Camouflaging MikroTik from ISP

Goal

Reduce ISP visibility that the connected device is a MikroTik by masking:

• System identity
• DHCP client hostname
• WAN (ether1) MAC address
• Blocking management ports on WAN

Firewall Rule

Drop MikroTik management ports from WAN (ether1):

/ip firewall filter
add chain=input in-interface=ether1 protocol=tcp port=8291,8728,8729 action=drop comment="Block Mikrotik management from ISP side"

Randomization Script

This script:

• Generates a random PC-style name (DESKTOP, LAPTOP, PC, WIN, WORKSTATION + random string)
• Applies it as system identity and DHCP client ID
• Randomizes MAC address on ether1

# --- Settings ---
:local hostnameLength 6
:local pcPrefixes {"DESKTOP";"LAPTOP";"PC";"WIN"}
:local androidPrefixes {"SM-G";"SM-A";"Redmi-Note";"Redmi";"vivo";"oppo";"Realme";"Infinix"}
:local chars "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
:local macChars "0123456789ABCDEF"

# --- Build long string for safe picking ---
:local multiplied ""
:for i from=1 to ((255 + [:len $chars]) / [:len $chars]) do={:set multiplied ($multiplied . $chars)}

# --- Generate pseudo-random hash (like your password generator) ---
/certificate scep-server otp
:local hash ""
:for i from=1 to=(((10 + ($hostnameLength-1)) / 10)) do={:set hash "$hash $([generate minutes-valid=0 as-value]->"password")"}

# --- Generate random hostname string ---
:local randStr ""
:for i from=0 to=(($hostnameLength*2)) step=2 do={
    :set $hex "0x$[:pick $hash $i ($i+2)]"
    :set randStr "$randStr$[:pick $multiplied ($hex)]"
}

# --- Choose style based on first byte of hash ---
:local styleByte "0x$[:pick $hash (4*2) (8*2+2)]"
:local style ([:tonum $styleByte] % 2)

# --- Pick prefix and build hostname ---
:local prefix ""
:if ($style = 0) do={
    :set prefix [:pick $pcPrefixes (([:tonum $styleByte]) % [:len $pcPrefixes])]
} else={
    :set prefix [:pick $androidPrefixes (([:tonum $styleByte]) % [:len $androidPrefixes])]
}

:local newName "$prefix-$randStr"

# --- Generate MAC ---
:local mac ""
:for i from=1 to=6 do={
    :set $hex1 "0x$[:pick $hash (i*2) (i*2+2)]"
    :set mac "$mac:$[:pick $macChars (([:tonum $hex1]+5) % [:len $macChars])]$[:pick $macChars (([:tonum $hex1] +1) % [:len $macChars])]"
}
:set mac [:pick $mac 1 [:len $mac]]

# --- Log result ---
:log warning "[MikroTik] Identity set to $newName , MAC set to $mac"

# --- Apply identity and MAC ---
/system identity set name=$newName
/interface ethernet set ether1 mac-address=$mac

Scheduler

Add to run script at every reboot:

/system scheduler
add name=RandomizeIdentity on-event="(paste script here)" start-time=startup

Behavior

• Each reboot = new MAC, hostname, identity, and DHCP IP
• ISP sees it as a new generic device
• Management ports blocked from WAN