deactivate management GUI on Wi-Fi - how to

RouterOS Beginner Basics
1

Hi,

For security reasons, I would like to deactivate the possibility of entering the router’s management console (navigator GUI) through a Wi-Fi connection (and only allow it through the Ethernet interfaces). What is the easiest way of doing this?

On another topic, if anyone knows an easy way of running Winbox on a Mac, this would also help. I’ve gone through some forums proposing different methods. Silly question… Why do I need Winbox if I can configure the router through it’s HTTP interface?

Any help is warmly welcome! No need to say I’m an absolute beginner :smiley:

Thanks in advance

2

If your WiFi is a separate network from the wired lan, then use an input filter chain rule to block dst-port=80 in-interface=wlan1

If you’re using a bridge to make the wlan and wired lan be one single network, then you’re going to have to set your bridge to use IP firewalls, and then in the bridge filter rules, create a rule with chain=input in-bridge=LAN Mac Protocol=800(ip) protocol 6(tcp) dst port=80 in-interface=wlan1 action=drop

3

so to understand if we tick yes to bridge use ip firewall the firewall rules that are applied are from ip firewall filter or from bridge filters?

4

You would filter the traffic in bridge filters. You’ll notice that the IP filtering criteria are greyed out if you don’t enable the use ip firewall option.

5

i didnt understand what and where is grey out when bridge ip firewall is off
if i understand if we have bridge ip firewall set to “off” then bridge filters only are executed.
if we have bridge ip firewall set to “on” then bridge filters AND ip firewall filter rules are executed. right?

6

Hmm - it looks like I was mistaken about the grey-out in bridge filters.
Even without setting “use ip firewall” - I can use the IP src/dst/protocol/port fields.
What was throwing me off was that when I expanded the MAC Protocol section, IP was selected by default, but the IP sections’s fields were greyed out. When I selected IP specifically in the MAC Protocol-Num field, then the IP section’s fields became available.

I was thinking you had to enable IP firewall on the bridge to get those fields to stop being greyed out…

I’d say to use the bridge filter since it’s able to specify the in-interface of the bridge explicitly. I’ve never personally needed to enable use IP filters for bridging so perhaps someone who’s used that feature specifically might shed a little more light on the differences between the two mechanisms.

If it were me, I’d just use the bridge filter rules:

/interface bridge filter
add chain=input action=drop dst-port=80 in-bridge=LAN in-interface=wlan1 ip-protocol=tcp mac-protocol=ip
add chain=input action=drop dst-port=22 in-bridge=LAN in-interface=wlan1 ip-protocol=tcp mac-protocol=ip
add chain=input action=drop dst-port=8291 in-bridge=LAN in-interface=wlan1 ip-protocol=tcp mac-protocol=ip

If you just want to block everything, be sure to make an allow rule for DHCP clients.

Perhaps this code is only effective if “use IP firewall” is set…