to connect to console and reactivate winbox port 8291 ?

Sob · Wed Sep 05, 2018 4:00 pm

You might be out of luck, it depends on how is RouterOS supposed to interact with newly added serial port. It didn't automatically enable console on my usb to serial cable. But I do remember that recently someone complained about how gps (which also looks like serial port) was claimed by console automatically. So I don't know what exactly is the right behaviour.

CsXen · Sun Sep 09, 2018 7:46 am

Hi.
You can see RX and TX testpoints on the router's mainboard (lower right area, near EJTAG and the wireless antenne):

Try to connect there over a proper level translator (probably 3.3V or 5V TTL levels there). If it works, you can reach the CLI.

Best regards: CsXen

gnarl · Thu Sep 13, 2018 12:22 am

Hi.
You can see RX and TX testpoints on the router's mainboard (lower right area, near EJTAG and the wireless antenne):

Try to connect there over a proper level translator (probably 3.3V or 5V TTL levels there). If it works, you can reach the CLI.

Best regards: CsXen

Hello,

I saw the TX & RX you are referring to but what should i solder there ? You mean serial cable ?

Locked Out of Mikrotik

Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Re: Locked Out of Mikrotik

Who is online