How to Connect to a MikroTik VPS with Winbox

To connect to a MikroTik VPS with Winbox, open Winbox, type the server IP in Connect To, enter your Login and Password, and click Connect. Winbox reaches RouterOS on TCP port 8291, so your connection must be able to reach that port on the server’s public IP.

A MikroTik VPS runs RouterOS as a virtual machine (Cloud Hosted Router, CHR). That makes it a good fit for VPN endpoints, routing labs and a fixed public IP for your network.

What you need

• The server IP. It is in your activation email and on the service page in the Client Area.
• Login and password. These are also in the activation email.
• Winbox. Download it from the official MikroTik download page. Current versions run on Windows, macOS and Linux.

The examples use 203.0.113.10, a documentation address. Replace it with your server’s IP.

Connect with Winbox step by step

1. Start Winbox.
2. In Connect To, type 203.0.113.10. If the Winbox port was changed on the router, add it: 203.0.113.10:8292.
3. Type the login, usually admin, and the password.
4. Click Connect. The main window opens with the menu on the left.

Ignore the Neighbors tab. It finds MikroTik devices on your local network only, so it never lists a router in a remote data center. Always connect by IP.

Tick Keep Password only on a computer that you alone use. The saved address list is stored on your computer, not on the router.

Turn on Safe Mode before you change anything

Most lockouts happen when someone edits a firewall rule or service setting and cuts off their own connection. Safe Mode protects you from that:

• In Winbox, click Safe Mode at the top left before you make changes.
• If the connection drops while Safe Mode is on, RouterOS undoes everything you changed in that session.
• When you are sure the changes are right, click Safe Mode again to keep them.

In a terminal (New Terminal in the left menu), the same switch is Ctrl + X.

Secure the router right after the first login

A public RouterOS login is scanned within minutes of going online. Do these four things first, with Safe Mode on.

1. Set a strong password. In Winbox use System › Password, or in the terminal:

/user set admin password="Use-A-Long-Unique-Password-Here"

2. Create your own admin user and disable the default one:

/user add name=netadmin group=full password="Another-Long-Password"
/user disable admin

Log out and connect again as netadmin before you disable admin, to confirm the new user works.

3. Turn off services you don’t use. Check what is enabled first:

/ip service print
/ip service disable telnet,ftp,www,api,api-ssl

Keep winbox and ssh enabled so that you always have two ways in.

4. Limit Winbox to your own IP (only if your IP is static):

/ip service set winbox address=198.51.100.25/32

Replace 198.51.100.25 with your office or home IP. If your IP changes, you lose Winbox access, so keep SSH open to a second trusted address, or leave this step out.

Fix common Winbox errors

“ERROR: could not connect to 203.0.113.10”. Winbox can’t reach port 8291. Check the IP and make sure the server is running in the Client Area. Then test the port from Windows PowerShell:

Test-NetConnection 203.0.113.10 -Port 8291

If the test fails while the server is running, the Winbox service may be disabled, moved to another port, or limited to an address list. Connect over SSH (port 22) and run /ip service print to check.

“ERROR: wrong username or password”. Check the login and password. Watch for trailing spaces copied from the email. RouterOS user names are case-sensitive.

Connected, but the window closes after a few seconds. A firewall rule in the input chain is blocking the session after it starts. Connect over SSH and list the rules with /ip firewall filter print.

Back up the configuration

Before major changes, save a backup and an export. Both stay on the router and can be downloaded from Files in Winbox:

/system backup save name=before-change
/export file=before-change

The .rsc export is plain text, so it is easy to read and copy parts from.

If you are locked out and none of the steps above helps, open a ticket from our contact page with the server IP and the time of the last change.

Frequently asked questions

Which port does Winbox use?

TCP 8291 by default. If you change it under IP › Services, connect with IP:newport.

Can I connect to RouterOS without Winbox?

Yes. SSH on port 22 gives you the full RouterOS command line. Every setting in Winbox is also available as a terminal command.

Why is my router missing from the Neighbors list?

Neighbors only shows devices in the same local network. A VPS sits in a remote data center, so you always connect to it by IP.

What does Safe Mode do if my internet drops?

RouterOS rolls back every change made in that Safe Mode session. This brings back the configuration you had before you started.