Port 8291 (MikroTik Winbox)

MikroTik RouterOS Winbox management.

Registered (user) port, 1024-49151 TCP Remote access Expose only to trusted sources

What port 8291 is used for

MikroTik RouterOS Winbox management.

Security: should port 8291 be open?

Expose only to trusted sources. Exposed Winbox was mass-exploited (CVE-2018-14847) to steal router credentials and build botnets such as Meris. Restrict to management IPs and update RouterOS.

IANA assignment

Port 8291 is in the registered range and has no IANA assignment. The usage above is unofficial but widespread.

Check what is listening on port 8291

Linux: is anything listening on TCP 8291?

sudo ss -tlnp 'sport = :8291'

Linux / macOS: which process owns the port

sudo lsof -nP -i :8291

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':8291 '

Windows (Command Prompt)

netstat -ano | findstr :8291

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 8291 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 8291

From Windows

Test-NetConnection HOST -Port 8291

Allow only trusted sources on port 8291 in the firewall

Replace 203.0.113.10 with the address or network you trust. With ufw, make sure the default incoming policy is deny.

ufw (one trusted source)

sudo ufw allow from 203.0.113.10 to any port 8291 proto tcp

iptables

sudo iptables -A INPUT -p tcp --dport 8291 -s 203.0.113.10 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8291 -j DROP

nftables

sudo nft add rule inet filter input ip saddr 203.0.113.10 tcp dport 8291 accept
sudo nft add rule inet filter input tcp dport 8291 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'TCP 8291 trusted' -Direction Inbound -Protocol TCP -LocalPort 8291 -RemoteAddress 203.0.113.10 -Action Allow

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.