Config Review - Flexibility and security for home user

utensilsforks · June 7, 2026, 8:11am

Hey all,

Sharing my RB5009UPr+S+ home config for feedback — would love a second set of eyes from folks more experienced with RouterOS.

Setup overview:

PPPoE WAN on ether1
5 VLANs: Management (10), Home (20), IoT (30), CCTV (40), Guest (50)
WireGuard for remote access
Inter-VLAN rules: Home can reach IoT and CCTV, Management can reach Home, everything else is dropped
IPv6 disabled for now
SSH hardened (strong crypto, non-default port), Telnet/FTP/API disabled

# 2026-06-03 21:34:49 by RouterOS 7.20.4
# software id = xx
#
# model = RB5009UPr+S+
# serial number = xxx
/interface bridge
add ingress-filtering=no name=bridge1 port-cost-mode=short vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] advertise=2.5G-baseT comment="ISP PPPoE WAN" \
    poe-out=off
set [ find default-name=ether8 ] comment=\
    "Dedicated unbridged port for management access"
set [ find default-name=sfp-sfpplus1 ] comment="Uplink to Unifi Switch"
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 keepalive-timeout=\
    99999 name=pppoe-out1 use-peer-dns=yes user=xxxx
/interface wireguard
add listen-port=12345 mtu=1420 name=wireguard1
/interface vlan
add comment="Management (Only me)" interface=bridge1 name=vlan10-mgmt \
    vlan-id=10
add comment="Home Devices" interface=bridge1 name=vlan20-home vlan-id=20
add comment=IoT interface=bridge1 name=vlan30-iot vlan-id=30
add comment=CCTV interface=bridge1 name=vlan40-cctv vlan-id=40
add comment="Guest (WiFi only)" interface=bridge1 name=vlan50-guest vlan-id=\
    50
/interface list
add name=LAN
add comment="WAN interface list" name=WAN
add comment=Management name=MGMT
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=192.168.88.2-192.168.88.254
add name=pool10 ranges=192.168.10.50-192.168.10.250
add name=pool20 ranges=192.168.20.50-192.168.20.250
add name=pool30 ranges=192.168.30.50-192.168.30.250
add name=pool40 ranges=192.168.40.50-192.168.40.250
add name=pool50 ranges=192.168.50.50-192.168.50.250
/ip dhcp-server
add address-pool=dhcp_pool0 interface=bridge1 name=dhcp1
add address-pool=pool10 interface=vlan10-mgmt name=dhcp10
add address-pool=pool20 interface=vlan20-home name=dhcp20
add address-pool=pool30 interface=vlan30-iot name=dhcp30
add address-pool=pool40 interface=vlan40-cctv name=dhcp40
add address-pool=pool50 interface=vlan50-guest name=dhcp50
/ip smb users
set [ find default=yes ] disabled=yes
/system logging action
set 0 memory-lines=10000
/interface bridge port
add bridge=bridge1 interface=sfp-sfpplus1 internal-path-cost=10 path-cost=10
add bridge=bridge1 interface=ether2
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,sfp-sfpplus1 vlan-ids=10,20,30,40,50
/interface list member
add interface=bridge1 list=LAN
add comment="PPPoE WAN interface" interface=pppoe-out1 list=WAN
add comment="Management interface list" interface=ether8 list=MGMT
add comment="Management VLAN" interface=vlan10-mgmt list=MGMT
add comment="Home VLAN" interface=vlan20-home list=LAN
add comment="IoT VLAN" interface=vlan30-iot list=LAN
add comment="CCTV VLAN" interface=vlan40-cctv list=LAN
add comment="Guest VLAN" interface=vlan50-guest list=LAN
add comment="Management VLAN" interface=vlan10-mgmt list=LAN
add interface=wireguard1 list=LAN
/interface ovpn-server server
add mac-address=FE:7A:42:00:AB:77 name=ovpn-server1
/interface wireguard peers
add allowed-address=192.168.100.2/32 interface=wireguard1 name=\
    "iPhone" public-key=\
    "xxx"
/ip address
add address=192.168.88.1/24 interface=bridge1 network=192.168.88.0
add address=192.168.10.1/24 comment=Management interface=vlan10-mgmt network=\
    192.168.10.0
add address=192.168.20.1/24 comment=Home interface=vlan20-home network=\
    192.168.20.0
add address=192.168.30.1/24 comment=IoT interface=vlan30-iot network=\
    192.168.30.0
add address=192.168.40.1/24 comment=CCTV interface=vlan40-cctv network=\
    192.168.40.0
add address=192.168.50.1/24 comment=Guest interface=vlan50-guest network=\
    192.168.50.0
add address=192.168.100.1/24 interface=wireguard1 network=192.168.100.0
/ip arp
add address=192.168.20.71 interface=vlan20-home mac-address=xx
add address=192.168.10.64 interface=vlan10-mgmt mac-address=xx
add address=192.168.40.50 interface=vlan40-cctv mac-address=xx
/ip cloud
set ddns-enabled=yes update-time=no
/ip dhcp-server config
set store-leases-disk=never
/ip dhcp-server lease

/ip dhcp-server network
add address=192.168.10.0/24 dns-server=192.168.10.1,1.1.1.1 gateway=\
    192.168.10.1
add address=192.168.20.0/24 dns-server=192.168.20.1,1.1.1.1 gateway=\
    192.168.20.1
add address=192.168.30.0/24 dns-server=192.168.30.1,1.1.1.1 gateway=\
    192.168.30.1
add address=192.168.40.0/24 dns-server=192.168.40.1,1.1.1.1 gateway=\
    192.168.40.1
add address=192.168.50.0/24 dns-server=192.168.50.1,1.1.1.1 gateway=\
    192.168.50.1
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes mdns-repeat-ifaces=\
    vlan20-home,vlan30-iot,vlan40-cctv servers=8.8.8.8,1.1.1.1
/ip firewall filter
add action=accept chain=input comment="Accept established,related,untracked" \
    connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input comment="Allow ICMP" protocol=icmp
add action=accept chain=input comment="allow WireGuard" dst-port=12345 \
    protocol=udp
add action=accept chain=input comment=\
    "Allow full access to the management interfaces" in-interface-list=MGMT
add action=drop chain=input comment="Block everything else" in-interface=\
    pppoe-out1
add action=fasttrack-connection chain=forward comment=\
    "Fast-track for established,related" connection-state=established,related \
    hw-offload=yes
add action=accept chain=forward comment="Accept established,related" \
    connection-state=established,related
add action=drop chain=forward connection-state=invalid
add action=drop chain=forward comment=\
    "Drop access to clients behind NAT from WAN" connection-nat-state=!dstnat \
    connection-state=new in-interface=pppoe-out1
add action=accept chain=forward comment="Allow internet access for all VLANs" \
    in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="WG to VLANS" in-interface=wireguard1 \
    out-interface-list=LAN
add action=accept chain=forward comment="Allow Home to Management" \
    connection-state=new in-interface=vlan20-home out-interface=vlan10-mgmt
add action=accept chain=forward comment="All Home to IoT" in-interface=\
    vlan20-home out-interface=vlan30-iot
add action=accept chain=forward comment="Allow Management to Home" \
    in-interface=vlan10-mgmt out-interface=vlan20-home
add action=accept chain=forward comment="Allow Home to CCTV" \
    connection-state=established,related,new in-interface=vlan20-home \
    out-interface=vlan40-cctv
add action=accept chain=forward dst-port=554,9000,80,8000,443 in-interface=\
    vlan30-iot out-interface=vlan40-cctv protocol=tcp
add action=drop chain=forward comment="Drop all other forwarded traffic"
/ip firewall nat
add action=masquerade chain=srcnat out-interface=pppoe-out1
/ip firewall service-port
set sip disabled=yes
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip service
set ftp disabled=yes
set telnet disabled=yes
set ssh port=2200
set winbox address=192.168.88.0/24,192.168.10.0/24,192.168.20.0/24
set api disabled=yes
set api-ssl disabled=yes
/ip smb shares
set [ find default=yes ] directory=/pub
/ip ssh
set strong-crypto=yes
/system clock
set time-zone-name=America/Toronto
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Main things I'm curious about:

Are there any gaps in my firewall rules I might have missed?
Also planning to remove the default untagged 192.168.88.0/24 — any gotchas I should watch out for before doing that?
Anything obviously wrong or inefficient?
Any general best practices I should be following?

Thanks in advance!

jaclaz · June 7, 2026, 9:30am

Usually this should be coupled with two rules in the ipv6 firewall dropping input and forward, see point #33 here:

The rationale being that IF ipv6 is enabled (by mistake or by an upgrade or by "whaetever") you have a "second line" of defense dropping everything.

TheCat12 · June 7, 2026, 1:12pm

This rule:

add action=drop chain=input comment=\
    "Block everything else" in-interface=\
    pppoe-out1

should be redacted into two ones to block mgmt access from all other VLANs as follows:

/ip firewall filter
add action=accept chain=input comment=\
    "Allow DNS input from LAN" dst-port=53 \
    in-interface-list=LAN protocol=udp
add action=drop chain=input comment=\
    "Drop all other input"

And this rule:

add action=drop chain=forward comment=\
    "Drop access to clients behind NAT from WAN" \
    connection-nat-state=!dstnat connection-state=\
    new in-interface=pppoe-out1

can be made into an allow one for port forwarding because there's an explicit drop all other forward rule at the end:

/ip firewall filter
add action=allow chain=forward comment=\
    "Allow port forwarding" connection-nat-state=\
    dstnat connection-state=new in-interface=\
    pppoe-out1

anav · June 7, 2026, 3:59pm

What is the purpose of having the 192.168.88.0/24 subnet attached to the bridge??
Once one goes VLANs, the bridge should just doing bridging not dhcp.
It would appear all your vlans are ONLY to be used to send over SPF1 to the unifi switch??
Am I to assume that you want ether2, to be on the 192.168.88 subnet???? As stated turn it into a vlan and treat it like any other vlan. What is supposed to be on the other ports??????
/interface bridge port
add bridge=bridge1 interface=sfp-sfpplus1 ingress-filtering=yes frame-types=admit-only-vlan-tagged
Neighours discovery should be set to MGMT
The off bridge ether8 should also be part of LAN interface list, aka so you can access internet from there if required. The wireguard, if its for you, aka admin only, should also be part MGMT list.
Winbox setting should be for admin only, so v10 subnet makes sense, ether8 subnet makes sense and if wireguard is admin only, then include wireguard subnet!! The other ones not so much
Missing IP address for offbridge 8, something like 192.68.77.1/30 interface=ether8 network=192.168.77.0. Then you plug your PC into ether8 change ipv4 settings to 192.168.77.2 and with username and password via winbox gain access to router.
Tool settings should be like so:
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=MGMT
The firewall rule allow home to management is nonsensical. If you want home to be management then dont make a separate management subnet. Management should be off bridge 8, wireguard coming in and the management subnet. The management subnet is what all other smart devices should get their IP from so reachable/configurable by admin only. So you need to decide if you really need a management subnet or just use home subnet as trusted subnet.
as far as firewall rules go


ip firewall filter
/ip firewall address-list
add address=192.168.30.0/24 list=FromHome  commment=iot
add address=192.168.40.0/24 list=FromeHome comment=cctv
/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input interface=lo src-address=127.0.0.1 dst-address=127.0.0.1
add action=accept chain=input comment="allow WireGuard" dst-port=12345 \
    protocol=udp
add action=accept chain=input comment="admin access" in-interface-list=MGMT
add action=accept chain=input comment="users to services" in-interface-list=LAN\
dst-port=53 protocol=udp
add action=accept chain=input comment="users to services" in-interface-list=LAN\
dst-port=53 protocol=tcp
add action=drop chain=input comment="Block all else"
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
add action=fasttrack-connection chain=forward connection-state=established,related 
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward comment="internet traffic" in-interface-list=LAN\ out-interface-list=WAN
add action=accept chain=forward comment="admin to all" in-interface-list=MGMT out-interface-list=LAN
add action=accept chain=forward comment="Allow Home to iot/cctv \
    in-interface=vlan20-home dst-address-list=FromHome
add action=accept chain=forward dst-port=554,9000,80,8000,443 in-interface=\
    vlan30-iot out-interface=vlan40-cctv protocol=tcp
add action=drop chain=forward comment="Drop all other forwarded traffic"

utensilsforks · June 10, 2026, 12:05am

Thanks for the detailed info!

Here is my updated config:

# 2026-06-09 21:22:30 by RouterOS 7.20.4
# software id =
#
# model = RB5009UPr+S+
# serial number = 
/interface bridge
add ingress-filtering=no name=bridge1 port-cost-mode=short vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] advertise=2.5G-baseT comment="ISP PPPoE WAN" \
    poe-out=off
set [ find default-name=ether8 ] comment=\
    "Dedicated unbridged port for management access"
set [ find default-name=sfp-sfpplus1 ] comment="Uplink to Unifi Switch"
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 keepalive-timeout=\
    99999 name=pppoe-out1 use-peer-dns=yes user=xxx
/interface wireguard
add listen-port=12345 mtu=1420 name=wireguard1
/interface vlan
add comment="Management (Only me)" interface=bridge1 name=vlan10-mgmt \
    vlan-id=10
add comment="Home Devices" interface=bridge1 name=vlan20-home vlan-id=20
add comment=IoT interface=bridge1 name=vlan30-iot vlan-id=30
add comment=CCTV interface=bridge1 name=vlan40-cctv vlan-id=40
add comment="Guest (WiFi only)" interface=bridge1 name=vlan50-guest vlan-id=\
    50
/interface list
add name=LAN
add comment="WAN interface list" name=WAN
add comment=Management name=MGMT
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=pool10 ranges=192.168.10.50-192.168.10.250
add name=pool20 ranges=192.168.20.50-192.168.20.250
add name=pool30 ranges=192.168.30.50-192.168.30.250
add name=pool40 ranges=192.168.40.50-192.168.40.250
add name=pool50 ranges=192.168.50.50-192.168.50.250
/ip dhcp-server
add address-pool=pool10 interface=vlan10-mgmt name=dhcp10
add address-pool=pool20 interface=vlan20-home name=dhcp20
add address-pool=pool30 interface=vlan30-iot name=dhcp30
add address-pool=pool40 interface=vlan40-cctv name=dhcp40
add address-pool=pool50 interface=vlan50-guest name=dhcp50
/ip smb users
set [ find default=yes ] disabled=yes
/system logging action
set 0 memory-lines=10000
/interface bridge port
add bridge=bridge1 frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1 \
    internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=MGMT
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,sfp-sfpplus1 vlan-ids=10,20,30,40,50
/interface list member
add comment="PPPoE WAN interface" interface=pppoe-out1 list=WAN
add comment="Management interface list" interface=ether8 list=MGMT
add comment="Management VLAN" interface=vlan10-mgmt list=MGMT
add comment="Home VLAN" interface=vlan20-home list=LAN
add comment="IoT VLAN" interface=vlan30-iot list=LAN
add comment="CCTV VLAN" interface=vlan40-cctv list=LAN
add comment="Guest VLAN" interface=vlan50-guest list=LAN
add comment="Management VLAN" interface=vlan10-mgmt list=LAN
add interface=wireguard1 list=LAN
add comment="Management ether8 internet access" interface=ether8 list=LAN
add interface=wireguard1 list=MGMT
add interface=vlan20-home list=MGMT
/interface ovpn-server server
add mac-address=FE:7A:42:00:AB:77 name=ovpn-server1
/interface wireguard peers
add allowed-address=192.168.100.2/32 interface=wireguard1 name=\
    " iPhone" public-key=\
    ""
/ip address
add address=192.168.10.1/24 comment=Management interface=vlan10-mgmt network=\
    192.168.10.0
add address=192.168.20.1/24 comment=Home interface=vlan20-home network=\
    192.168.20.0
add address=192.168.30.1/24 comment=IoT interface=vlan30-iot network=\
    192.168.30.0
add address=192.168.40.1/24 comment=CCTV interface=vlan40-cctv network=\
    192.168.40.0
add address=192.168.50.1/24 comment=Guest interface=vlan50-guest network=\
    192.168.50.0
add address=192.168.100.1/24 interface=wireguard1 network=192.168.100.0
add address=192.168.77.1/30 comment="Management ether8" interface=ether8 \
    network=192.168.77.0
/ip arp

/ip cloud
set ddns-enabled=yes update-time=no
/ip dhcp-server config
set store-leases-disk=never
/ip dhcp-server lease

/ip dns
set allow-remote-requests=yes mdns-repeat-ifaces=\
    vlan20-home,vlan30-iot,vlan40-cctv servers=8.8.8.8,1.1.1.1
/ip firewall address-list
add address=192.168.30.0/24 comment=IoT list=FromHome
add address=192.168.40.0/24 comment=CCTV list=FromHome
/ip firewall filter
add action=accept chain=input comment="Accept established,related,untracked" \
    connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input comment="Allow ICMP" protocol=icmp
add action=accept chain=input comment=Loopback dst-address=127.0.0.1 \
    in-interface=lo src-address=127.0.0.1
add action=accept chain=input comment="allow WireGuard" dst-port=12345 \
    protocol=udp
add action=accept chain=input comment="Admin access" in-interface-list=MGMT
add action=accept chain=input comment="LAN DNS UDP" dst-port=53 \
    in-interface-list=LAN protocol=udp
add action=accept chain=input comment="LAN DNS TCP" dst-port=53 \
    in-interface-list=LAN protocol=tcp
add action=drop chain=input comment="Block everything else"
add action=fasttrack-connection chain=forward comment=\
    "Fast-track for established,related" connection-state=established,related \
    hw-offload=yes
add action=accept chain=forward comment="Accept established,related" \
    connection-state=established,related
add action=drop chain=forward connection-state=invalid
add action=drop chain=forward comment=\
    "Drop access to clients behind NAT from WAN" connection-nat-state=!dstnat \
    connection-state=new in-interface=pppoe-out1
add action=accept chain=forward comment="Allow internet access" \
    in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="WG to VLANS" in-interface=wireguard1 \
    out-interface-list=LAN
add action=accept chain=forward comment="Admin to ALL" connection-state=new \
    in-interface-list=MGMT out-interface-list=LAN
add action=accept chain=forward comment="Allow Home to IoT/CCTV" \
    dst-address-list=FromHome in-interface=vlan20-home
add action=accept chain=forward comment="Allow Management to Home" disabled=\
    yes in-interface=vlan10-mgmt out-interface=vlan20-home
add action=accept chain=forward comment="IoT to CCTV" dst-port=\
    554,9000,80,8000,443 in-interface=vlan30-iot out-interface=vlan40-cctv \
    protocol=tcp
add action=drop chain=forward comment="Drop all other forwarded traffic"
/ip firewall nat
add action=masquerade chain=srcnat out-interface=pppoe-out1

/ip firewall service-port
set sip disabled=yes
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip service
set ftp disabled=yes
set telnet disabled=yes
set ssh port=2200
set winbox address=\
    192.168.10.0/24,192.168.20.0/24,192.168.77.0/30,192.168.100.0/24
set api disabled=yes
set api-ssl disabled=yes
/ip smb shares
set [ find default=yes ] directory=/pub
/ip ssh
set strong-crypto=yes
/system clock
set time-zone-name=America/Toronto
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=MGMT

# Note: The following are configured and active (visible in Winbox) but do not appear in export:

# 1. /interface bridge port sfp-sfpplus1 ingress-filtering=yes

For VLAN 10 I have it so some services like unifi os, proxmox and physical server sit on .10 and personal devices and such go on VLAN 20. Do you think its redundant and I should just combine those two vlans for home use?

Any other suggestions or missing? All going uplink to unifi switch.

infabo · June 10, 2026, 12:14am

because ingress-filtering=yes is the default.

jaclaz · June 10, 2026, 8:35am

The plain export only shows the settings that are non-default.
To check fully a setting (don't do this on the whole device unless you really want to) you need to use the "verbose" modifier, i.e.:

/interface bridge port
export verbose

or

/interface bridge
export verbose

utensilsforks · June 14, 2026, 3:13pm

@anav just following up to see if you have any further tips or its ok?

anav · June 19, 2026, 1:20pm

Looks good not quite optimal in forward chain still have extra not needed rules.
Note MGMT interface includes wireguard users! connection=new is redundant and not needed.
MGMT interface rule allows v10 to v20 and v20 to v10 for that matter.

Should look like
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward comment="Allow internet access" \
in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="Admin to ALL" \
in-interface-list=MGMT out-interface-list=LAN
add action=accept chain=forward comment="Allow Home to IoT/CCTV"
dst-address-list=FromHome in-interface=vlan20-home
add action=accept chain=forward comment="IoT to CCTV" dst-port=
554,9000,80,8000,443 in-interface=vlan30-iot out-interface=vlan40-cctv
protocol=tcp
add action=drop chain=forward comment="Drop all other forwarded traffic"

S8T8 · June 19, 2026, 2:02pm

I would be very careful before blindly adding firewall rules for IPv6 , requirements for Fast Path is no firewall rules (Packet Flow in RouterOS | RouterOS Manual).
I get your point for suggesting and my router also had in / out drop IPv6 rules.
In case those rules are added to a switch, performance are degraded a lot, an expert user like you already know, but a novice may complain.

anav · June 19, 2026, 2:33pm

???????????? Not sure what you mean @S8T8

IPV6 is disabled in his settings.
The only reason to have the two
Input and forward chain drop all rules is for the very rare chance that on an upgrade or router burp the IPV6 settings parameter is changed to enabled (or operator error).