(1) Question about your settings here… what is vlan10??
Point of personal preference i prefer to manually untag bridge ports on the config so they show up on the export and can follow the Admin/s logic.
/interface bridge vlan
add bridge=bridge tagged=bridge vlan-ids=10
add bridge=bridge tagged=bridge vlan-ids=20
TO:
/interface bridge vlan
add bridge=bridge tagged=bridge untagged=wlan1,wlan2 vlan-ids=20
(2) Again personal preference but I prefer the following format…
add bridge=bridge ingress-filtering=yes frame-types=admit-priority-and-untagged interface=wlan3 pvid=20
add bridge=bridge ingress-filtering=yes frame-types=admit-priority-and-untagged interface=wlan4 pvid=20
(3) Dont understand your settings for dchp server network… what is special about 10.10.10.11 ???
/ip dhcp-server network
add address=10.10.10.0/24 dns-server=10.10.10.11 gateway=10.10.10.1
add address=10.10.11.0/24 dns-server=1.1.1.1 gateway=10.10.11.1
(4) Your input chain rules dont quite match your stated concerns, in that anyone can access your router for config purposes
Thus recommend the following at least:
/ip firewall filter
add action=accept chain=input comment=
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=
“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
add action=accept chain=input comment=TrustedLAN in-interface=bridge src-address=10.10.10.0/24
add action=accept chain=input comment=“access to services” dst-port=53 protocol=udp in-interface-list=LAN
add action=accept chain=input comment=“access to services” dst-port=53 protocol=tcp in-interface-list=LAN
add action=drop chain=input comment=“DROP ALL ELSE” { put this rule in last }
(5) Accessing internal servers by their WANIP is a bit tricky, since the default rule only allows it from the WAN side
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
Recommended to change this rule to the following three rules which are clearer and provide better security and fix your dst nat problem.:
add action=accept chain=forward comment=“internet” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat
add action=drop chain=forward comment=“DROP ALL ELSE”
(6) Looking at your source nat rules, I see you have accounted for local users on the trusted subnet also accessing the servers by the WANIP, as you have the required hairpin nat rule in place.
The hairpin nat rule is NOT required for the VLAN subnet as that is a different subnet.
(7) Not sure what you are doing with the dstnat rules, a kind of cute method to deal with a dynamic WANIP attempt but the problem is that you do not rule out 10.10.11.0 subnet which is also local.
It would appear that you are trying to direct ALL users to go out a server for all browsing??? Can you provide a better explanation please… What is at 10.100.100 and what is its purpose??
add action=dst-nat chain=dstnat comment=http dst-address=!10.10.10.1
dst-address-type=local dst-port=80 protocol=tcp to-addresses=10.10.10.100
to-ports=80
add action=dst-nat chain=dstnat comment=https dst-address=!10.10.10.1
dst-address-type=local dst-port=443 protocol=tcp to-addresses=
10.10.10.100 to-ports=443