my Mikrotik router is behind my internet provider router (f.eg: 192.168.1.1). The Mikrotik is placed in this router, in its DMZ zone.
Any device in the LAN is allowed to go on internet, but are locked inside their own VLAN.
The only exception is the VLAN99 (Management) which is allowed to go to internet or to any other VLAN.
Now, i would like to go further, and only allow devices from management VLAN (99) to access my internet router.
In case i create a firewall roule which blocks the internet router IP (192.168.1.1), in that case the whole internet access is blocked as well.
I guess, we are in a similar situation as for Hairpin, but my knowledge in networking are too weak to do this setup.
I am kinda new year. I am seeking some assistance in securing my RB2011UiAS. I have configured NAT on the two ISP that I have. But I also want to secure some port to be open and secure. I have been getting funny going through that port and I am suspecting they are affecting some of the services we have. I would appreciate any help on this.
1.) DMZ normally means whatever is inside that zone should not at all be able to access/manage your internet GW. Is it DMZ really?
2.) Do you do NAT on Mtik? If so you can drop requests to 192.168.0.1 if not NATed
3.) Or on forward chain, before NAT, drop all traffic directly to 192.168.0.1 coming from the VLAN i/f you want to block
Input chain to Mtik and output chain to gateway needs to be open.
Also if you have DNS servers or similar stuff on internet gateway used by the VLAN clients it won’t work.
Make sure this is all handled either by Mikrotik or by cloud service.
it works (all VLANs can access internet), but when you add them, it stops? I don’t see how it would be possible. Yes, drop rule deals with VLANs (in-interface-list=VLAN), but another condition is dst-address-list=“Router Vodafone” and if that list contains only single address, rule won’t touch anything else. You can enable logging for the rule (log=yes), to see if it really blocks your traffic, but it can’t.
And where exactly did you put them? Because if it’s at same position as previous ones, it can’t work. You just reversed previous rule:
Original one blocked traffic from VLANs to ether1 and addresses in “Router Vodafone” list.
New one blocks traffic from ether1 and addresses in “Router Vodafone” (after preceding rules allows it to BASE)
So all outgoing packets are still allowed, and this would only block responses. But it would have to be at the beginning of chain, because any response will have connection-state=established and will be allowed by fasttrack rule or the following one, and nothing will be blocked.
