The opening of the service port on the Mikrotik router provides an opening for hackers to enter the Mikrotik service to access the router illegally. This research aimed to close certain ports that are gaps for hackers and uses port knocking and telegram bots. The Telegram bot was used as a message notification to managers in real-time to provide information that occurs when the vulnerability scanning process is carried out to find and map weaknesses in the network system. Searching for weaknesses also includes looking for open router service ports such as ports 22, 23, 80, and 8291. This research used the Network Development Life Cycle method, which started from analysis design and prototype simulation to implementation. The research results after testing were able to secure local network service ports against vulnerability scanners on routers using the port knocking method, and testing attack schemes carried out from each scheme could run well on the router’s local network and obtain notifications via telegram bots in real time to administrators. This research contributes to administrators’ ability to secure networks so irresponsible people do not easily infiltrate them.