MikroTik at Home

Two MikroTik routers at home: a neglected hAP ac3 audited and hardened in one night, then ad blocking in a container on a hAP ax3.

A MikroTik hAP ac3 that had been running fine, which was the problem. A read-only audit, a WireGuard server and the iPhone camera that wanted to search for its private key, AllowedIPs mistaken for access control, a torrent client whose RPC is remote code execution by design, a port-forward blamed on CGNAT that was a one-digit typo. Then a hAP ax3 running blocky in a RouterOS container: no Pi-hole and no separate box, a DNS trick against client DoH bypass, and the six places where RouterOS containers use Docker's words with different meanings. Last, the rest of that first night on the ac3: the hardening done over the same SSH session it could have cut. 8 posts.

1. The router had been running fine, which was the problem
2. The iPhone camera wanted to Google my private key
3. AllowedIPs is not access control
4. Transmission is a remote-code-execution box by default
5. It wasn't CGNAT. It was a one-digit typo.
6. 572,000 domains and the router barely notices
7. Six gotchas deep in RouterOS containers
8. Hardening the box you're logged in through