Mikrotik, add rules over API

README.md

Prerequisites:

• Mikrotik API is enabled (IP > Services > API, enabled on port 8728 and/or 8729)
• Mikrotik API ports are allowed (IP > Firewall > Filter Rules, input chain has both TCP ports allowed)
• Mikrotik management interface IP address is reachable
• Linux (VM or real hardware)

Steps

• Download the script from here to your Linux machine - https://wiki.mikrotik.com/wiki/Manual:API_Python3
• Find all input rules, input and press enter twice:

  /ip/firewall/filter/print
  ?chain=input
  

• Identify first rule in the output

  !re
  =.id=*9D
  =chain=input
  ...
  !done
  

• Allow winbox, input and press enter twice:

  /ip/firewall/filter/add
  =chain=input
  =src-address=192.168.88.100
  =protocol=tcp
  =dst-port=8291
  =action=accept
  =comment=TEST
  =place-before=*9D
  

  Note: 192.168.88.100 is an IP-address of a machine from where you're going to connect to Mikrotik
• Now try to connect

How about getting a rule to protect the router?

@jojoamrni I drop everything coming outside of the lan network list, but such topics as network segmentation and security hardening is out of scope of this particular case :)