-
Remove all WAN bridges, not required.
-
None of the WANs have a reachable public IP??? no need to use back to home VPN if you have an accessible public IP.
-
The actual use of a bridge would be to assign all vlans to Bridge-Loop
Bridge ports would consist of ether3, and ether4 and correct me if wrong, there are no other LAN subnets or ports ??? -
Seem confused, 5 or 6 wans??
-
No understanding of vlans have you read —> http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1 if not, its a must read, if yes, you didnt learn it yet.
-
Very unsafe setup, exposing both winbox and www, to the internet…
-
In contrast to 6. your firewall rules are a tad paranoid in that the focus is on blocking instead of on needed traffic, but thats personal preference just saying its actually contradictory to be worried about stuff that rarely happens if ever and not be concerned about making it easy to get hacked. In any case your firewall rules are not complete at all.
-
Can you tell me the purpose of this set of rules, why do you have this set of mangles included???
add action=mark-connection chain=input in-interface=1_ISP1_30M+50M
new-connection-mark=wan1_conn passthrough=yes
add action=mark-connection chain=input in-interface=2_ISP2_30M+50M
new-connection-mark=wan2_conn passthrough=yes
add action=mark-connection chain=input in-interface=3_ISP3_30M+50M
new-connection-mark=wan3_conn passthrough=yes
add action=mark-connection chain=input in-interface=4_ISP4_30M+50M
new-connection-mark=wan4_conn passthrough=yes
add action=mark-connection chain=input in-interface=5_ISP5_30+50M
new-connection-mark=wan5_conn passthrough=yes
add action=mark-routing chain=output connection-mark=wan1_conn
new-routing-mark=to_wan1 passthrough=yes
add action=mark-routing chain=output connection-mark=wan2_conn
new-routing-mark=to_wan2 passthrough=yes
add action=mark-routing chain=output connection-mark=wan3_conn
new-routing-mark=to_wan3 passthrough=yes
add action=mark-routing chain=output connection-mark=wan4_conn
new-routing-mark=to_wan4 passthrough=yes
add action=mark-routing chain=output connection-mark=wan5_conn
new-routing-mark=to_wan5 passthrough=yes -
Can you tell me the purpose of this set of rules??
add action=accept chain=prerouting in-interface=1_ISP1_30M+50M
add action=accept chain=prerouting in-interface=2_ISP2_30M+50M
add action=accept chain=prerouting in-interface=3_ISP3_30M+50M
add action=accept chain=prerouting in-interface=4_ISP4_30M+50M
add action=accept chain=prerouting in-interface=5_ISP5_30M+50M -
For pcc mangles, and the routing-marks, you do not need to restate the source address and passthrough=no ( not yes )
-
Routes seem okay.
++++++++++++++++++++++++++++++++++++++++++
Summary, a bit messy, vlan understanding needs works and major changes, mangles need to be rationalized ( pcc mangles for the most part are good). Firewall rules need work.
Perhaps some explanation of what is happening for each WAN.
Which WAN is vpn travelling over, any incoming traffic for port forwarding and if so which WAN
what happens when a WAN fails or are they all from the same provider so if one goes down likely they are all not working?
In terms of the VLANS, you have one subnet but many vlans which doesnt make sense.
Can you explain what each port NOT THE WAN PORTs, but other ether ports do… what are they attached too
What the purpose is for each vlan, seeing as they have no structure??? ( ip address, pool, etc..)