Hello everyone
New Mikrotik user here (literally the first time ever i’ve touched anything Mikrotik)
i just inherited a small network with a RB951Ui-2Hnd router and before anything i wanted to check the firewall but the firewall tab in winbox was empty!! so i did a little digging around the internet and apparently Mikrotik SOHO routers are supposed to have a pre configured firewall and it can be seen by using the “/ip firewall export” command in the winbox terminal, but after running this command there is no firewall rules in the reports! there’s just one line which is NAT and that’s it!
am i doing it wrong? or is it removed?
btw where the best place to learn the Mikrotik winbox and terminal?
Looks like someone emptied that firewall.
I hope you haven’t got it connected to a WAN interface ?
Is this router like Main? At the Wan interface? If no firewall rules are defined, it means that the router is not configured as it should be. If you have not configured mikrotik before, then I recommend reading the documentation, because explaining everything - where, what and how it should be - will be a very time-consuming task.
As a beginner, I would recommend you to use default firewall rules and then gradually see what your network needs (split Vlans, restrict something, etc.)
https://help.mikrotik.com/docs/spaces/ROS/pages/48660574/Filter
/interface list
add name=WAN
add name=LAN
/interface list member
add interface=ether1 list=WAN
add interface=bridge1 list=LAN
/ip firewall address-list
add address=192.168.88.2-192.168.88.254 list=allowed_to_router
/ip firewall filter
add action=accept chain=input src-address-list=allowed_to_router
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input src-address-list=allowed_to_router
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input in-interface-list=LAN
add action=drop chain=input comment="drop all else"
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=forward comment="allow internet traffic" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="allow port forwarding" connection-nat-state=dstnat { disable or remove if not required }
add action=drop chain=forward comment="drop all else"
YEP right at the edge, no firewall no nothing
Thanks for sending the rules
yes its the main router, i mean there is another one for the ISP router connected to the radio antenna but i don’t have access to that one.
i have some experience with Cisco routers but mostly i’ve used other more straight forward SOHO routers, but Mikrotik is like a full fledge professional router more like Cisco than other SOHO routers so i definitely need help to set up the firewall and have some aspect of security and ease of mind, ill fine tune it later when i learn more of Mikrotik winbox and terminal.
btw, for some reason, besides no firewall, its using port 2 for LAN and 3 for WAN and idk if i can just copy the rules you provided can i? aside from changing the IP i think i should define my LAN and WAN somewhere before applying the rules, and after applying the rules how can i remove and or preferably edit them fast if there is a problem?
this device should have a default firewall config. Maybe it is quick set as CPE or something - as these quickset profiles remove firewall rules IIRC.
is it or is it not the main router?
From what you described it is not and it is right that there is no internal configuration, but everything is transparent to avoid double NAT and other double router bullshit.
If you do not assign a public IP to the RB951Ui-2HnD, you have no control over anything on the Internet, such as opening ports & co. The only thing you can do is (subsequently) divide the network STARTING from the RB951Ui-2HnD into separate subnets, all with double NAT and what follows.
If the RB951Ui-2HnD does indeed have a public IP, I highly recommend updating it to 6.49.17 and then resetting it to default settings. This will reset the firewall and everything else you need to the correct defaults.
it does have a public IP and i would've reset the router if i had proper documentation but i have nothing, its a mess and i think setting up the Default/SOHO firewall is my best choice right now, i just need someone to explain it once and ill be good to go
i don’t have any documentation left for me but i don’t think its set as CPE, its just not configured or even worse, removed.
Please share the current configuration to help you:
/export file=anynameyoulike
This will create a file (which can be found at files) that you can download.
Remove serial and any other private info and post between code tags by using the </> button.
Ignore the bad advice above to modify the existing configuration.
The router should not be connected to the internet so remove.
- use netinstall to upgrade to latest firmware, to be sure you have a non-compromised firmware on the router,
- Then should have a decent starting point firewall.
That would be my take as well.
Given the inexperience of the user, no offense intented, it’s best to start from default with a netinstalled device.
Agreed. Do an export with sensitive so you have reference config at hand (in case there are some vpns or something important configured). then netinstall (with reset config) to latest ROS.
Here you go
# by RouterOS 7.13.3
# software id = *****
#
# model = RB951Ui-2HnD
# serial number = ****
/interface bridge
add name=INT-LAN protocol-mode=none
add name=Z-WAN protocol-mode=none
/ip pool
add name=dhcp_pool0 ranges=192.168.1.40-192.168.1.250
/ip dhcp-server
add address-pool=dhcp_pool0 interface=INT-LAN name=dhcp1
/user group
add name=SSH-GRP policy="ssh,read,!local,!telnet,!ftp,!reboot,!write,!policy,!\
test,!winbox,!password,!web,!sniff,!sensitive,!api,!romon,!rest-api"
/interface bridge port
add bridge=INT-LAN interface=ether2
add bridge=Z-WAN interface=ether3
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip address
add address=192.168.1.2/24 interface=ether2 network=192.168.1.0
add address=PUBLIC IP interface=ether3 network=PUBLIC IP
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.9 domain=M******.local \
gateway=192.168.1.2
/ip firewall nat
add action=masquerade chain=srcnat out-interface=Z-WAN to-addresses=\
PUBLIC IP
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=PUBLIC IP routing-table=main \
suppress-hw-offload=no
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes port=2225
set api disabled=yes
set api-ssl disabled=yes
/ip ssh
set forwarding-enabled=local
/system clock
set time-zone-name=
/system note
set show-at-login=no
/system ntp client servers
add address=192.168.1.8
i think (i hope) i removed all sensitive information
i would do this but i’m just afraid ill break something, lets do the bad advice for now and eventually when i’m sure everything is working fine ill
“1. use netinstall to upgrade to latest firmware, to be sure you have a non-compromised firmware on the router,
2. Then should have a decent starting point firewall.”
but just for now for my ease of mind help me set up the firewall
[/quote] btw, for some reason, besides no firewall, its using port 2 for LAN and 3 for WAN and idk if i can just copy the rules you provided can i? aside from changing the IP i think i should define my LAN and WAN somewhere before applying the rules, and after applying the rules how can i remove and or preferably edit them fast if there is a problem? [/quote]
yes, you can copy my example. Change WAN to whichever port you need. In the Address-list, change the IP to the one you need.
@Mossii
Maybe you need some background to understand the set of configuration johnson73 provided.
Here you define two interface lists, one is LAN or inside/safe, the other one is WAN or outside/dangerous:
/interface list
add name=WAN
add name=LAN
Here you define which interfaces are what, a default configuration is usually that of having a single port, ether1, connected to the internet and a bridge (comprising all other interfaces) connected to your local network, hence:
/interface list member
add interface=ether1 list=WAN
add interface=bridge1 list=LAN
Should become for you:
/interface list member
add interface=Z-WAN list=WAN
add interface=INT-LAN list=LAN
Here you define a firewall address list that will be allowed to access the router, this is usually your whole local network minus the IP the router has on the LAN side bridge, but it could be a smaller range or just the administrator pc address:
/ip firewall address-list
add address=192.168.88.2-192.168.88.254 list=allowed_to_router
in your case it should probably be the same range you have in the DHCP server as dhcp_pool0: 192.168.1.40-192.168.1.250
Now you add the corpus of firewall filter rules, here divided in two groups, the first is relative to input chain, i.e. connections to the router, including one which allows access from the above address-list:
/ip firewall filter
add action=accept chain=input comment=“defconf: accept established,related,untracked” connection-state=established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input > src-address-list=allowed_to_router
add action=accept chain=input comment=“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
add action=accept chain=input > in-interface-list=LAN
#final rule
add action=drop chain=input comment=“drop all else”
Then a second group in the forward chain. i.e. connections that should go through the router:
/ip firewall filter
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related
add action=accept chain=forward comment=“defconf: accept established,related, untracked” connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=forward comment=“allow internet traffic” > in-interface-list=LAN out-interface-list=WAN
#disable or remove the following if not required
add action=accept chain=forward comment=“allow port forwarding” connection-nat-state=dstnat
#final rule
add action=drop chain=forward comment=“drop all else”
if you review them one by one, what they do should be easy to understand from the comment, and you will notice that:
- there is no reference to individual interfaces or to their assigned IP addresses, but only interface lists and address lists
- the final rule in each group is a drop all else one, i.e. any connection that has not been explicitly allowed by a previous rule will get at the end and be dropped.
These two rules are almost the same:
add action=accept chain=input src-address-list=allowed_to_router
add action=accept chain=input in-interface-list=LAN
if you added the whole local network to the address list, and later you can decide to disable the one or the other.
These two rules are almost the same:
add action=accept chain=input src-address-list=allowed_to_router
add action=accept chain=input in-interface-list=LAN
Is an excellent start if the src-address-list is comprised of your LOCAL admin IPs ( wired/wifi/vpn if any) aka only those devices that need access to the router.
The allow interface list= LAN, should be limited to dst-port=53 for DNS.
Netinstall
Start from default
Learn.
This does make it easier to understand, thank you.
ill be using the configuration tomorrow
i have some questions tho
We use a vpn which uses the 172.16.0.0/24 range if i want to allow it through the router from inside our LAN to a VPS i don’t need to change anything correct?
ill remove the rule for port forwarding for now, i don’t think it’s needed.
These rules basically drop anything that was not initiated from inside our LAN correct?
and what about remote access like Anydesk or rdg/rdp i think they’ll be blocked after applying these rules correct? What would you recommend is the best practice for remote access for myself with full access and limited access for other users using the MT?
There is a refurbished Cisco Router connected to 3 analog telephone lines so because of this and any other surprises (thing was working now it doesn’t) how can i remove the rules and return to the previous unconfigured state?