for example:
Code: Select all
/interface gre add name="tun0" ...
/ip firewall interface-list
add list=transport interface=ether1
add list=transport interface=tun0
add list=lan interface=ether2
add list=lan interface=ether3
/ip firewall filter
add chain=forward action=jump jump-target=transport_lan in-interface-list=transport out-interface-list=lan
add chain=forward action=jump jump-target=lan_transport out-interface-list=transport in-interface-list=lan
add chain=forward action=drop
add chain=input action=jump jump-target=transport_self in-interface-list=transport
add chain=input action=jump jump-target=lan_self in-interface-list=lan
add chain=input action=drop
#real policies
add chain=transport_lan action=accept protocol=tcp dst-port=80
add chain=transport_self protocol=icmp action=accept
add chain=lan_transport action=accept
add chain=lan_self action=accept
Code: Select all
/ip fi interface-list add list=transport interface=tun1
/ip fi interface-list add list=lan interface=ether4
Code: Select all
/ip firewall filter
add chain=forward action=jump jump-target=transport_forward in-interface=ether1
add chain=forward action=jump jump-target=transport_forward in-interface=tun0
add chain=forward action=jump jump-target=lan_forward in-interface=ether2
add chain=forward action=jump jump-target=lan_forward in-interface=ether3
add chain=forward action=drop
add chain=input action=jump jump-target=transport_self in-interface=ether1
add chain=input action=jump jump-target=transport_self in-interface=tun0
add chain=input action=jump jump-target=lan_self in-interface=ether2
add chain=input action=jump jump-target=lan_self in-interface=ether3
add chain=input action=drop
add chain=transport_forward action=jump jump-target=transport_lan out-interface=ether2
add chain=transport_forward action=jump jump-target=transport_lan out-interface=ether3
add chain=lan_forward action=jump jump-target=lan_transport out-interface=ether1
add chain=lan_forward action=jump jump-target=lan_transport out-interface=tun0
#real policies
add chain=transport_lan action=accept protocol=tcp dst-port=80
add chain=transport_self protocol=icmp action=accept
add chain=lan_transport action=accept
add chain=lan_self action=accept
Code: Select all
/ip fi fi
add place-before=2 chain=forward action=jump jump-target=transport_forward in-interface=tun1
add place-before=2 chain=forward action=jump jump-target=lan_forward in-interface=ether4
add place-before=2 chain=input action=jump jump-target=transport_self in-interface=tun1
add place-before=2 chain=input action=jump jump-target=lan_self in-interface=ether4
add chain=transport_forward action=jump jump-target=transport_lan out-interface=ether4
add chain=lan_forward action=jump jump-target=lan_transport in-interface=ether4