Block all Internet Service and allow only SMTP and POP

yemsopheak · September 10, 2014, 1:53am

Dear all,

My case study is blocking all Internet services and allow only smtp port 25 and pop3 port 110 to everyone. Only specific mac-address are allow to use internet.
I apply script bellow but it dos not work for allow port 25 and 110. Bellow are my firewall rules.

ip firewall filter add chain=forward protocol=tcp dst-port=110 src-address=192.168.88.0/24 action=accept disabled=no
ip firewall filter add chain=forward protocol=tcp dst-port=25 src-address=192.168.88.0/24 action=accept disabled=no

ip firewall filter add chain=input src-mac-address=00:21:CC:4A:55:B4 action=accept
ip firewall filter add chain=input src-mac-address=28:D2:44:15:1F:B0 action=accept
ip firewall filter add chain=input src-address=192.168.88.0/24 action=drop

Doesn’t every one have comment on my mistake?

Thanks so much for advance.
Sopheak

IntrusDave · September 10, 2014, 5:38am

Try this:

ip firewall filter add chain=forward protocol=tcp dst-port=!25,110 src-address=192.168.88.0/24 action=drop disabled=no

yemsopheak · September 25, 2014, 11:29am

Dear IntrusDave,
I tried already with your commend line but it is still the same. Do you have any advise more?
Below are the print script from my Mikrotik

jan/02/1970 00:19:00 by RouterOS 6.12

software id = 4AXH-SQ9J

/ip firewall filter
add chain=input src-mac-address=00:21:CC:4A:55:B4
add chain=input disabled=yes src-mac-address=28:D2:44:15:1F:B0
add action=drop chain=forward dst-port=!25,110 protocol=tcp src-address=192.168.88.0/24
add action=drop chain=input src-address=192.168.88.0/24

thanks for your comment.