// REFERENCE · PORT 8291 · TCP

Port 8291: MikroTik Winbox

Port 8291 is Winbox, the management port for MikroTik routers.

AT A GLANCE
PORT
8291 / TCP
SERVICE
MikroTik Winbox
ALSO CALLED
winbox
IF EXPOSED
HIGH RISK IF EXPOSED

What runs on port 8291

MikroTik RouterOS devices accept connections from the Winbox configuration app on TCP 8291. It gives full administrative control of the router. MikroTik gear is popular with small ISPs, offices and enthusiasts.

On a home network

MikroTik routers and access points listen on 8291 on the LAN. Other brands do not use it.

If port 8291 is reachable from the internet

Winbox should never be reachable from the internet. A Winbox flaw patched in 2018 let attackers read router credentials, and it was used to hijack large numbers of MikroTik routers, including for injecting cryptomining scripts into web traffic. Exposed MikroTik devices were later recruited into the Meris botnet in 2021. Restrict 8291 to your LAN with a firewall rule and keep RouterOS updated.

How to check whether it is open on your network

In RouterOS, check IP, Services and limit Winbox to your local addresses. RECON's Exposure Check tests whether 8291 answers on your public address.

// RELATED PORTS
2000Cisco SCCP / MikroTik btestTCPMEDIUM RISK IF EXPOSED22SSHTCPMEDIUM RISK IF EXPOSED23TelnetTCPHIGH RISK IF EXPOSED80HTTPTCPLOW RISK IF EXPOSED
ON YOUR PHONE · EXPOSURE CHECK

To find out whether port 8291 is open on something in your home, and whether the internet can reach it, the app scans your Wi-Fi from your phone and checks your public address from the outside. It says what it checked and what it could not. Get RECON for iPhone — one-time purchase, no account, nothing leaves the device.

ALL PORTSPORT LOOKUPSUBNET CALCULATOR
// OTHER TOOLS
Subnet Calculator
IPV4 · IPV6 · CIDR
MAC Vendor Lookup
OUI · MA-L · MA-M · MA-S
Certificate & CSR Decoder
X.509 · PKCS#10 · PEM · DER
DNS Leak Test
VPN · RESOLVER · PRIVACY
DNS Benchmark
CLOUDFLARE · GOOGLE · QUAD9 · 8 RESOLVERS
Port Lookup
TCP · UDP · WHAT IS PORT…
HAR Analyzer
HTTP ARCHIVE
What Is My IP
PUBLIC IP · FINGERPRINT