Hi
I am new to the Mikrotik. Using 750GR3 . I have configured it as below.
In my filter rules i have configured as below. In short after correct port knock sequence I have added the IP’s in “Secured” List which are allowed to connect using VPN, also allowed the few External WAN Static IP’s in “MySecuredIPs” to do allow full access. And any other traffic after this is dropped.
So now from within router
a) I am unable to ping to any external
b) DNS not resolving as external ip cannot be reached
c) unable to send emails and etc etc
Please Help/Suggest
/interface ethernet
set [ find default-name=ether2 ] name=Lan speed=100Mbps
set [ find default-name=ether1 ] arp=proxy-arp name=Wan speed=100Mbps
set [ find default-name=ether3 ] speed=100Mbps
set [ find default-name=ether4 ] speed=100Mbps
set [ find default-name=ether5 ] speed=100Mbps
/interface pptp-server
add name=pptp-interface user=“”
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip firewall layer7-protocol
add name=“Blocked Websites” regexp=“^.+(facebook.com|gaana.com).*$”
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
/ip pool
add name=PPTP-Pool ranges=192.168.0.217-192.168.0.232
add name=DHCP-Pool ranges=192.168.0.18-192.168.0.189
/ip dhcp-server
add address-pool=DHCP-Pool interface=Lan lease-time=8h name=DHCP
/ppp profile
add local-address=192.168.0.1 name=PPTP remote-address=PPTP-Pool
add dns-server=8.8.8.8 local-address=192.168.0.1 name=SSTP remote-address=
SSTP-Pool use-encryption=required
set [ find default=yes ] addresses=0.0.0.0/0
/system logging action
set 1 disk-file-name=log
/interface list member
add interface=Wan list=WAN
add interface=Lan list=LAN
/interface pptp-server server
set authentication=pap,chap,mschap1,mschap2 enabled=yes
/interface sstp-server server
set authentication=mschap2 certificate=“Test Server Cert” default-profile=
SSTP force-aes=yes pfs=yes
/ip address
add address=192.168.1.2/24 interface=Wan network=192.168.1.0
add address=192.168.0.1/24 interface=Lan network=192.168.0.0
/ip arp
add address=192.168.0.119 interface=Wan mac-address=14:2D:27:D5:C2:01
/ip dhcp-client
add dhcp-options=hostname,clientid interface=Lan
/ip dhcp-server network
add address=192.168.0.0/24 gateway=192.168.0.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,4.2.2.1,8.8.4.4
/ip firewall address-list
add address=127.0.0.1 list=Temporary
add address=127.0.0.1 list=Temporary2
add address=192.168.0.217-192.168.0.232 list=“VPN List”
add address=230.143.210.150 list=MySecuredIPs
add address=130.232.103.129 list=MySecuredIPs
/ip firewall filter
add action=reject chain=forward comment=“Website Block” disabled=yes
layer7-protocol=“Blocked Websites” reject-with=icmp-network-unreachable
add action=accept chain=input src-address=192.168.1.0/24
add action=accept chain=input src-address=192.168.0.0/24
add action=add-src-to-address-list address-list=Temporary
address-list-timeout=30s chain=input dst-port=14 log=yes protocol=tcp
add action=add-src-to-address-list address-list=Temporary2
address-list-timeout=1m chain=input dst-port=44 log=yes protocol=tcp
src-address-list=Temporary
add action=add-src-to-address-list address-list=Secured address-list-timeout=
30m chain=input dst-port=73 log=yes protocol=tcp src-address-list=Temporary2
add action=accept chain=input src-address-list=Secured
add action=accept chain=input src-address-list=MySecuredIPs
add action=drop chain=input
**** If above disabled the WAN is reachable ****
****So I think we need a rule with which the router’s ip ( 192.168.1.2 ) is allowed to reach outer world ****
/ip firewall nat
add action=masquerade chain=srcnat src-address=192.168.0.0/24
add action=masquerade chain=srcnat src-address=192.168.1.0/24
add action=dst-nat chain=dstnat dst-port=51000 in-interface=Wan log=yes
protocol=tcp src-address-list=“VPN List” to-addresses=192.168.0.3
to-ports=51000
add action=dst-nat chain=dstnat dst-port=51001 in-interface=Wan log=yes
protocol=tcp src-address-list=MySecuredIPs to-addresses=192.168.0.3
to-ports=51000
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set udplite disabled=yes
set dccp disabled=yes
/ip route
add distance=1 gateway=192.168.1.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set www-ssl address=0.0.0.0/0 port=444
set api disabled=yes
set api-ssl disabled=yes
/ppp secret
add name=ppppptp9 password=passwordptp9@1 profile=PPTP service=pptp
add name=ppppptp10 password=passwordptp10@1 profile=PPTP service=pptp
/system package update
set channel=long-term