MikroTik Remote Access.
No Public IP or Port Forwarding Required.

The platform operates through an outbound encrypted WireGuard reverse tunnel. When you register a router in your dashboard, our cloud server reserves an isolated tunnel IP (10.8.0.x) and assigns a dedicated triplet of high-range external ports for your services (e.g. WinBox 20001, WebFig 20002, and REST API 20003).

You paste our generated 5-line script into your MikroTik Terminal. Your router initiates an outbound UDP handshake directly to our gateway (router.jasdes.com:51820). Our gateway's Linux kernel then uses iptables NAT forwarding to redirect any traffic reaching your assigned port directly down the WireGuard tunnel to your router. Because the connection is outbound from your router, upstream firewalls, missing public IPs, and NAT barriers are completely bypassed.

Mobile network operators (Safaricom, Airtel) and satellite providers (Starlink) place subscriber routers behind Carrier-Grade NAT (CGNAT) using private RFC 6598 addresses (100.64.0.0/10), where incoming connections from the Internet are impossible to forward.

Our system solves this by establishing a secure outbound WireGuard connection from your router to our cloud gateway. Even if the cell tower rotates, your dynamic IP changes, or Starlink switches ground stations, built-in roaming automatically maintains your active WinBox and WebFig sessions without interruption.

You do not need to use clunky in-browser HTML5 virtual desktops. You run your normal desktop WinBox application (v3 or v4 for Windows, macOS, or Linux) directly on your workstation:

1. Open native WinBox on your computer.
2. In the Connect To box, enter your assigned gateway address and port: e.g. router.jasdes.com:20001.
3. Enter your normal MikroTik administrator username and password.
4. Click Connect. Traffic flows over the encrypted tunnel with full native protocol speed and sub-millisecond responsiveness.

Exposing default ports (WinBox 8291, WebFig 80/443, or SSH 22) directly on your public WAN IP exposes your router to automated botnet scanners, brute-force dictionary attacks, and RouterOS zero-day exploits (such as CVE-2018-14847).

Our architecture requires zero open incoming WAN ports. Your standard MikroTik firewall rule (chain=input action=drop in-interface-list=WAN) remains 100% active. Only authenticated, 256-bit ChaCha20-Poly1305 encrypted traffic originating from the WireGuard tunnel interface can reach your management services. Your router remains completely dark and invisible to external WAN port scanners.

Yes. Every registered router receives individual dedicated external ports for all major RouterOS management interfaces:

• WebFig: Open your web browser directly to http://router.jasdes.com:<web_port>.
• SSH & Terminal Console: Run ssh -p <ssh_port> admin@router.jasdes.com for instant CLI scripting.
• RouterOS v7 REST API: Direct HTTP/JSON endpoint at <api_port> for Prometheus telemetry, custom billing daemons, or Ansible automation playbooks.

WireGuard is completely stateless and integrated natively into the RouterOS v7 kernel. Unlike legacy PPTP, L2TP, or SSTP connections that suffer from daemon crashes, hanging sessions, or stale TCP timeouts, WireGuard requires no session renegotiation.

The instant power is restored or the cellular ISP reconnects, the router dispatches an authenticated packet and the tunnel is live within milliseconds. Your dashboard automatically detects the link, updates the device status to 'Online', and starts tracking millisecond latency.

Every new account receives an instant 3-Day Free Testing Trial with zero credit card required and all features unlocked. For ongoing connectivity, you can activate flexible tiers:

• 1 Month Standard: KES 110 (30 days of remote access & nightly backups).
• 6 Months Saver: KES 600 (Save KES 60 on extended connectivity).
• 1 Year Pro: KES 1,150 (Best value annual peace of mind).

Payments are processed in real time via Safaricom M-Pesa STK Push directly to your phone. Instant payments, router configurations and access — renewals seamlessly extend your connection without changing your assigned ports or requiring script reconfiguration.