All Notes
Technology
Developer Utilities
Logging into Your Router from CLI A Practical Guide

A technician inserts a circuit board into a server rack, illustrating technology and connectivity.
A technician inserts a circuit board into a server rack, illustrating technology and connectivity.

Logging into Your Router from CLI A Practical Guide

The Power Beyond the GUI: Why CLI Router Access Matters

For most everyday tasks, your router’s web-based Graphical User Interface (GUI) is perfectly adequate. It’s user-friendly, intuitive, and gets the job done for basic Wi-Fi setup, port forwarding, or checking connected devices. But what happens when you need to delve deeper? When you need to troubleshoot a complex network issue, script automated configurations, or access features simply not exposed in the web interface? That’s where the Command Line Interface (CLI) comes in.

Accessing your router via CLI offers unparalleled control, detailed insights, and the ability to perform actions impossible or cumbersome through a GUI. It’s the language of network engineers and system administrators, providing granular control over routing tables, firewall rules, quality of service (QoS) policies, and much more.

This guide will walk you through the primary methods of logging into your router’s CLI: SSH, Telnet, and Serial Console. We’ll cover the prerequisites, step-by-step instructions for different operating systems, and crucial security considerations.

Essential Prerequisites Before You Begin

Before attempting to log in, ensure you have the following:

  1. Router IP Address: This is usually your default gateway. On Windows, open Command Prompt and type ipconfig. On macOS/Linux, open Terminal and type ip route or netstat -rn. Look for the “Default Gateway” or “gateway” IP address. Common default IPs include 192.168.1.1, 192.168.0.1, or 10.0.0.1.
  2. Router Credentials: You’ll need the router’s username and password. These are often admin/admin, admin/password, or are printed on a sticker on the router itself. If you haven’t changed the default credentials, do so immediately after logging in for security!
  3. CLI Client Software: Depending on your operating system and the connection method, you’ll need specific software.
  4. (Optional) Physical Access: For serial console connections, you’ll need physical access to the router.

Method 1: SSH (Secure Shell) - The Recommended Approach

SSH is the gold standard for secure remote access. It encrypts all communications between your computer and the router, protecting your credentials and data from eavesdropping. Most modern, professional, and prosumer routers (e.g., Cisco, Juniper, Mikrotik, Ubiquiti, OpenWrt-based devices) support SSH. Many basic consumer routers, however, might not.

Why SSH?

  • Security: Encrypts traffic, preventing unauthorized interception.
  • Authentication: Supports password and key-based authentication for stronger security.
  • Integrity: Ensures data isn’t tampered with during transmission.

Checking if SSH is Enabled

You can often check your router’s web GUI under “Administration,” “Security,” or “Remote Management” settings to see if SSH (or “Secure Shell”) is enabled. It typically runs on TCP port 22. If it’s not enabled, you may need to enable it via the web GUI first, or resort to a serial console if direct network access is impossible.

Logging in via SSH

On Linux and macOS (Using OpenSSH Client)

Both Linux and macOS come with the OpenSSH client pre-installed, making this process straightforward.

  1. Open Terminal: Launch your terminal application.
  2. Execute the SSH command: 
    ssh <username>@<router_ip_address>
    Replace <username> with your router’s username (e.g., admin, root, cisco) and <router_ip_address> with your router’s IP (e.g., 192.168.1.1). Example: ssh admin@192.168.1.1
  3. Accept Host Key (First Time): If you’re connecting for the first time, you’ll be prompted to verify the router’s host key fingerprint. Type yes and press Enter to add it to your known_hosts file.
  4. Enter Password: You’ll be prompted for the router’s password. Type it carefully (it won’t echo on the screen) and press Enter.

If successful, you’ll see the router’s command prompt.

On Windows (Using PuTTY)

PuTTY is a popular, free SSH and Telnet client for Windows.

  1. Download PuTTY: Visit the official PuTTY website and download the executable: https://www.putty.org/
  2. Run PuTTY: Double-click the downloaded putty.exe file.
  3. Configure Connection:
    • In the “Session” category, enter your router’s IP address in the “Host Name (or IP address)” field.
    • Ensure “Port” is set to 22 and “Connection type” is set to SSH.
    • (Optional but recommended) In the “Saved Sessions” field, type a name (e.g., “MyRouter”) and click “Save” to easily open this connection in the future.
  4. Open Connection: Click the “Open” button.
  5. Security Alert (First Time): If it’s your first time connecting, you’ll see a “PuTTY Security Alert” about the host key. Click “Accept” to proceed and cache the key.
  6. Enter Credentials: A terminal window will open, prompting you for your username (login as:) and then your password. Enter them and press Enter after each.

You should now be logged into your router’s CLI.

Common SSH Issues

  • “Connection refused”: SSH daemon might not be running on the router, or it’s disabled.
  • “Connection timed out”: Router might be off, unreachable (wrong IP), or a firewall is blocking port 22.
  • “Access denied”: Incorrect username or password.

Method 2: Telnet - The Less Secure Legacy Option

Telnet is an older network protocol for remote CLI access. While simpler to use, it transmits all data, including usernames and passwords, in plain text. This makes it highly vulnerable to eavesdropping and is generally not recommended for secure environments. Use it only if SSH is absolutely unavailable and you understand the security risks, or on a completely isolated network. It typically runs on TCP port 23.

Why Telnet (and Why NOT)?

  • Simplicity: Easy to implement and use.
  • Legacy Support: Found on older networking equipment or very basic consumer routers.
  • NOT Recommended: All data is unencrypted. Anyone sniffing network traffic can steal your credentials and data.

Checking if Telnet is Enabled

Similar to SSH, check your router’s web GUI for “Remote Management” or “Administration” settings. If Telnet is an option, it’s typically disabled by default on modern devices due to security concerns.

Logging in via Telnet

On Linux and macOS (Using Telnet Client)

You might need to install the Telnet client as it’s often not included by default on modern distributions.

  1. Install Telnet Client (if needed):
    • Debian/Ubuntu: sudo apt update && sudo apt install telnet
    • Fedora/RHEL/CentOS: sudo dnf install telnet
    • macOS (Homebrew): brew install telnet (or it might still be pre-installed on older macOS versions).
  2. Open Terminal.
  3. Execute the Telnet command: 
    telnet <router_ip_address>
    Example: telnet 192.168.1.1
  4. Enter Credentials: You’ll be prompted for a username and password.

On Windows (Using Built-in Telnet Client)

The Telnet client is typically present but disabled by default on Windows.

  1. Enable Telnet Client:
    • Go to “Control Panel” -> “Programs” -> “Turn Windows features on or off”.
    • Scroll down and check the box next to “Telnet Client”. Click “OK”.
    • Windows will install the feature.
  2. Open Command Prompt: Type cmd in the Start menu search and open “Command Prompt”.
  3. Execute the Telnet command: 
    telnet <router_ip_address>
    Example: telnet 192.168.1.1
  4. Enter Credentials: You’ll be prompted for a username and password.

Common Telnet Issues

  • “Connection refused” / “Could not open connection”: Telnet server not running on the router, or disabled.
  • “Telnet is not recognized as an internal or external command”: On Windows, you haven’t enabled the Telnet Client feature.
  • Security Concerns: The biggest “issue” with Telnet is its inherent insecurity. Always prioritize SSH.

Method 3: Serial Console - The Out-of-Band Lifeline

A serial console connection is a direct, physical connection to your router’s console port. This method is invaluable for initial setup, troubleshooting when network connectivity is lost (e.g., misconfigured IP addresses, firewall rules that lock you out), or recovering a “bricked” device. It’s often the only way to access the router’s boot loader or perform low-level debugging.

Why Serial Console?

  • Out-of-Band Management: Does not rely on network connectivity, crucial for troubleshooting network issues.
  • Initial Setup: Essential for configuring a router fresh out of the box before network interfaces are up.
  • Recovery: Can access boot menus or recovery modes not available via network protocols.

Hardware Needed

  1. Console Cable:
    • RJ45 to DB9 (Serial): Common for many Cisco, Juniper, and other enterprise routers. One end plugs into the router’s console port (looks like a regular Ethernet port but labeled “Console”), the other into your computer’s DB9 serial port.
    • USB-A to Mini/Micro USB/USB-C: Some newer devices, especially smaller ones like Raspberry Pis or certain consumer routers, might use a standard USB cable for console access.
  2. USB-to-Serial Adapter: If your computer lacks a DB9 serial port (most modern laptops and desktops do), you’ll need a USB-to-Serial adapter. Ensure it comes with the necessary drivers for your OS.

Common Serial Settings

Routers typically use specific serial port settings. The most common are:

  • Baud Rate (Speed): 9600 (most common), 115200 (for faster devices/firmware updates). Check your router’s documentation.
  • Data Bits: 8
  • Parity: None
  • Stop Bits: 1
  • Flow Control: None (or Hardware, if specified by the router).

Logging in via Serial Console

On Linux and macOS (Using minicom or screen)

  1. Connect Cable: Plug the console cable into your router’s console port and your computer’s serial/USB port.
  2. Identify Serial Port:
    • Linux: ls /dev/ttyS* (for built-in serial) or ls /dev/ttyUSB* (for USB-to-serial adapters). It might be /dev/ttyUSB0.
    • macOS: ls /dev/cu.* or ls /dev/tty.*. Look for something like /dev/cu.usbserial-XXXX or /dev/cu.usbmodemXXXX.
  3. Install Client (if needed):
    • minicom: A powerful text-based terminal emulator. Install via package manager (sudo apt install minicom or sudo dnf install minicom).
    • screen: A simpler, often pre-installed utility that can connect to serial ports.
  4. Connect with screen (Quick & Easy): 
    screen <serial_port_path> <baud_rate>
    Example: screen /dev/ttyUSB0 9600
    • To exit screen, press Ctrl+A then k, then y.
  5. Connect with minicom (More Features, Requires Setup):
    • First-time setup: sudo minicom -s
      • Go to “Serial port setup”.
      • Press A to change “Serial Device” to your identified port (e.g., /dev/ttyUSB0).
      • Press E to change “Bps/Par/Bits” to your baud rate (e.g., 9600 8N1).
      • Press F to set “Hardware Flow Control” to No.
      • Save setup as dfl (default). Exit minicom.
    • Connect: minicom (to open with default settings).
    • To exit minicom, press Ctrl+A then X, then yes.
  6. Enter Credentials: You should see the router’s login prompt. Enter your username and password.

On Windows (Using PuTTY or Tera Term)

  1. Connect Cable: Plug the console cable into your router’s console port and your computer’s serial/USB port.
  2. Identify COM Port:
    • Right-click “This PC” (or “My Computer”) -> “Manage” -> “Device Manager”.
    • Expand “Ports (COM & LPT)”. Look for your USB-to-Serial adapter (e.g., “USB Serial Port (COM3)”). Note the COM port number.
  3. Use PuTTY:
    • Open PuTTY.
    • In the “Session” category, select “Serial” as the “Connection type”.
    • Enter the identified COM port (e.g., COM3) in the “Serial line” field.
    • Enter the Baud Rate (e.g., 9600) in the “Speed” field.
    • Click “Open”.
  4. Use Tera Term (Alternative): Tera Term is another popular, free terminal emulator for Windows, often preferred for serial connections.
    • Download Tera Term: https://ttssh2.osdn.jp/
    • Install and run Tera Term.
    • Go to “File” -> “New connection…” or “Setup” -> “Serial port…”.
    • Select your COM port and configure the settings (Baud rate, Data, Parity, Stop, Flow control).
    • Click “OK”.
  5. Enter Credentials: A terminal window will open. You should see the router’s login prompt. Enter your username and password.

Common Serial Console Issues

  • “Unable to open serial port” / “No such device”: Incorrect COM port selected, or the USB-to-Serial adapter drivers are not installed or working correctly.
  • Garbled text / No output: Incorrect baud rate or other serial settings. Double-check your router’s documentation for the correct settings.
  • No response to keyboard input: Check flow control settings.
  • Faulty cable/adapter: Try a different cable or adapter if available.

Basic CLI Commands After Logging In (Vendor-Specific)

Once logged in, the commands you can execute will vary significantly depending on the router’s operating system (e.g., Cisco IOS, Juniper Junos, Mikrotik RouterOS, OpenWrt, DD-WRT). However, here are some widely applicable concepts and generic examples:

  • enable or configure terminal: On Cisco IOS and similar systems, you might need to enter a privileged mode to execute certain commands or configuration changes.
  • show running-config / show configuration: Displays the current active configuration of the device. Invaluable for understanding how the router is set up.
  • show ip interface brief: Shows a summary of IP addresses and status for network interfaces.
  • ping <ip_address>: Tests connectivity to another device on the network.
  • exit or logout: Logs you out of the current session or mode.
  • ? (question mark): Often used to get help or a list of available commands in the current context.

Note: Always consult your specific router’s documentation for precise command syntax and available features. Incorrect commands can potentially disrupt network service.

Security Best Practices for Router CLI Access

Accessing your router’s CLI grants immense power, which comes with significant responsibility. Implement these security measures:

  1. Always Prioritize SSH: If your router supports SSH, disable Telnet completely. The security risk of plain-text credentials and data transmission is simply too high.
  2. Change Default Credentials: This is non-negotiable. Default usernames and passwords are well-known to attackers. Use strong, unique passwords for your router’s CLI (and GUI) access.
  3. Use Strong Passwords: Employ complex passwords that are at least 12-16 characters long, including a mix of uppercase, lowercase, numbers, and symbols.
  4. Limit Access:
    • Firewall Rules: If possible, configure your router’s firewall to only allow SSH/Telnet access from specific, trusted IP addresses (e.g., your management workstation’s IP).
    • Disable Remote Access: Unless absolutely necessary, disable remote SSH/Telnet access from the internet. If you need it, use a VPN or limit access to very specific external IPs.
  5. Keep Firmware Updated: Router manufacturers regularly release firmware updates that include security patches. Keeping your router’s firmware current can protect against known vulnerabilities.
  6. Consider SSH Key-Based Authentication: For advanced users and increased security, configure SSH key pairs. This removes the need for password authentication and is far more secure.
  7. Audit Logs: Regularly check your router’s logs for unusual login attempts or suspicious activity.

Troubleshooting Tips

If you’re having trouble logging in:

  • Double-Check IP and Credentials: A simple typo is a common culprit.
  • Router Reboot: As a last resort, power cycle your router. This can sometimes resolve transient issues.
  • Firewall on Your PC: Ensure your computer’s firewall isn’t blocking outgoing connections on port 22 (SSH) or 23 (Telnet).
  • Router Firewall: The router itself might have rules blocking management access from your subnet. If you suspect this, a serial console connection is your best bet to investigate and rectify.
  • Cable/Adapter Check: For serial connections, ensure your console cable is working correctly and your USB-to-Serial adapter drivers are installed and functioning. Try a different cable or port if available.
  • Vendor Documentation: Always refer to your router’s specific manual or online documentation for precise details on CLI access, default settings, and commands.

Conclusion

Accessing your router’s CLI opens up a world of advanced configuration and troubleshooting possibilities that the web GUI simply can’t provide. Whether you’re fine-tuning network performance, diagnosing obscure connectivity issues, or preparing for a career in networking, mastering CLI access is a fundamental skill.

By prioritizing secure methods like SSH, understanding the importance of serial console for recovery, and diligently following security best practices, you can confidently take command of your network infrastructure. Embrace the command line – it’s where the real power lies.

References

Note: Specific command syntax and features for routers vary greatly by manufacturer (e.g., Cisco, Juniper, Mikrotik, Ubiquiti, D-Link, Netgear, TP-Link, ASUS) and their respective operating systems (IOS, Junos, RouterOS, EdgeOS, OpenWrt, DD-WRT). Always consult your device’s specific documentation.

Last updated on
Share this post: Twitter Facebook LinkedIn
Linux Networking Debug Toolbox ip, ss, netstat, and curlMaking Dev Tools Feel Native with TUI Interfaces