ACME HTTP-01 challenges require that (at least briefly after an outbound ACME request) the router be reachable on port 80.
What I've got working at the moment - though, I'll discuss the vagaries of "working" below - based (thank you, as always) on discussions I'd found here in the forum, looks like the quotes below.
It "works" in the sense that, except when the router has recently (within the last address-list-timeout which I presently have set to 5 minutes, though actually that's probably longer than is strictly needed?) inbound connections to port 80 are not accepted by the firewall filter.
But, during those minutes, any inbound port 80 connection is connected, and I do see some of the never-ending scan-everyone-all-the-time scans hit, and produce a completed HTTP session to the router's web server. As the only service offered by the web server on port 80 is for ACME HTTP-01 challenge response, it's a fairly minor attack surface, but I'd like to close it down further.
I happen to, at the moment, have an ACME certificate purchased through GoGetSSL from Sectigo.
I find no published list of server names or IP addresses from which to constrain inbound HTTP sessions during the port-80-open-after-initiating-ACME-request time period, and I find references that suggest that it's not practiced (to allow ACME issuers to make it harder for the bad guys to know which source address ranges to try to compromise, and to allow HTTP-01 challenges to arrive from various places around the world at once). Frankly, as a lifetime security guy, I don't find these arguments convincing, giving rapid DNS propagation, RouterOS' ability to dynamically track the current IP addresses of a given FQDN, etc. But, this does seem to be the case at the moment.
So, just trust that RouterOS' web server is secure enough, when only ACME response is permitted on port 80?
Any other ways to armor the ROS web server port 80 listener during these dynamic periods of opening up to any source IP address on the whole Internet?
thanks,
-Jay
/ip/firewall/address-list
add list=${MyACMECertIssuerDirURLsList} address=${MyACMECertIssuerDirectoryURLHostname}
/ip/firewall/mangle
add comment="When I make an outbound connection to my ACME cert issuer, temporarily add {my address} to list=ACME-client, which will then (temporarily) allow inbound port 80, for the ACME server to perform Domain Validation. This avoids the need to keep inbound port 80 open all the time." \
chain=postrouting action=add-src-to-address-list src-address-type=local \
dst-address-list=${MyACMECertIssuerDirURLsList} \
address-list=ACME-client address-list-timeout=5m
/ip/firewall/filter
add comment="When MikroTik ACME client reaches out (see mangle rules) the ACME-client list will temporarily be populated with {me}, which will allow incoming HTTP connections for the ACME server to perform Domain Validation. This avoids the need to keep port 80 open inbound all the time." \
chain=input action=accept protocol=tcp dst-address-list=ACME-client dst-port=80
With of course
/ip/service/webserver> print
index-plain: no
webfig-plain: no
graphs-plain: no
rest-plain: no
crl-plain: no
scep-plain: no
acme-plain: yes
index-secure: yes
webfig-secure: yes
graphs-secure: yes
rest-secure: yes