RouterOS API access, account policy and firewall hardening

Prerequisites and authority

Network/RouterOS authority, known topology and a recovery management path are required. Preserve existing router configuration before managed changes.

Secure RouterOS API access

Create a dedicated integration account rather than using the router's general administrator credentials. Restrict API access to the BryanNet management source address or routed VPN network.

The existing guide provides this baseline RouterOS example. It must be adjusted and tested for the target firmware and BryanNet operations; read,write,api is not yet certified as the complete least-privilege policy.

/user group add name=bryannet policy=read,write,api
/user add name=bryannet group=bryannet password="<STRONG_UNIQUE_PASSWORD>"
/ip service set api disabled=no port=8728 address=10.200.0.1/32

Do not copy the placeholder password. If a group/account already exists, inspect and update it through the appropriate tool instead of creating an ambiguous duplicate.

Port 8728 is the conventional plain API service. Restrict it to a trusted management network or encrypted VPN. API-SSL conventionally uses 8729, but the current BryanNet connection implementation does not configure TLS or certificate verification. Setting the saved SSL field or changing the port does not enable TLS. Do not use API-SSL as an interchangeable BryanNet transport; see Supported RouterOS versions, API ports and permissions.

RouterOS service restrictions and input firewall policy both matter. Add a narrowly scoped allow rule before a rule that would otherwise drop the management connection. Do not disable the firewall or publish the API on the public internet.

Verify TCP reachability and then authentication. A connection refusal, timeout and rejected login have different causes. Test each managed function before removing policy rights. Rotate API credentials using API security, generated router identifiers and secrets and confirm synchronization afterward.

Related guides

Related guides: Validate hotspot login, provisioning and router health, Shipped Desired State presets and safe customization, Internet sources and multi-site network topology, Router connection fails or API authentication is rejected.