Secure Remote Access Links for MikroTik Devices

Summary When you open a device remotely, MKController creates a temporary link (https://…remote.mkcontroller.net). With the secure access URL on, that link can’t be forwarded: it only opens on the network where it was created, stays tied to the first browser that opens it and expires when its session time runs out — 30 minutes by default, and you choose it. Active connections shows every link that is still open — who created it, from where, how long it has left — and lets you revoke any of them on the spot.

Remote access links are powerful — they open a router’s management interface. The secure access URL makes sure the person who opens the link is the person who asked for it.

When you click to access a device remotely — the WebFig interface of a MikroTik router, for example, even behind CGNAT — MKController generates a unique, temporary link that opens the device through the platform. Each click creates a new link.

The option is off by default and available on every plan. When a company turns it on:

• Same network on the first open. The link only opens, the first time, on the same network where it was generated.
• One browser per link. The first browser that opens the link keeps it. Any other browser is refused — even with the link in hand.
• IP changes are fine. If the IP changes during use (Starlink, mobile networks), access continues in the same browser.
• The session time always applies. The link lasts as long as the session time set for your company, counted from when it was generated. After that, generate a new one from the platform.

Every remote access link expires, with or without the secure access URL. Settings → Security → Remote access → Session time sets how long, for the whole company: 15 or 30 minutes, 1, 2, 4 or 8 hours. The default is 30 minutes.

The clock starts when the link is generated, so a longer time does not extend a link that already exists, and a shorter one applies to the links generated from then on.

1. Go to Settings → Security (company administrators only).
2. Open the Remote access tab.
3. Switch Secure access URL on.

The confirmation tells you when it takes effect: it applies to links opened from now on, and a link already in use can take up to 5 minutes to follow the new rule. Turning it off works the same way.

Every link your team generates stays listed in Settings → Security → Remote access → Active connections for as long as it still works — generated, inside its session time, and not revoked. Open it to see, for each connection:

• the device it opens, with its logo or category icon, and how much time is left;
• who generated it, when, and the IP address the link was created from;
• the connection id, and a Revoke button.

Revoke ends it immediately. The link stops opening and anyone using it is dropped — their page shows the same message as an expired link. To get back in, generate a new remote access.

A refused link opens a page explaining why, in Portuguese and English, with a button to talk to support:

The page says	Why	What to do
This secure access link was already opened in another browser	Someone else — or another browser on the same computer — opened the link first.	Generate a new link and open it in the browser you will use.
This secure access link only opens on the network it was generated from	The first open came from a different network.	Generate the link from the network where you will use it.
We couldn’t verify this access right now	The access couldn’t be confirmed at that moment.	Generate a new link on the same network and try again.

The secure access URL assumes that the person who generates the link is the person who opens it. Keep it off if your team works differently, for example:

• Links created through the MKController API by one system and opened by people elsewhere — the network that counts is the one that created the link.
• People who generate the link on one network and open it on another — at the office VPN and then on a phone over 4G, for instance.

Yes. The network is only checked on the first open. After that, access keeps working in the same browser even if the public IP changes.

Not with the secure access URL on — the first browser keeps the link. Each person generates their own link from the platform.

As long as your company’s session time: 30 minutes by default, and you can set it between 15 minutes and 8 hours in Settings → Security → Remote access. It counts from when the link was generated, so changing the time does not extend a link already created.

Open Settings → Security → Remote access → Active connections, find the connection — the list shows the device, who generated it and the IP it came from — and select Revoke. It stops working right away, and whoever is using it is dropped.

No. It only applies to the remote access links of your company’s devices.

• Single Sign-On (SSO) — sign in with Google or Microsoft Entra ID.
• Active sessions — see who is signed in and revoke access.

Didn’t find what you need? Have questions or feedback? Reach out to MKController Support.

👉 Click here to talk to us.