MikroTik WinBox vs WebFig: Which RouterOS GUI to Use, and When
WinBox 4 is native on Windows, macOS and Linux and can reach a router by MAC address. WebFig needs only a browser and TCP 443. Which one fits your MikroTik workflow, and how to lock both down.
The MikroTik WinBox vs WebFig question used to be settled by your operating system: WinBox was a Windows binary, so Mac and Linux users ran it under Wine or lived in the browser. That argument is gone. WinBox 4 is a native application for Windows, Linux and macOS, and the download page currently offers v4.3 (released July 20, 2026) for Windows 64-bit and arm64, macOS universal and Linux 64-bit, with no 3.x build listed. What still separates the two tools is Layer 2 reach, how many windows you can keep open, and which TCP port you end up exposing.
Bottom line: use WinBox 4 for daily administration, keep WebFig enabled over HTTPS as the no-install fallback, and treat both as management services that belong behind the firewall, never on the WAN.
The short comparison
| WinBox 4 | WebFig | |
|---|---|---|
| What it is | Native desktop app | Web UI served by the router |
| Platforms | Windows (64-bit, arm64), macOS (universal), Linux (64-bit) | Any browser |
| Transport | TCP 8291 (winbox service) | TCP 80 (www) or TCP 443 (www-ssl) |
| Layer 2 reach | Yes, MAC session via neighbor discovery | No, IP only |
| Encryption | Built in: ECSRP key exchange, AES128-CBC-SHA | TLS only after www-ssl gets a certificate |
| Window model | Tabbed work area plus workspaces | Single page |
| RoMON | Connect through a RoMON agent | No equivalent |
| Feature coverage | Mirrors the console menu for menu | ”Nearly all RouterOS features” per the manual |
Where WinBox wins
MAC sessions are the recovery path. The Neighbors tab lists MikroTik devices on the local broadcast domain and connects by MAC address instead of IP. That is what gets you back in after a bridge or VLAN change leaves the router with no reachable address, the failure mode covered in VLAN filtering on RouterOS bridges. WebFig, as one forum regular put it, is “Layer3/4 / IP only”. Two caveats from the manual: a MAC session “uses network broadcasts and is not 100% reliable,” so use an IP whenever you have one, and MAC connections need an unfragmented MTU of 1500. On Windows, a (port 20561) timed out error means file and print sharing is disabled on the client.
Multiple windows. WinBox 4 opens each menu as a tab, and workspaces (which replaced the v3 sessions) keep a separate set of connections and windows per environment. Firewall filter, connection tracking and the log side by side is how you actually debug a rule. WebFig is a single page.
RoMON. The launcher can connect through a RoMON agent to a router with no Layer 3 path to you, which matters on a stack of CRS switches where only one box carries a management address.
Encryption without a certificate. WinBox is signed with an Extended Validation certificate, uses ECSRP for key exchange and authentication, verifies the password on both sides so a man-in-the-middle cannot impersonate the router, and encrypts with AES128-CBC-SHA. No PKI on your side.
Live graphs and drag-and-drop. Real-time traffic on any interface, queue or firewall rule, and .npk packages or backups dropped straight into the window.
Where WebFig wins
Zero install. A phone, a tablet, a locked-down corporate laptop that will not run an unsigned binary, or a jump host with only a browser. WebFig serves the same layout from 192.168.88.1 on a fresh device.
Standard TLS. Once www-ssl has a certificate, WebFig is ordinary HTTPS on 443 that browser trust stores and corporate policy already understand. The WebFig manual covers both paths: a self-signed certificate for LAN-IP access (public CAs will not issue for 192.168.88.1), or Let’s Encrypt through the built-in ACME client when you reach the router by a public name. The DNS-01 challenge for IP Cloud <id>.sn.mynetname.net names needs no inbound WAN port, and certificates renew automatically at 80 percent of validity.
Skins. WebFig Design Skin can hide menus, rename fields, mark items read-only and limit values, useful for handing a client a reduced interface. Building one needs the policy and sensitive permissions, and the manual is explicit that skins are “not a security feature.” User group policy is the control.
A terminal in the corner. The CLI in WebFig’s top-right corner provides the same functionality as WinBox’s New Terminal, so you are never stuck with only the forms.
The WinBox 4 transition
MikroTik announced WinBox 4 on August 29, 2024 as a first public beta, rebuilt “from zero,” with dark mode and a minimum RouterOS version of 6.43. Early builds lacked keyboard shortcuts, hover help, skins and LTE graphs; by v4.3 the shortcut table is documented (Ctrl+E enables an item, Ctrl+Shift+E disables it, Alt or Cmd+T opens a terminal). One community observation is worth planning around: new RouterOS features tend to land in the CLI first, then WinBox, then WebFig some time later. If a fresh 7.x feature is missing from WebFig, check the terminal before assuming it does not exist. Since RouterOS 7.17 the same thread notes that “webfig looks nearly identical to winbox4,” so layout is no longer a reason to pick one.
Ports, exposure and locking both down
Every management tool is a listening service, and the Services manual lists them: ftp 21, ssh 22, telnet 23, www 80, www-ssl 443, winbox 8291, api 8728, api-ssl 8729. Port 8291 also carries the MikroTik smartphone app and The Dude, so restricting it affects those too.
Each service has an address property that takes IPv4 and IPv6 prefixes. Read the wording carefully: when set, “packets are not dropped at the network level, but access to the service is denied for sources not matching the specified addresses.” The socket still answers. MikroTik’s own line is “to block access from external or untrusted networks, we recommend using a Firewall instead.” Do both: restrict the service and keep the input-chain drop for the WAN interface list that the default configuration already provides.
A reasonable baseline for a home or small-office box:
/ip/service/set winbox address=192.168.88.0/24,10.10.0.0/24
/ip/service/set www-ssl certificate=WebFig disabled=no tls-version=only-1.2
/ip/service/set www disabled=yes
/ip/service/set telnet,ftp,api disabled=yesThe WebFig certificate name comes from the manual’s self-signed example. Disabling www after www-ssl works means credentials never cross the LAN in clear text.
MAC WinBox answers on Layer 2 regardless of IP configuration, so MikroTik’s hardening guidance recommends /tool mac-server mac-winbox set allowed-interface-list=none on production networks; a dedicated management interface list is the middle path. The wider first-boot sequence is in securing a new RouterOS box. Exposed router management ports are a recurring subject in general security news, and techsentinel.news tracks that beat.
For remote management, bring the router into a WireGuard tunnel first and restrict 8291 and 443 to the tunnel’s subnet. Port-forwarding either service from the WAN is the mistake the address property was never designed to cover.
What you actually need
- Home lab, one hEX S or RB5009: WinBox 4 daily. Enable
www-sslwith a self-signed certificate, disablewww, keep WebFig as the phone fallback. - Small-business admin, several sites: WinBox with the Managed list and one workspace per client. RoMON for Layer 2 islands. WireGuard in, then 8291 scoped to the tunnel prefix.
- Handing a client limited access: WebFig with a skin, a restricted user group, and
www-sslonly. - Locked-down workstation, no binaries: WebFig over 443 with a Let’s Encrypt certificate on a real name and split-horizon DNS pointing it at the LAN address.
Things to test before you call it done
nc -zv 192.168.88.1 8291
nc -zv 192.168.88.1 80
curl -kI https://192.168.88.1/
openssl s_client -connect 192.168.88.1:443 -tls1_2 </dev/null 2>/dev/null | head -5The first should succeed, the second should be refused, the third should return a header over TLS, and the fourth should show the certificate you assigned. From outside, nmap -p 80,443,8291 <wan-ip> should report all three as filtered. On the router, /ip/service/print and /tool/mac-server/mac-winbox/print should match what you intended, not what shipped.
Related across the network
- Portainer: The Best GUI for Managing Docker on Your Homelab — dockerhomelab.com
- Best Homelab Firewall in 2026: OPNsense, pfSense, UniFi, MikroTik — firewallcompare.com
- pfSense Alternatives: 7 Platforms Compared for 2026 — firewallcompare.com
- Best Filament for Beginners: What to Buy First — 3dfilamentguide.com
- Filament Density: Convert Spool Weight to Length — 3dfilamentguide.com
Sources
Related
RouterOS Firewall Rules Explained: Chains, Connection State, and the Default Rule Set Line by Line
RouterOS firewall rules explained from the packet's point of view: which chain it lands in, why first match wins and no match means accept, what connection-state actually tracks, and what every defconf rule and FastTrack are doing.
How to Update RouterOS v6 to v7: The Two-Step Path, Backups, and What the Converter Breaks
Upgrading RouterOS v6 to v7 is a forced stop at 7.12.1, a RouterBOOT reboot after each hop, and a config converter that rewrites OSPF, BGP and routing filters. Here is the order to do it in.
MikroTik WireGuard VPN Configuration on RouterOS 7: Interface, Peers, Allowed-Address and the Firewall Rule
A MikroTik WireGuard VPN configuration in packet order: interface and keys, peer and allowed-address, address and route, the input rule that must sit above the defconf drop, then the road-warrior and site-to-site variants and the tests that prove the tunnel.