I’ve got a mikrotik border router that is doing NAT with port forwarding incoming connections. From a restricted set of src addresses, I’d like to be able to access the router directly on a select set of ports (e.g. snmp monitoring), but I’m not sure how to do it and the couple of things I’ve tried didn’t work (e.g. port forwarding to the router’s lan address, or saying “action=accept”).
No need for port forwarding, all you need is to allow access in input chain like this:
/ip firewall filter
add chain=input src-address=192.168.88.88 protocol=udp dst-port=161 action=accept comment="allow snmp"
add chain=input src-address-list=admins protocol=tcp dst-port=22,8291 action=accept comment="allow ssh and winbox"
For the record, mainly for access from internet, it’s safer to use VPN, not just whitelist for addresses.
That was my concern, it was not clear but assumed that access was being asked for from the LAN side, no worries…
However I would state it differently, one would be insane to access the router externally without a VPN.
Slightly difference nuance. 