Remote access: Winbox and WireGuard
Your routers often sit behind NAT or a mobile connection with no public IP, so you can’t reach them directly with WinBox. ISPMan gives you two ways in:
- Winbox jumpbox: ISPMan forwards a public port to each router’s Winbox port, limited to the IP ranges you allow. Best for day-to-day WinBox work.
- Leo WireGuard network: a private WireGuard network for your devices that your laptop or phone can join. Best when you want full network access to several devices.
There’s also a quick Remote Access link on each MikroTik’s device page.
Winbox jumpbox
Section titled “Winbox jumpbox”Turn it on for one router
Section titled “Turn it on for one router”- Open the router’s device page and find Access & Credentials.
- Switch on Enable Winbox Port. It saves immediately.
- Wait about 3 minutes for the change to apply. A Jumpbox Address appears,
such as
<jumpbox-host>:<port>. Click it to copy. - In WinBox, connect to that address with the router’s username and password.
If the router’s Winbox doesn’t listen on the default port 8291, set Winbox Port (on device) first (click Change, or Edit Device).
The Device Info card also shows the jumpbox address. If the port is allocated but not yet being forwarded, its tooltip says so: enable the Winbox port and wait for the next update (about 3 minutes).
Settings → Winbox Access
Section titled “Settings → Winbox Access”Owners manage the jumpbox for the whole account at Settings → Winbox
Access (/dashboard/settings/winbox-jumpbox).
| Section | What it does |
|---|---|
| Enable Winbox Jumpbox | Winbox jumpbox enabled (all devices) turns the jumpbox on for every router at once, overriding each router’s own toggle. |
| Applied rules | Read-only list of the port forwards that are live right now: Device, External port, Internal port, Allowed sources, Added. |
| Allowed IPv4 Networks | Only IPs in these networks can reach the jumpbox. Type an IPv4 address or network (for example 196.201.11.0/24) and click Add Network. A bare IP counts as a single host (/32). Up to 9 networks. |
| Your current IP | If ISPMan detects the IP you’re browsing from, it offers to allow just that address. |
| Quick add common ISP bands | Broad ranges seen from real users. Click to add, then narrow them down. |
| Allow all | Allow all traffic opens Winbox to every IPv4 address (0.0.0.0/0) for a set time (15 minutes up to 24 hours). It’s removed automatically when the time ends. Submitting again resets the timer. |
Changes take about 3 minutes to apply.
Remote Access link
Section titled “Remote Access link”On a MikroTik’s device page, click Remote Access, then Generate Link. ISPMan creates a remote access link to the router and shows its expiry. Use it for quick access when you don’t need the jumpbox.
Leo WireGuard network
Section titled “Leo WireGuard network”Devices → Wireguard (/dashboard/devices/wireguard) manages Leo, a
WireGuard-based management network for your account. It’s for paying accounts
and has to be approved first.
- Open Devices → Wireguard and click Request Leo Management Access. ISPMan support reviews the request and you’re notified when it’s approved.
- Once approved, the page shows your Network Configuration: a dedicated /28 network (14 usable addresses), available IPs and onboarded devices. Contact support if you need more addresses.
- Click Onboard New Device and pick a router. In the provisioning window, click Start Provisioning. ISPMan creates the WireGuard interface, adds the peer, configures the IP address and adds a firewall rule, showing each step as it completes.
- Under Management Interface, click Create Management Peer. Scan the QR code with the WireGuard app on your phone or laptop, or use the configuration file shown.
- Connect the WireGuard app. Your devices are now reachable at their Leo IP addresses.
To remove a router from Leo, click Deprovision in the Onboarded Devices table, then Start Deprovisioning.
Keep management access locked down
Section titled “Keep management access locked down”Good habits for router security:
- Don’t expose management ports to the internet. WinBox (8291), SSH (22), the web interface (80/443) and the API (8728/8729) should only be reachable from your LAN and the ISPMan management tunnel. A firewall rule that accepts established traffic and the management tunnel, then drops those ports from everywhere else, does this. The Admin Access List script in manual onboarding sets up a version of this. Read its warning first.
- Keep the jumpbox allow list tight. Add your office or home IP rather than whole networks, and remove entries you no longer need.
- Change the default admin password. Use Reset Admin Password on the device page and keep the new one somewhere safe.
- Turn SSH off when you aren’t using it with Disable SSH.
- Don’t leave Public RADIUS on. It’s a temporary workaround only.
- Don’t delete ISPMan’s tunnel interface, login or scheduled scripts on the router. If you do, the router drops offline in ISPMan and you’ll need to re-onboard it.