All tutorials
Router

Access a router behind your MikroTik

Reach the admin page of a second router connected to your MikroTik's LAN — from anywhere — with a remote plus one NAT rule. Same trick as the OLT guide, aimed at a router.

A second router hanging off your MikroTik's LAN has no direct path from the internet. MikRouter forwards a public address + port down a VPN tunnel to your MikroTik, and one NAT rule hands that traffic to the downstream router. Opening ph1.mikrouter.com:44541in your browser then lands you on that router's login page.

Your browseranywhereMikRouter serverph1.mikrouter.compublic port 44541Your MikroTikVPN client + NATmain router2nd router192.168.88.2 : 80HTTPSVPN tunnelLANBrowser → server public port → down the VPN tunnel → MikroTik NAT rule → router login

Before you start, make sure you have

  • A MikRouter account with enough credits or a payment method.
  • Winbox open and connected to the main MikroTik the second router is plugged into.
  • The downstream router's LAN IP address and admin port — e.g. 192.168.88.2 on port 80. Find it under IP›DHCP Server›Leases on the MikroTik, or from the router itself.
1

Create a remote for the router

In the dashboard go to Remotes and click + New Remote.
https://mikrouter.com/remotes

Remote Accounts

Manage your remote access accounts. Drag to rearrange.

+ New Remote

Office Router

Online
+ add another

Pick a server close to you, set a Duration, and choose a VPN Service (L2TP is easiest). The key field is Service Port:

FieldValue
VPN ServiceL2TP
Service PortOther
Port8090
ProtocolTCP
Remote NameSecondary Router

Why “Other” for the Service Port?

The built-in choices (Winbox 8291, HTTPS 443, HTTP 80, SSH 22) point at the main MikroTik itself. Because you want a different device on the LAN, pick Other with a free port like 8090— you'll aim it at the second router in step 5.
https://mikrouter.com/remotes/new
1. Remote Server

PH 1

🇵🇭 PH

L2TP, SSTP, OVPN

SG 1

L2TP, SSTP

US 1

OVPN

2. Service Configuration
Duration1
UnitWeek(s)
VPN ServiceL2TP
Service PortOther ▾
Port8090
ProtocolTCP
3. Details
Remote NameSecondary Router
Purchase Summary
Server
PH 1 (PH)
Duration
1 Week(s)
VPN Service
L2TP
Service Port
8090 (TCP)
Total
PHP 10
Purchase — PHP 10
2

Pay and confirm

Choose a Payment Method, click Purchase, then Confirm. With Credits the remote activates instantly; with an e-wallet it activates once payment clears.
3

Copy your connection details

Open the new remote under Remotes. Use the copy buttons rather than retyping.
https://mikrouter.com/remotes/665…

Secondary Router

Online
VPN Credentials

Username

mr-8x3k9p

Password

a1b2c3d4e5

Connect To

ph1.mikrouter.com

Assigned Port

44541

Remote URL

ph1.mikrouter.com:44541

Use this address to connect via Winbox, SSH, HTTP, or API.

Quick Setup
MikroTik TerminalCopy
/interface l2tp-client add name=mikrouter-l2tp-mr-8x3k9p connect-to=ph1.mikrouter.com user=mr-8x3k9p password=a1b2c3d4e5 disabled=no
FieldValue
Connect Toph1.mikrouter.com
Usernamemr-8x3k9p
Passworda1b2c3d4e5
Remote URLph1.mikrouter.com:44541
Service Port8090
4

Build the VPN tunnel on the MikroTik

The fastest way is the Quick Setupcommand on the remote's detail page. In Winbox openNew Terminal, paste it, and press Enter:
MikroTik Terminal
/interface l2tp-client add name=mikrouter-l2tp-mr-8x3k9p connect-to=ph1.mikrouter.com user=mr-8x3k9p password=a1b2c3d4e5 disabled=no

Prefer clicking? Add it by hand instead: go to PPP, click + › L2TP Client, and on the Dial Out tab fill in:

FieldValue
Connect Toph1.mikrouter.com
Usermr-8x3k9p
Passworda1b2c3d4e5
Profiledefault-encryption
Allowmschap2, mschap1, chap, pap

Confirm the client shows an R(running) flag and the remote's badge turns Online.

5

Point the port at the second router

The tunnel now reaches your MikroTik on port 8090. This NAT rule forwards it to the downstream router. Open New Terminal and paste, replacing the router IP/port with your own:
MikroTik Terminal
/ip firewall nat add chain=dstnat protocol=tcp \
    in-interface=mikrouter-l2tp-mr-8x3k9p dst-port=8090 \
    action=dst-nat to-addresses=192.168.88.2 to-ports=80 \
    comment="mikrouter 2nd router"
FieldValue
in-interfacemikrouter-l2tp-…
dst-port8090
to-addresses192.168.88.2
to-ports80

Prefer the menus? Go to IP›Firewall›NAT and add the same values on the General and Action tabs.

If the page still won't load

The downstream router's gateway must be this MikroTik so its replies find their way back. If it points elsewhere, add a source-NAT so the traffic appears to come from the router:
MikroTik Terminal
/ip firewall nat add chain=srcnat dst-address=192.168.88.2 action=masquerade comment="mikrouter 2nd router return"
6

Open the router from anywhere

That's it. From any device, open a browser and go to your Remote URL:
FieldValue
Addresshttp://ph1.mikrouter.com:44541
http://ph1.mikrouter.com:44541
R

Router Admin

Web management

admin
••••••
Log In

Sign in with the downstream router's own username and password — not your MikroTik or MikRouter login.

Is the second device a MikroTik too?

Then you can reach its Winbox the same way: set the NAT rule's to-ports to 8291 instead of 80, then open Winbox and connect to ph1.mikrouter.com:44541.

Troubleshooting

Remote shows “Offline” in the dashboard

  • The VPN client isn't connected — recheck step 4 (username, password, server address).
  • Make sure your ISP isn't blocking the protocol; try SSTP (port 443) if L2TP won't connect.
  • Confirm the subscription hasn't expired.

Online, but the browser page times out

  • Check the NAT rule from step 5 — dst-port must equal your Service Port (8090), and to-addresses/to-ports must match the router.
  • From New Terminal run /ping 192.168.88.2 to confirm the MikroTik can reach the router.
  • If ping works but the page doesn't load, add the srcnat masquerade rule from step 5.

Page loads but won't log in

  • Use the downstream router's own admin credentials, not your main router or MikRouter login.
  • If it only serves HTTPS, try https:// and set the NAT to-ports=443.

Quick recap

  1. Buy a remote — set Service Port = Other (8090, TCP).
  2. Copy the credentials & Remote URL from the detail page.
  3. Create the VPN client on the main MikroTik (paste the Quick Setup command).
  4. Add one NAT rule forwarding port 8090 → the second router's IP:80.
  5. Browse to ph1.mikrouter.com:44541 — you're on the router.