Which commands restrict Winbox and SSH management access to a specific source network (for example 192.168.0.0/24)?

Which commands restrict Winbox and SSH management access to a specific source network (for example 192.168.0.0/24)?

• A. /ip service set winbox address=0.0.0.0/0; /ip service set ssh address=0.0.0.0/0
• B. /ip service set winbox address=192.168.0.0/24; /ip service set ssh address=192.168.0.0/24
• C. /ip service set winbox address=192.168.1.0/24; /ip service set ssh address=192.168.1.0/24
• D. /ip service set winbox address=0.0.0.0/0; /ip service set ssh address=192.168.0.0/24

Answer: (B)

In MikroTik RouterOS, you control where management traffic can come from by setting the allowed source addresses for each service. The address parameter on /ip service tells the router which source networks are permitted to reach that service. To truly restrict both Winbox and SSH to a specific subnet, you set that subnet on both services. Using 192.168.0.0/24 for both Winbox and SSH ensures only devices in that subnet can access the router’s management interfaces. Why the other options aren’t correct: using 0.0.0.0/0 on either service would allow access from anywhere, removing the restriction. Restricting to a different subnet like 192.168.1.0/24 would not match the intended 192.168.0.0/24. Setting one service to a restricted subnet and leaving the other open would still expose one management channel to all sources.

In MikroTik RouterOS, you control where management traffic can come from by setting the allowed source addresses for each service. The address parameter on /ip service tells the router which source networks are permitted to reach that service. To truly restrict both Winbox and SSH to a specific subnet, you set that subnet on both services. Using 192.168.0.0/24 for both Winbox and SSH ensures only devices in that subnet can access the router’s management interfaces.

Why the other options aren’t correct: using 0.0.0.0/0 on either service would allow access from anywhere, removing the restriction. Restricting to a different subnet like 192.168.1.0/24 would not match the intended 192.168.0.0/24. Setting one service to a restricted subnet and leaving the other open would still expose one management channel to all sources.