Login
Contact Us
View Categories

SSH Tunneling Through a MikroTik to Access Phones UI

AI Doc Summarizer Doc Summary

📌 Purpose #

This document explains how to use an SSH tunnel through a MikroTik router to access the web interface of devices located on an internal network that is not directly reachable from the local computer.

Common use cases include:

  • Yealink phones
  • Poly phones
  • Grandstream phones
  • PBXs
  • Managed switches
  • Firewalls
  • Network appliances

Network Overview #

In this scenario:

  • The remote computer can connect to the MikroTik router via SSH.
  • The target device is located on an internal network.
  • Direct access to the device’s web interface is not possible.
  • An SSH tunnel is used to securely forward web traffic through the MikroTik.

Example topology:

Remote Computer
      |
      | SSH Tunnel
      |
MikroTik Router
      |
      | Internal Network
      |
Target Device

🔧 Requirements #

Before proceeding, obtain:

  • MikroTik IP address
  • MikroTik SSH username
  • MikroTik SSH password or SSH key
  • IP address of the target device
  • Confirmation that the web interface is enabled

Step 1: Verify Connectivity from the MikroTik #

Connect to the MikroTik using PuTTY.

Verify that the MikroTik can reach the target device:

ping <Device_IP>

Example:

ping 192.168.100.50

If the device does not respond, verify routing, VLAN configuration, and firewall rules before continuing.

Step 2: Configure the SSH Tunnel #

Open PuTTY and configure:

  • Host Name: MikroTik IP
  • Port: 22
  • Connection Type: SSH

Navigate to:

Connection > SSH > Tunnels

HTTP Web Access (Port 80) #

If the device uses HTTP:

Source Port

8080

Destination

192.168.100.50:80

Click Add.

You should see:

L8080 192.168.100.50:80

Return to the Session page and connect to the MikroTik.

HTTPS Web Access (Port 443) #

If the device uses HTTPS:

Source Port

8443

Destination

192.168.100.50:443

Click Add.

You should see:

L8443 192.168.100.50:443

Connect to the MikroTik.

Step 3: Access the Device #

HTTP Example #

Open a web browser and navigate to:

http://127.0.0.1:8080

HTTPS Example #

Open a web browser and navigate to:

https://127.0.0.1:8443

The connection will be securely forwarded through the MikroTik to the target device.

✅ Common Port Examples #

ServiceDevice PortLocal Tunnel Port
HTTP Web Interface808080
HTTPS Web Interface4438443
SSH222222
Alternate HTTP Service80808081

Note: The local tunnel port can be any unused port on your computer. It does not need to match the destination port.

⚠️ Troubleshooting #

Browser Cannot Connect #

Verify:

  • The SSH tunnel is active
  • The device IP address is correct
  • The web service is enabled on the device
  • The MikroTik can reach the device

Tunnel Connects but Page Does Not Load #

Verify:

  • Correct destination port (80 or 443)
  • Firewall rules allow access
  • VLAN routing is functioning properly

Certificate Warning #

When using HTTPS, a certificate warning may appear if the device uses a self-signed certificate. This is expected in many internal network environments.

📝 Summary #

SSH tunneling allows technicians to securely access web interfaces on devices located behind a MikroTik router without requiring direct network access. This method is commonly used for managing phones, PBXs, switches, and other network equipment on isolated VLANs or internal subnets.

📌 Purpose #

This document explains how to use an SSH tunnel through a MikroTik router to access the web interface of devices located on an internal network that is not directly reachable from the local computer.

Common use cases include:

  • Yealink phones
  • Poly phones
  • Grandstream phones
  • PBXs
  • Managed switches
  • Firewalls
  • Network appliances

Network Overview #

In this scenario:

  • The remote computer can connect to the MikroTik router via SSH.
  • The target device is located on an internal network.
  • Direct access to the device’s web interface is not possible.
  • An SSH tunnel is used to securely forward web traffic through the MikroTik.

Example topology:

Remote Computer
      |
      | SSH Tunnel
      |
MikroTik Router
      |
      | Internal Network
      |
Target Device

🔧 Requirements #

Before proceeding, obtain:

  • MikroTik IP address
  • MikroTik SSH username
  • MikroTik SSH password or SSH key
  • IP address of the target device
  • Confirmation that the web interface is enabled

Step 1: Verify Connectivity from the MikroTik #

Connect to the MikroTik using PuTTY.

Verify that the MikroTik can reach the target device:

ping <Device_IP>

Example:

ping 192.168.100.50

If the device does not respond, verify routing, VLAN configuration, and firewall rules before continuing.

Step 2: Configure the SSH Tunnel #

Open PuTTY and configure:

  • Host Name: MikroTik IP
  • Port: 22
  • Connection Type: SSH

Navigate to:

Connection > SSH > Tunnels

HTTP Web Access (Port 80) #

If the device uses HTTP:

Source Port

8080

Destination

192.168.100.50:80

Click Add.

You should see:

L8080 192.168.100.50:80

Return to the Session page and connect to the MikroTik.

HTTPS Web Access (Port 443) #

If the device uses HTTPS:

Source Port

8443

Destination

192.168.100.50:443

Click Add.

You should see:

L8443 192.168.100.50:443

Connect to the MikroTik.

Step 3: Access the Device #

HTTP Example #

Open a web browser and navigate to:

http://127.0.0.1:8080

HTTPS Example #

Open a web browser and navigate to:

https://127.0.0.1:8443

The connection will be securely forwarded through the MikroTik to the target device.

✅ Common Port Examples #

ServiceDevice PortLocal Tunnel Port
HTTP Web Interface808080
HTTPS Web Interface4438443
SSH222222
Alternate HTTP Service80808081

Note: The local tunnel port can be any unused port on your computer. It does not need to match the destination port.

⚠️ Troubleshooting #

Browser Cannot Connect #

Verify:

  • The SSH tunnel is active
  • The device IP address is correct
  • The web service is enabled on the device
  • The MikroTik can reach the device

Tunnel Connects but Page Does Not Load #

Verify:

  • Correct destination port (80 or 443)
  • Firewall rules allow access
  • VLAN routing is functioning properly

Certificate Warning #

When using HTTPS, a certificate warning may appear if the device uses a self-signed certificate. This is expected in many internal network environments.

📝 Summary #

SSH tunneling allows technicians to securely access web interfaces on devices located behind a MikroTik router without requiring direct network access. This method is commonly used for managing phones, PBXs, switches, and other network equipment on isolated VLANs or internal subnets.

What are your Feelings

Moshe Rosenberg

CEO

Moshe leads the team
Dataphone’s fearless leader, Moshe oversees all operations with a hands-on approach. He is passionate about coming up with new solutions in the field of VoIP and implmeenting new technology that keeps Dataphone a step ahead. The precursor to Dataphone, Data Day, gave Moshe a strong background in ERP Implementation.

Moshe always stays focused on the big picture and actively searches for new and improved solutions. The most important thing to him is simplifying his customers' workflow. When Moshe isn’t at work, he’s enjoying time with his family, or learning about new updates in the world of technology.

Ahron Greenberg

CTO

Ahron sees the big picture
As CTO of Dataphone, Ahron oversees the software design and implements new technologies for the company. He guides us on broadening the company’s scope, making new services accessible to Dataphone customers. He is the expert at defining our process of architecting failovers, and our customers rely on his ingenious solutions. He guides the software team in VoIP and development with patience, leadership, and skill.

On top of his skills at coding, problem-solving, and debugging, he’s an exceptional communicator. With years of experience, including 3 at Dataphone, Ahron brings a wealth of knowledge and expertise to the team.

Ahron spends his spare time with his family, learns about new technologies, and actively contribute to open-source projects, fostering innovation beyond the workplace.

Maqsood Ahmed

Full Stack Developer

Maqsood crafts the code
As a Full-stack developer at Dataphone, Maqsood tackles both backend and frontend development.. Maqsood’s excellent performance at Dataphone is driven by his love of learning new things.

Having worked over four years as a full stack developer in other companies before joining the Dataphone team, Maqsood appreciates the collaboration and teamwork that his job involves.

Beyond coding, Maqsood unwinds by watching movies and spending quality time with family. Weekends might find him taking small trips and trekking adventures.

Erick Orellana

Customer Onboarding Specialist

Erick sets you up for success
Erick handles onboarding for new clients at Datphone, walking them through the entire process and ensuring seamless transitions. With his meticulous management, problem-solving prowess, and attention to detail, he’ll aim to get you up and running with little to no downtime. Erick has worked in customer and tech support with many companies, including Dell, Sony, and Google, netting him over 15 years of experience. Clients appreciate Erick's personalized attention and commitment to their satisfaction.

When not helping customers, Erick enjoys family time with his two teenagers, playing basketball, and beating his record in video games. People are often surprised to learn that under his calm nature lies a passionate Heavy Metal fan!

Omar O.

VoIP Support Specialist

Omar solves your headaches!
Omar is our tech support expert at Dataphone, helping customers with migration, deployment, and installation for the past three years. Formerly at Google Tech Support and other phone service companies, Omar brings eight years of technical experience in networks, servers, and phone service to his job.

Known for his fast but meticulous approach and customer-oriented style, clients value Omar for his familiarity with their setups and his commitment to earning their satisfaction with prompt, effective solutions. Omar always makes sure to test every setup he creates, ensuring they are error-free. He’s also a true team player who gladly lends a hand to his colleagues, and treats their clients like his own.

Outside work, Omar enjoys family time, hitting the gym, and watching classics.

Manny Portillo

Tech Support Specialist

Manny gets you sorted!
Manny provides tech support for customers and has a rapport with many of them. When clients call, they appreciate reaching a knowledgeable professional who understands their needs and resolves their issues promptly. With prior experience at Google Tech Support, Manny brings efficiency and a no-nonsense approach to problem-solving.

Most satisfying to Manny is collaborating with his colleagues and working as a team. He loves to give his clients the royal treatment, creating loyal repeat customers.

When not busy solving issues and helping customers, you’ll find Manny taking care of his daughter and sharing his love of tech with her. He also enjoys music and movies and hanging out at the park.