I don’t have any of these rules running and after some more googling I found that people are recommending them. Should I put these rules in place? What do they do?
Make your router ping-able (I understand this one, it just allows me to ping the router from the WAN side? LAN side?)
Accept Connections (not sure what this rule means because I can run a game server behind the router and the WAN side can connect to my game servers with the proper port forwarding)
Drop Incoming Internet Connections (Security Rule) (does this just drop port 80 and 443 request?)
Drop Invalid Connections (kind of self explanatory but is there something to this?)
My setup is a basic home setup, Cable ISP modem going to router and router has two basic subnets on it to manage my interneal network and a guest account. I also run a few game servers behind the router.
If you don’t have any input filters or forward filters then you effectively have no firewall functionality. Which filters do you have active right now?
I think you might be missing some rules on you second post.
For better reading do export compact on /ip firewall filter.
This give a clearer overview of all the created rules. Also keep in mind the difference between the various chains.
input chain is hit when traffic is destined for the router itself. Forward chain is hit for traffic traversing through the router.
Here is my minimal recommended set of rules
add action=drop chain=input comment=“Drop invalid connections” connection-state=invalid
add chain=input comment=“Accept established connections” connection-state=established
add chain=input comment=“Accept related connections” connection-state=related
add chain=input comment=“Allow access from local network” in-interface= src-address=
add action=log chain=input comment=“Log everything else” disabled=yes log-prefix=“IPv4 Drop input RR:”
add action=drop chain=input comment=“Drop everything else”
add action=drop chain=forward comment=“Drop invalid connections” connection-state=invalid
add chain=forward comment=“Accept established connections” connection-state=established
add chain=forward comment=“Accept related connections” connection-state=related
add chain=forward comment=“Allow traffic from Local network” in-interface= src-address=
add action=log chain=forward comment=“Log everything else” disabled=yes log-prefix=“IPv4 Drop forward RR:”
add action=drop chain=forward comment="Drop everything else"Since you seem to have 2 LAN networks (VLAN’s) create some more rules for those networks.
Your rules could look like this:
add action=drop chain=input comment=“Drop invalid connections” connection-state=invalid
add chain=input comment=“Accept established connections” connection-state=established
add chain=input comment=“Accept related connections” connection-state=related
add chain=input comment=“Allow access from local network” in-interface= src-address=
add chain=input comment=“Allow access from local network 3” in-interface= src-address=
add action=log chain=input comment=“Log everything else” disabled=yes log-prefix=“IPv4 Drop input RR:”
add action=drop chain=input comment=“Drop everything else”
add action=drop chain=forward comment=“Drop invalid connections” connection-state=invalid
add chain=forward comment=“Accept established connections” connection-state=established
add chain=forward comment=“Accept related connections” connection-state=related
add chain=forward comment=“Allow traffic from Local network to go outside” in-interface= src-address= out-interface=WAN
add chain=forward comment=“Allow traffic from Local network 3 to go outside” in-interface= src-address= out-interface=WAN
add action=log chain=forward comment=“Log everything else” disabled=yes log-prefix=“IPv4 Drop forward RR:”
add action=drop chain=forward comment=“Drop everything else”
So do I drop my the first 4 rules (the new ones) and add your second set of rules? And do I replace each IP with the local VLAN IP? Or do I also drop my VLAN rules?
And in these rules I replace the “ip” with my two VLAN subsets? (192.168.1.0/24 & 192.168.2.0/24)
add chain=input comment=“Allow access from local network” in-interface= src-address=
add chain=input comment=“Allow access from local network 3” in-interface= src-address=