I've shared some security best practices on a recent blog post if you want some tips.

You should definitely spend some time and effort hardening the VPN concentrator.I talked at a MUM a few years ago exactly on this topic - watch it here! You can do this in AWS, Azure, Google cloud or a slew of other cloud platforms, not to mention physical hardware in your own Data Center, if you have one. Spin up a VPN concentrator and provision/commission it.So first off, what's it take to get remote WinBox access similar to what you can do with our dashboard? Here's a quick summary for the DIY'ers out there: With RemoteWinBox it's way less work, way less headache.' Evan says, 'it's a lot of work and effort to turn up a VPN concentrator, keep it secure and maintain servers. We wanted to take a minute to talk about the use case here, describe the problem and share what's going on with our solution. How can I do my own Remote WinBox access? Here's a visual of how RemoteWinBox punches through LTE

My next blog post will probably be about how to use RemoteWinBox and passthrough mode to remove a layer of NAT for the customer, but still be able to use WinBox remotely. We hear that a lot of you out there use MikroTik SXT or WAP modem + routers. Ultimately, the issue is that when NAT is involved, using WinBox from the WAN becomes hard, and using WinBox from the LAN requires being on site! In other cases, some operators use their own LTE equipment which can only run in NAT mode (looking at you, Baicells), resulting in the same limitation. And good luck getting a tier 1 carrier to give you a port forward over a SIM card! So if you're using another carriers SIM, your MikroTik LTE router/modem will probably receive an RFC1918 IP address in the 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16 range. In addition, they're likely to be leveraging CG-NAT (Carrier Grade NAT) and your modem's public IP will likely change often. But, in the inbound traffic direction, without a port forward there's not really and good way to access services behind the NAT. What's wrong with NAT? Nothing too bad, really in the outbound direction. In particular, some of the carriers like AT&T, Verizon and T-mobile will provide service to your modem by using NAT (Network Address Translation). 'RemoteWinBox has saved us countless hours and it's been a life saver' - Evan Feldman. So we talked to Evan Feldman at West Michigan Communications who told us that he found out about us on a Reddit thread about how to access WinBox through NAT and he says that he loves the RemoteWinBox service and uses it with his LTE customers.

We have been wondering if RemoteWinBox was a good fit for LTE.

Winbox remote access