Block all ports except 100 ports

RouterOS Beginner Basics
1

Hi , I want to block all ports except well known ports such as 80 , 21 , 22 , 53 , … (100 ports)

some of them are tcp and some other are udp.

i use these rules :

/ip firewall filter 
add chain=forward disabled=no action=accept in-interface=ether2 protocol=udp dst-port=21 
. 
. 
. 
add chain=forward disabled=no action=accept in-interface=ether2 protocol=tcp dst-port=80 

add chain=forward disabled=no action=drop in-interface=ether2

but after I enable the last rule, all ports are blocked and the traffic is dropped.
and once I disable last rule then the problem is solved.

what shall i do ?

2

Hi,

Enable logging in that last rule to see what ports is getting blocked.

I think your issue can be that in-interface=

3

you can do it more simple

/ip firewall filter
add action=drop chain=input dst-address=... dst-port=!80,21,8080,etc
in-interface=ether* protocol=tcp
add action=drop chain=input dst-address=... dst-port=!80,21,8080,etc
in-interface=ether* protocol=udp
add action=drop chain=input dst-address=..*. in-interface=ether5

4

You need a rule to accept connection-state=established,related and place it before all of these rules.
Your reply packets are being dropped by your rules.

----[webserver:80]—> accepted because destination port is 80
<–[client:24768]----- dropped because the destination port is not in your list (the source is 80, but your rules specify DEST. port)

The connection-state=established,related rule will match these replies, and it will also speed up your performance so your firewall only has to check the 100 ports whenever a new connection attempt comes in.

5

Tks for your reply . I would like to explain that : all my ips are public & valid & I use mikrotik as a software router between the vpses.

I have defined two interfaces (ether1 & ether2) . /27 ip address is assigned to ether2 & connected by ether1 to the internet. I have set the first usable ip of this block as the gateway of vpses.

ether1 has only one ip address and belongs to a different range .
The mentioned /27 ips have been routed to the ip which is set on ether1 by the datacenter.

I have added the following rules before all of my rules . But new connections to each of my /27 ips are still blocked. :frowning:

add chain=forward protocol=tcp connection-state=invalid action=drop comment="drop invalid connections"  
add chain=forward connection-state=established action=accept comment="allow already established connections"

pls advise.

6

Be sure to add “related” to the “allow established connections” rule. (this is for things like FTP and SIP that negotiate some other port or IP address to use along-side the original connection, ICMP error messages, etc)

Your rules are using the wrong interface if you’re wanting to block incoming connections to the /27 network. Use in-interface=ether1 on all of those rules, because a new connection from the Internet will arrive on ether1. The replies will come into the router on ether2, and by that point, the connection state will become “established” so the established rule will allow replies for anything that was allowed to reach the servers.