Application of Firewall rules and general security question (public network access)

RouterOS Beginner Basics
1

Hello,
i have one short question referring to the firewall rules and securing my Mikrotik router:

I created one bridge (bridge A), which includes vlan10 and ether2.

I want to prohibit any traffic or access from this bridge (including all of its interfaces) to the rest of my network, because it will be accessible by anyone.

Can I already achieve this, by setting up this single and simple firewall rule?
→ Chain: Forward; Input In.: bridge A; Output In.: any; Action: drop

If I select a bridge-interface in a firewall rule, is this rule also applied to the interfaces beloging to this bridge?

Additional steps I took:
– IP → Services: Disabled all services except of www, www-ssl and winbox
– Tools → MAC-Server: Telnet is disabled completely, Winbox is only available for some specific interfaces
– IP → Neighbour-List → Discovery Interfaces: Disabled for all interfaces, except for some specific ones
– I deleted the admin-user and created a new one with a long password

What other steps do you recommend to me to avoid any bad surprise?

Thank you so much in advance.

2

You probably want two rules. One in forward chain to prevent access to other interfaces. And second in input chain, to prevent access to router itself (services running on it). From IP perspective, bridge is just one interface, no matter how many ports it has. So yes, you select it as input interface and it’s enough.

3

Custom src and dst address lists are good

4

Thanks for your help. I now created three rules:

1.) Action: drop II Chain: forward II In. Interface: bridge-A II Out. Interface: ANY
2.) Action: drop II Chain: forward II In. Interface: ANY II Out. Interface: bridge-A
3.) Action: drop II Chain: input II In. Interface: bridge-A II Out. Interface: ANY
3.) Action: drop II Chain: output II In. Interface: ANY II Out. Interface: bridge-A

Did I setup these rules correct? - I’m especially not sure if the bridge-A Interface is supposed to be the Input or the Output Interface.

Thanks in advance and happy holidays :slight_smile:

5

Incoming interface is where it comes from, outgoing interface is where it goes to.

So to prevent access from bridge-A to other networks and router:

/ip firewall filter
add action=drop chain=forward in-interface=bridge-A
add action=drop chain=input in-interface=bridge-A

To also prevent access from other networks to bridge-A:

/ip firewall filter
add action=drop chain=forward out-interface=bridge-A

And preventing router from sending anything to bridge-A is probably unnecessary, but if you want it, it won’t hurt anything:

/ip firewall filter
add action=drop chain=output out-interface=bridge-A
6

Thank you so much guys!

I really appreciate your help!

7

does this help at all:?

/ip firewall address-list
add address=192.168.0.0/16 list=private-networks
add address=172.16.0.0/12 list=private-networks
add address=10.0.0.0/8 list=private-networks
add address=1.1.1.1 list=port-knock-secured-ips comment="This is an example - this address will be allowed access to the router from externally"
/ip firewall filter
add chain=input dst-port=1234 protocol=tcp action=add-src-to-address-list address-list="port-knock-step-1" address-list-timeout=1m 
add chain=input dst-port=5678 protocol=tcp src-address-list="port-knock-step-1" action=add-src-to-address-list address-list="port-knock-secured-ips" address-list-timeout=1m
add action=accept chain=input comment="Accept related/established from internal networks" connection-state=established,related in-interface=![/interface ethernet find where default-name=ether1]
add action=accept chain=input comment="Accept inbound related/established" connection-state=established,related in-interface=[/interface ethernet find where default-name=ether1]
add action=accept chain=input comment="Accept inbound for SSTP VPN" dst-port=443 in-interface=[/interface ethernet find where default-name=ether1] protocol=tcp
add action=accept chain=input comment="Accept inbound L2TP/IPsec VPN" dst-port=1701,500,4500 in-interface=[/interface ethernet find where default-name=ether1] protocol=udp
add action=drop chain=input comment="Drop unsolicited inbound WAN traffic" in-interface=[/interface ethernet find where default-name=ether1]
add action=accept chain=input comment="Accept broadcast traffic from internal networks" dst-address-type=broadcast,multicast in-interface=![/interface ethernet find where default-name=ether1]
add action=accept chain=input comment="Accept icmp on all interfaces" protocol=icmp 
add action=accept chain=input comment="Allow access from any port knock IPss" src-address-list=port-knock-secured-ips in-interface=[/interface ethernet find where default-name=ether1]
add action=accept chain=input comment="Allow access from any private networks" src-address-list=private-networks in-interface=![/interface ethernet find where default-name=ether1] 
add action=accept chain=input comment="Accept DHCP on all interfaces" dst-port=67 log-prefix=log-dhcp protocol=udp
add action=drop chain=input comment="Drop and log all inbound traffic not matching previous rules"