You lost me there friend,
if these two rules are the same, i got it that with one i can define a couple of IP’s while the other gives the whole lan access to the router(we’re talking about winbox and terminal here right?input rules= access to router) than what’s the port 53 limit you pointed out?
yes, you can copy my example. Change WAN to whichever port you need. In the Address-list, change the IP to the one you need.
Thanks again
Do you have any recommendations for anything to add or remove to these rules?
@anav
In the OP’s current config the DNS server Is on another device, 192.168.1.9.
- you can use the default method, it also works well. ( https://www.youtube.com/watch?v=hMj80ZIVBQs
- you can use “good practice”, where it is defined in the rules - we prohibit everything (drop-ALL) and allow only what we need. I already copied these rules for you before.
Need to add more rolls? Here you need to understand what your needs are…will there be only one LAN or several (work or guest etc.)
can i still use remote desktop such as Anydesk after adding these rules? if i got it right, these rules drop everything that’s not initiated from inside LAN, correct?
Hi Jaclaz, my intention was generic, thanks for pointing that out, in which case the OP only needs to allow local/vpn admin associated IPs to the input chain from the LAN side.
Yes, of course, you can use all applications, etc. These rules cover the security of the router to prevent outside access. From local Lan, everything works without changes. But remember that the order of firewall rules also matters because it affects traffic flow performance, security, and things like that. If, for example, you need access from the outside, it is recommended to use a vpn connection instead of creating a “hole” for winbox or RDP 3389. This is not safe!
Look at the video link I posted earlier and I think you will understand the basic idea of how firewall rules work, what blocks what and how to create these rules.
after applying the rules some were disconnected from the internet and some could access internet! what might be the problem here? is there any log i can provide?
i pinged google and 8.8.8.8 and both failed, even the Voip phone of that same PC had stopped working.
the config
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.)
From post #7
That recommendation was repeated in post #11 and #12
I was going to post again in my view starting from default would be the ONLY sensible starting point but alas … some are more interesting in patching holes instead of starting from a clean, known to be working config.
Sorry for the late reply, here you go
# by RouterOS 7.13.3
# software id = *****
#
# model = RB951Ui-2HnD
# serial number = ****
/interface bridge
add name=INT-LAN protocol-mode=none
add name=Z-WAN protocol-mode=none
/ip pool
add name=dhcp_pool0 ranges=192.168.1.40-192.168.1.250
/ip dhcp-server
add address-pool=dhcp_pool0 interface=INT-LAN name=dhcp1
/user group
add name=SSH-GRP policy="ssh,read,!local,!telnet,!ftp,!reboot,!write,!policy,!\
test,!winbox,!password,!web,!sniff,!sensitive,!api,!romon,!rest-api"
/interface bridge port
add bridge=INT-LAN interface=ether2
add bridge=Z-WAN interface=ether3
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip address
add address=192.168.1.2/24 interface=ether2 network=192.168.1.0
add address=PUBLIC IP interface=ether3 network=PUBLIC IP
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.9 domain=M******.local \
gateway=192.168.1.2
/ip firewall nat
add action=masquerade chain=srcnat out-interface=Z-WAN to-addresses=\
PUBLIC IP
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=PUBLIC IP routing-table=main \
suppress-hw-offload=no
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes port=2225
set api disabled=yes
set api-ssl disabled=yes
/ip ssh
set forwarding-enabled=local
/system clock
set time-zone-name=
/system note
set show-at-login=no
/system ntp client servers
add address=192.168.1.8
and here’s the rules i edited and used in the terminal
[Admin@MikroTik] > interface list
[Admin@MikroTik] /interface/list> add name=Z-WAN
failure: already have interface with such name
[Admin@MikroTik] /interface/list> add name=INT-LAN
failure: already have interface with such name
[Admin@MikroTik] /interface/list> /interface list member
[Admin@MikroTik] /interface/list/member> add interface=ether3 list=Z-WAN
input does not match any value of list
[Admin@MikroTik] /interface/list/member> add interface=ether2 list=INT-LAN
input does not match any value of list
[Admin@MikroTik] /interface/list/member> /ip firewall address-list
[Admin@MikroTik] /ip/firewall/address-list> add address=192.168.1.30-192.168.1.240 list=allowed_to_router
[Admin@MikroTik] /ip/firewall/address-list> /ip firewall filter
[Admin@MikroTik] /ip/firewall/filter> add action=accept chain=input src-address-list=allowed_to_router
[Admin@MikroTik] /ip/firewall/filter> /ip firewall filter
[Admin@MikroTik] /ip/firewall/filter> add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
[Admin@MikroTik] /ip/firewall/filter> add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
[Admin@MikroTik] /ip/firewall/filter> add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
[Admin@MikroTik] /ip/firewall/filter> add action=accept chain=input src-address-list=allowed_to_router
[Admin@MikroTik] /ip/firewall/filter> add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
[Admin@MikroTik] /ip/firewall/filter> add action=accept chain=input in-interface-list=INT-LAN
input does not match any value of interface-list
[Admin@MikroTik] /ip/firewall/filter> add action=drop chain=input comment="drop all else"
[Admin@MikroTik] /ip/firewall/filter> add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
[Admin@MikroTik] /ip/firewall/filter> add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
[Admin@MikroTik] /ip/firewall/filter> add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
[Admin@MikroTik] /ip/firewall/filter> add action=accept chain=forward comment="allow internet traffic" in-interface-list=INT-LAN out-interface-list=Z-WAN
input does not match any value of interface-list
[Admin@MikroTik] /ip/firewall/filter> add action=drop chain=forward comment="drop all else"
why is it configed like this? why there is 2 bridges? isn’t it possible to just use the built in switch? or just 1 bridge
edit
and
i'm new in this network, i don't know what would break if i do a reset, ill eventually do it but not right now.
When you get an error:
[Admin@MikroTik] > interface list
[Admin@MikroTik] /interface/list> add name=Z-WAN
failure: already have interface with such name
[Admin@MikroTik] /interface/list> add name=INT-LAN
failure: already have interface with such name
[Admin@MikroTik] /interface/list> /interface list member
[Admin@MikroTik] /interface/list/member> add interface=ether3 list=Z-WAN
input does not match any value of list
[Admin@MikroTik] /interface/list/member> add interface=ether2 list=INT-LAN
input does not match any value of list
you should check what you did and correct it.
What I posted based on johnson73 suggestions was:
/interface list
add name=WAN
add name=LAN/interface list member
add interface=Z-WAN list=WAN
add interface=INT-LAN list=LAN
Can you see the difference?
You have two bridges, each containing a single interface, this can be either extremely smart o completely unneeded, but if the scope is - temporarily - patching your existing configuration you shouldn’t change this approach for the moment.
Since:
/interface bridge port
add bridge=INT-LAN interface=ether2
add bridge=Z-WAN interface=ether3
the ether2 and ether3 interfaces are not “single” or “self-standing” anymore, in interface list member you need to add the two bridges.
i can see my mistake now
instead of adding ports ether 2 and 3 to WAN and LAN i should add the bridges, idk why though? the bridges are connected to the ports so why it wouldn’t be accepted?
and can i ask what makes it smart or unneeded to have 2 bridges?
edit: i edited the rules and applied them and everything seems to be working fine, i do have 1 unremovable “special dummy rule for fasttrack counters” in filter rules tab and 3 in mangle tab, which might be there cuz i did something wrong?
Naaah, leave that fasttrack rule alone, if everything is working, you are surely better than before.
Which doesn’t mean that your configuration is “perfect” as there can be other things to fix, or to better, as more expert members advised, re-analyzing requirements and starting form a clean state.
You are now in this situation 
:
https://en.wikipedia.org/wiki/The_Little_Dutch_Boy#Popular_culture:_the_legend_of_the_boy_and_the_dike
the dike still needs to be repaired.
Imagine a bridge as a box.
You have an object, let’s say an orange, you put it in a box and close the box.
Once you put the orange in the box, the orange still exists, but you cannot see it anymore.
If you want to move it, to -say - put it on a shelf, you don’t anymore grab the orange, but rather move the box with the orange inside it.
If you tell someone else to do that, you don’t say anymore “put the orange on the shelf”, but rather “put the box with the orange on the shelf”.
Making a bridge and putting a single interface in it (so that it actually bridges nothing) is not needed as the single, self-standing, interface can work just fine, but it can be a “smart” thing to do if you intend - before or later - to add other interfaces/devices to it.
lol can i at least remove the duplicate dummy rules in mangle tab? (why does it have to say dummy? I’m not a MT expert but can i at least rename it?)
the dike does indeed needs to be repaired but for now its not a wide open door with a welcome sign, like it was before so the question now is where to go next for more general rules like the ones we applied (what do they do anyway? you said the comments explain but i didn’t really get the forward rules perhaps dummy is the correct term for me 
)
and if each bridge has one interface than how does the ports in the “boxes” communicate with each other since they’re in different boxes?
i also wanna thank everyone here for helping me and being patient and friendly.
Through a clever use of straws.
You can pierce a hole in the box, reach the orange and get the juice.
Seriously, you have IP addresses assigned to the orange (and to the apple in the other box):
/ip address
add address=192.168.1.2/24 interface=ether2 network=192.168.1.0
add address=PUBLIC IP interface=ether3 network=PUBLIC IP
The two boxes are currently “inheriting” the addresses of their contents.
You have a Static route:
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=PUBLIC IP routing-table=main suppress-hw-offload=no
that is essentially saying “ALL traffic should go through” PUBLIC IP.
But if you run the command:
/ip route print
you will see that you have two DAC (Dynamic, Active Connected) routes.
So the router knows where to send “local” traffic.
The NAT:
/ip firewall nat
add action=masquerade chain=srcnat out-interface=Z-WAN to-addresses=PUBLIC IP
is using instead the box.