Router

Access a router behind your MikroTik

Reach the admin page of another router — typically the internet modem your MikroTik connects through — from anywhere, with a remote plus one NAT rule. Same trick as the OLT guide, aimed at a router.

Another router on your network — very often the internet modem your MikroTik gets its connection from — has no direct path from the internet. MikRouter forwards a public address + port down a VPN tunnel to your MikroTik, and one NAT rule hands that traffic on to it. Opening http://test.mikrouter.com:12345in your browser then lands you on that router's login page.

The remote reaches the MikroTik. The NAT rule is what carries it the last hop — back to the modem in front of it.

The example used throughout: the internet modem at 192.168.1.1

Every screen and command below is filled in for one real setup, so you can see what a finished configuration looks like. Swap these five values for your own as you go:

The device — the internet modem the MikroTik gets its connection from. Any other router or device with a web interface works exactly the same way; only the address and port change.
Its address — 192.168.1.1, the address you already use to reach the modem's admin page from inside the network. If you are not sure, it is the MikroTik's own gateway: check IP›Routes for the 0.0.0.0/0 route, or IP›DHCP Client.
Its web port — 80, because this modem serves its admin page over plain HTTP. That is why the NAT rule below ends in to-ports=80 and why you open it with http://. A device that serves HTTPS uses 443 in both places instead.
The Service Port — 8080, a free port you pick yourself. It is the port that comes out of the tunnel on the MikroTik, and it has nothing to do with the modem's own port.
The public address — test.mikrouter.com:12345, which MikRouter assigns when you buy the remote. Yours will differ.

Before you start, make sure you have

A MikRouter account with enough credits or a payment method.
Winbox open and connected to the MikroTik that sits behind the modem.
The other router's IP address and admin port — for the internet modem that is typically 192.168.1.1 on port 80, the address you already use to open it from inside the network.

Create a remote for the modem

In the dashboard go to Remotes, click + New Remote, and fill in the purchase form. Pick the server, set a Duration, and choose a VPN Service — the key field is Service Port:

https://mikrouter.com/user/remotes/new

1. Remote Server

test

🇵🇭 PH

L2TP, SSTP, OVPN, PPTP

2. Service Configuration

Duration1

UnitWeek(s)

VPN ServiceOVPN

Service PortOther ▾

Port8080

ProtocolTCP

3. Details

Remote NameInternet Modem

Purchase Summary

Server: test (PH)
Duration: 1 Week(s)
VPN Service: OVPN
Service Port: 8080 (TCP)
Total: PHP 10

Purchase — PHP 10

Field	Value	Note
Remote Server	`test (PH)`	The server your MikroTik will dial
VPN Service	`OVPN`	Any of the four works
Service Port	`Other`	Not Winbox/HTTPS — those point at the main router
Port	`8080`	Any free port on the tunnel
Protocol	`TCP`	Router admin page is TCP
Remote Name	`Internet Modem`	Anything you like

Why “Other” for the Service Port?

The built-in choices (Winbox 8291, HTTPS 443, HTTP 80, SSH 22) point at the MikroTik itself. Because you want a different device, pick Other with a free port like 8080— you'll aim it at the modem in step 5.

Pay and confirm

Choose a Payment Method, click Purchase, then Confirm. With Credits the remote activates instantly; with an e-wallet it activates once payment clears.

Copy your connection details

Open the new remote under Remotes. Use the copy buttons rather than retyping.

https://mikrouter.com/user/remotes/665…

Internet Modem

Offline

VPN Credentials

Username

user-ovpn

Password

pass-ovpn

Connect To

test.mikrouter.com

Assigned Port

12345

Remote URL

test.mikrouter.com:12345

Use this address to connect via Winbox, SSH, HTTP, or API.

Service Port

8080 (TCP)

Arrives on your MikroTik through the tunnel — the port your NAT rule matches.

It reads Offline, which is correct — nothing has dialled in yet. That changes in step 4.

Field	Value	Note
Connect To	`test.mikrouter.com`	VPN server address
Username	`user-ovpn`	PPP username
Password	`pass-ovpn`	PPP password
Remote URL	`test.mikrouter.com:12345`	Server : your assigned port
Service Port	`8080`	The port you chose in step 1

Build the VPN tunnel on the MikroTik

This part is the same for every remote, whatever sits behind the router, so it has its own guide per protocol rather than a shortened copy here. Open the one for the VPN Serviceyou chose in step 1 and follow it to the end, then come back:

OVPN Client Setup →mikrouter.com/guides/ovpn-client-setup SSTP Client Setup →mikrouter.com/guides/sstp-client-setup L2TP Client Setup →mikrouter.com/guides/l2tp-client-setup PPTP Client Setup →mikrouter.com/guides/pptp-client-setup

You are done with this step when the client shows an R (running) flag in PPP and the remote's badge has turned Online:

https://mikrouter.com/user/remotes

Accounts

Remote Accounts

Manage your remote access accounts. Drag to rearrange.

▦☰+ New Remote

Search remotes…

NameRemote accessVPNExpiresStatus

⠿🇵🇭MikroTik RB5009test.mikrouter.com:54321sstp7d 0hOffline

⠿🇵🇭Internet Modemtest.mikrouter.com:12345ovpn7d 0hOnline

Note down the nameyou gave the VPN client — step 5 uses it to keep the NAT rule limited to tunnel traffic. This guide's example is mikrouter-ovpn, the name the Quick Setup command uses.

Point the port at the modem

The tunnel now reaches your MikroTik on port 8080. One NAT rule forwards it to the modem — two ways to add it.

Open IP›Firewall, go to the NAT tab and click New:

admin@192.168.88.1 (hEX) hEX WinBox

Workspace:<own> ▾▣ 1⚲↶↷Safe Mode⚙

Firewall▾Filter RulesNATMangleRawService PortsConnectionsAddress ListsLayer7 Protocols⇗✕

+New▶ Enable✗ Disable✕ Remove💬 Comment⚲ Find▼ Filter

# ▴⚑ActionChainSrc. AddressDst. AddressProtocol

0↗masqueradesrcnat

1 item▶ Live

Actions

Reset Counters

Reset All Counters

hEX 192.168.88.1 / mmips / hEX / 7.23.3 (stable)0 %196.9 MiB / 59.1 MiB / 256.0 MiB01:16:00

On the General tab set the chain, then the two things the rule has to match — the protocol and the port the tunnel delivers on. In. Interface is optional; the mockup fills it in because it is worth setting:

admin@192.168.88.1 (hEX) hEX WinBox

Workspace:<own> ▾▣ 1⚲↶↷Safe Mode⚙

NAT Rule › New…□✕

GeneralAdvancedExtraActionStatistics

Enabled✓

Comment

Chaindstnat▾

Src. Address+

Dst. Address+

Src. Address List+

Dst. Address List+

Protocol6 (tcp)▾−

Src. Port+

Dst. Port8080−

Any. Port+

In. Interfacemikrouter-ovpn⋮▾−

Out. Interface+

In. Interface List+

Out. Interface List+

Packet Mark+

Connection Mark+

Routing Mark+

Connection Type+

Copy

Actions

Reset Counters

Reset All Counters

Status: CancelApplyOK

hEX 192.168.88.1 / mmips / hEX / 7.23.3 (stable)0 %196.9 MiB / 59.1 MiB / 256.0 MiB01:16:00

In. Interface is optional — leaving it empty still works

The rule forwards either way, because it matches the port wherever the traffic came from. That is also the reason to set it: with the field empty, anything that reaches this router on port 8080 is sent to the modem, including a machine on your own LAN. Naming the VPN interface narrows the rule to traffic that actually came down your tunnel. Set it unless you have a reason not to.

Then switch to the Action tab and say where it goes. To Addresses and To Ports only appear once Action is dst-nat:

admin@192.168.88.1 (hEX) hEX WinBox

Workspace:<own> ▾▣ 1⚲↶↷Safe Mode⚙

NAT Rule › New…□✕

GeneralAdvancedExtraActionStatistics

Actiondst-nat▾

Log

Log Prefix+

To Addresses192.168.1.1−

To Ports80−

Copy

Actions

Reset Counters

Reset All Counters

Status: CancelApplyOK

hEX 192.168.88.1 / mmips / hEX / 7.23.3 (stable)0 %196.9 MiB / 59.1 MiB / 256.0 MiB01:16:00

Click Apply, then OK. The rule appears in the NAT list.

Open New Terminal and paste. The four highlighted values are the ones to change; everything else is the same on every router:

MikroTik Terminal

/ip firewall nat add chain=dstnat protocol=tcp \
    in-interface=mikrouter-ovpn dst-port=8080 \
    action=dst-nat to-addresses=192.168.1.1 to-ports=80 \
    comment="mikrouter 2nd router"

mikrouter-ovpn is your VPN client's name from step 4, 8080 the Service Port you chose in step 1, and 192.168.1.1 / 80 the modem's own address and admin port. The chain, protocol and action are the same for everyone.

in-interface is optional — drop that one setting and the rule still forwards, it just stops being limited to traffic that arrived through the tunnel. Everything else is required.

Field	Value	Note
chain	`dstnat`	General tab — catches traffic addressed to this router, before it is routed
protocol	`tcp (6)`	General tab — a web interface is TCP
dst-port	`8080`	General tab — the Service Port you chose in step 1
in-interface	`mikrouter-ovpn`	General tab, optional — the VPN client from step 4; limits the rule to tunnel traffic
action	`dst-nat`	Action tab — rewrite the destination, i.e. send it on to another device
to-addresses	`192.168.1.1`	Action tab — the modem's address
to-ports	`80`	Action tab — its admin port (8291 for Winbox, 443 for HTTPS)
comment	`mikrouter 2nd router`	Optional — a label so you can find this rule again later

If the page still won't load

The modem has to be able to send its replies back the way they came. Add a source-NAT so the traffic appears to come from the MikroTik itself:

MikroTik Terminal

/ip firewall nat add chain=srcnat dst-address=192.168.1.1 action=masquerade comment="mikrouter 2nd router return"

Only the highlighted address changes — the same modem address as the rule above. The chain, action and comment stay as they are.

Open the modem from anywhere

That's it. From any device, open a browser and go to your Remote URL:

Field	Value	Note
Address	`http://test.mikrouter.com:12345`	http, because this router serves its admin page on port 80

Not Securehttp://test.mikrouter.com:12345

Router Admin

Web management

admin

••••••

“Not Secure” in the address bar is expected here

Every browser flags a plain http://page that way, and this one is plain HTTP because the router's own admin page is. It says nothing about the tunnel, which carried the traffic encrypted the whole way to your MikroTik. Sign in as normal.

Sign in with the modem'sown username and password — not your MikroTik or MikRouter login. Need another device too? Buy another remote, pick a different Service Port (say 8081), and add another NAT rule pointing at that device's address instead.

Is the second device a MikroTik too?

Then you can reach its Winbox the same way: set the NAT rule's to-ports to 8291 instead of 80, then open Winbox and connect to test.mikrouter.com:12345.

Troubleshooting

Remote shows “Offline” in the dashboard

The VPN client isn't connected — recheck step 4 (username, password, server address).
Make sure your ISP isn't blocking the protocol; try SSTP (port 443) if OVPN won't connect.
Confirm the subscription hasn't expired.

Online, but the browser page times out

Check the NAT rule from step 5 — dst-port must equal your Service Port (8080), and to-addresses/to-ports must match the modem.
From New Terminal run /ping 192.168.1.1 to confirm the MikroTik can reach the modem.
If ping works but the page doesn't load, add the srcnat masquerade rule from step 5.

Page loads but won't log in

Use the modem's own admin credentials, not your MikroTik or MikRouter login.
If it only serves HTTPS, try https:// and set the NAT to-ports=443.

Quick recap

Buy a remote on the test (PH) server — set Service Port = Other (8080, TCP).
Copy the credentials & Remote URL from the detail page.
Create the VPN client on the main MikroTik (follow the guide for your protocol).
Add one NAT rule forwarding port 8080 → the modem's 192.168.1.1:80.
Browse to http://test.mikrouter.com:12345 — you're on the modem.

Another way to do this

No MikroTik? Use an agent instead

Everything above needs a MikroTik, a remote per device and one NAT rule each. A MikRouter agent reaches the same modem from the inside instead: a cheap board — or a Windows PC or Mac already on that network — dials out on its own, and you add a mapping in the dashboard for each service you want to open. No firewall rule to write, no port forwarding, and one agent covers every device the network can route to — the modem, a router, a DVR, a camera, a NAS.

Agent Overview →what an agent is, and the three setup steps Use a PC you already have →Windows or Mac on that network — nothing to buy Buy a cheap board →an ESP32 that does nothing else

Which is right for you: if your MikroTik is already dialled in and you only want this one modem, the guide above is the shorter path. An agent wins when there is no MikroTik, when you would rather not touch firewall rules, or when you want several devices at the site. ⚠️ An ESP32 agent holds only a handful of connections at once, so a heavy admin page can load slowly through one — a Linux, Windows or Mac agent has far more headroom.