MAC Server Configuration

MAC Server Configuration

Version Info

RouterOS 7.16 | Min: v6.0+ | ⏱️ 5 minutes | 🟢 Beginner

Tested on: 7.16 7.14

Version-specific notes

• v7.22: Added interface parameter for MAC-Telnet client
• v6.x: Same commands work on RouterOS 6.x

TL;DR (Quick Start)

For the impatient: restrict MAC access to LAN interfaces only for security.

/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN
/tool mac-server ping set enabled=no

Verify with:

/tool mac-server print
/tool mac-server mac-winbox print

Overview

What this does: MAC Server provides Layer 2 management access to RouterOS without requiring IP configuration. It includes MAC-Telnet (CLI), MAC-Winbox (GUI), and MAC Ping services. This is essential for initial router setup or recovery when IP connectivity is unavailable.

When to use this:

• Initial router configuration before IP is set
• Recovery when IP configuration is broken
• Accessing routers in unknown network state
• Emergency management access on trusted networks

Prerequisites:

• Direct Layer 2 connectivity (same broadcast domain)
• Winbox application (for MAC-Winbox)
• Another MikroTik router (for MAC-Telnet between routers)

MAC Server Services

Service	Purpose	Access Method
MAC-Telnet	Command-line access	Another MikroTik or Linux client
MAC-Winbox	Graphical Winbox access	Winbox application
MAC Ping	Respond to MAC-level pings	MAC ping utility

Configuration Steps

Step 1: Check Current Configuration

View current MAC server settings.

/tool mac-server print
/tool mac-server mac-winbox print
/tool mac-server ping print

Default output:

allowed-interface-list: all

By default, MAC access is enabled on all interfaces, including WAN.

Step 2: Create Management Interface List

Create an interface list for trusted management interfaces.

/interface list add name=MGMT
/interface list member add list=MGMT interface=bridge

Step 3: Restrict MAC-Telnet

Limit MAC-Telnet to management interfaces only.

/tool mac-server set allowed-interface-list=MGMT

Step 4: Restrict MAC-Winbox

Limit MAC-Winbox to management interfaces only.

/tool mac-server mac-winbox set allowed-interface-list=MGMT

Step 5: Disable MAC Ping (Optional)

Disable MAC ping responses for additional security.

/tool mac-server ping set enabled=no

Step 6: Verify Configuration

Confirm settings are applied.

/tool mac-server print
/tool mac-server mac-winbox print

Expected output:

allowed-interface-list: MGMT

Common Scenarios

Scenario: Use Default LAN List

Most default configurations include a “LAN” interface list:

/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN

Scenario: Disable MAC Access Completely

For maximum security in production environments:

/tool mac-server set allowed-interface-list=none
/tool mac-server mac-winbox set allowed-interface-list=none
/tool mac-server ping set enabled=no

Scenario: Allow on Specific Interfaces

Enable MAC access only on specific physical ports:

/interface list add name=mac-access
/interface list member add list=mac-access interface=ether1
/interface list member add list=mac-access interface=ether2

/tool mac-server set allowed-interface-list=mac-access
/tool mac-server mac-winbox set allowed-interface-list=mac-access

Scenario: Connect via MAC-Telnet

From another MikroTik router, connect using MAC address:

/tool mac-telnet B8:69:F4:7F:F2:E7

Specify interface (v7.22+):

/tool mac-telnet B8:69:F4:7F:F2:E7 interface=ether1

Scenario: Scan for MAC-Accessible Devices

Discover routers on the network:

/tool mac-scan ether1

Expected output:

MAC-ADDRESS       ADDRESS   AGE
B8:69:F4:7F:F2:E7 0.0.0.0   3
4C:5E:0C:12:34:56 0.0.0.0   5

Scenario: Connect via Winbox (MAC)

1. Open Winbox
2. Click “Neighbors” tab
3. Select router by MAC address
4. Enter credentials and click “Connect”

Verification

Check 1: Verify MAC-Telnet Settings

/tool mac-server print

Expected: Shows restricted allowed-interface-list.

Check 2: Verify MAC-Winbox Settings

/tool mac-server mac-winbox print

Expected: Shows restricted allowed-interface-list.

Check 3: Test MAC Connection

From Winbox Neighbors tab, verify router appears only when connected to allowed interface.

Troubleshooting

Symptom	Cause	Solution
Cannot connect via MAC-Winbox	MAC-Winbox restricted	Check allowed-interface-list includes your interface
Router not in Winbox Neighbors	Different broadcast domain	Ensure Layer 2 connectivity (same VLAN/switch)
“Could not connect” error	Service disabled	Set allowed-interface-list to include interface
Windows can’t find router	File and Print Sharing disabled	Enable in Windows network settings
MAC-Telnet works, Winbox doesn’t	Different services	Configure both MAC-Telnet AND MAC-Winbox
Connection drops immediately	Version mismatch	Update Winbox and RouterOS
Multiple NICs cause issues	Wrong adapter used	Disable unused network adapters

Security Considerations

• MAC access bypasses IP firewall - Layer 2 traffic is not filtered by /ip firewall
• Default enables on ALL interfaces - Including WAN, which is dangerous
• No IP-based access control - Any device on same L2 segment can attempt connection
• Always restrict to trusted interfaces - Never allow MAC access on public/WAN interfaces
• Consider disabling in production - Use IP-based access (SSH, Winbox over IP) instead

Community Tips

Windows Connection Issues: For reliable MAC-Winbox connections on Windows:

1. Enable “File and Print Sharing”
2. Disable unused network adapters
3. Temporarily disable antivirus/firewall if connection fails
4. Ensure MTU is 1500 (fragmentation breaks MAC packets)

Emergency Access: If you lock yourself out via IP, MAC access can save you - but only if:

• You’re on the same L2 segment as an allowed interface
• MAC server wasn’t disabled on that interface

IP Services vs MAC Server: Disabling services in /ip service does NOT disable MAC access. Both must be configured separately:

• /ip service controls IP-based access (SSH, Telnet, Winbox over IP)
• /tool mac-server controls Layer 2 MAC-based access

Related Topics

Management Access

• IP Services - IP-based management (SSH, WinBox, API)
• User Management - authentication for all access
• SSH - secure shell access

Network Discovery

• IP Neighbors - neighbor discovery protocols
• RoMON - remote management overlay network

Security

• Firewall Basics - protect management access
• Firewall Address Lists - restrict access by IP

Reference

• MikroTik MAC Server Documentation
• MikroTik Securing Your Router

Properties Reference

Property	Type	Default	Description
allowed-interface-list	string	all	Interface list where service is enabled

Special values:

• all - Service on all interfaces (insecure default)
• none - Service completely disabled
• listname - Service only on interfaces in specified list

MAC Ping Properties

Property	Type	Default	Description
enabled	yes/no	yes	Enable MAC ping responses

Command Reference

Command	Description
/tool mac-server set	Configure MAC-Telnet server
/tool mac-server print	Show MAC-Telnet settings
/tool mac-server mac-winbox set	Configure MAC-Winbox server
/tool mac-server mac-winbox print	Show MAC-Winbox settings
/tool mac-server ping set	Configure MAC Ping
/tool mac-server ping print	Show MAC Ping settings
/tool mac-telnet <MAC>	Connect to remote router via MAC
/tool mac-scan <interface>	Scan for MAC-accessible devices