Yes, if you largely re-use firewall, then you have to setup and maintain both interface lists.
Your own approach (if executed carefully) works as well, but lacks flexibility (e.g. if your LAN is more than bridge1-LAN or if your WAN interface changes (to e.g. VLAN interface or PPPoE or something).
I prefer not trying to be too cute. Avoid ! rules unless they are required as its clearer to state what traffic is needed!1
So From:
/ip firewall filter
add action=accept chain=input comment=“accept established, related” \ connection-state=established,related
add action=drop chain=input comment=“drop invalid” connection-state=invalid
add action=accept chain=input comment=“accept ICMP” protocol=icmp
add action=drop chain=input comment=“drop all not coming from LAN” \ in-interface=!bridge1-LAN
add action=accept chain=forward comment=“accept established, related” \ connection-state=established,related
add action=drop chain=forward comment=“drop invalid” connection-state=invalid
add action=accept chain=forward comment=“accept in ipsec policy” \ ipsec-policy=in,ipsec
add action=accept chain=forward comment=“accept out ipsec policy” \ ipsec-policy=out,ipsec
add action=drop chain=forward comment=“drop all from WAN not DSTNATed” \ connection-nat-state=!dstnat in-interface=ether1-Internet
TO:
/ip firewall address-list
add address=192.168.88.X list=Authorized comment=“Admin PC”
add address=192.168.88.Y list=Authorized comment=“Admin laptop/ipad”
add address=192.168.88.Z list=Authorized comment=“Admin smartphone”
/ip firewall filter
add action=accept chain=input connection-state=established,related**,untracked**
add action=drop chain=input comment=“drop invalid” connection-state=invalid
add action=accept chain=input comment=“accept ICMP” protocol=icmp
add action=accept chain=input comment=“admin access” src-address-list=Authorized
add action=accept chain=input comment=“users to services” in-interface-list=LAN dst-port=53 protocol=udp
add action=accept chain=input comment=“users to services” in-interface-list=LAN dst-port=53 protocol=tcp
add action=drop chain=input comment=“drop all else” { add as very last rule }
+++++++++++++++++++++++++++++++++++
add action=fasttrack chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward comment=“drop invalid” connection-state=invalid
add action=accept chain=forward comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat disabled=yes { enable if required or remove }
add action=drop chain=forward comment=“drop all else”
Thanks a lot for your replies mkx and anav, very helpful! I tried both configs, but I have a few questions regarding your rules anav:
- Instead of authorising every device, can I also just authorise my entire LAN range or is this bad practice? My config would then be as follows:
/ip pool
add name=dhcp_pool1 ranges=177.22.12.0-177.22.12.254
/ip firewall address-list
add address=177.22.12.0/24 list=Authorized
Otherwise, if I am not mistaken, I would need to set static IPs for my admin devices.
-
Is untracked necessary? The rule also seems to work without it. What is the benefit of including untracked?
-
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat disabled=yes { enable if required or remove }
Does your comment mean that this rule can be disregarded and left out, if everything works as intended without the rule?
Yes, that is the whole point, you use static DHCP leases for trusted devices and only they require access on the input chain.
The LAN only requires access to specific services normally DNS and sometime NTP.
Yes if not doing port forwarding, then the rule can be removed.
Read the posts by SINDY, on this thread… http://forum.mikrotik.com/t/firewall-rule-ordering-best-practices-other-questions/178088/1
Thanks a lot again anav!
Other rookies, below you can find a little summary of the inputs above. Hope it helps (LAN IP can be changed of course and the MAC address is device specific; if port forwarding is also needed see anav´s post #22):
/interface ethernet
set [ find default-name=ether1 ] name=ether1-WAN
set [ find default-name=ether2 ] disabled=yes name=ether2-LAN
set [ find default-name=ether3 ] disabled=yes name=ether3-LAN
set [ find default-name=ether4 ] disabled=yes name=ether4-LAN
set [ find default-name=ether5 ] disabled=yes name=ether5-LAN
/interface bridge
add name=Bridge-LAN
/interface bridge port
add bridge=Bridge-LAN interface=ether2-LAN
add bridge=Bridge-LAN interface=ether3-LAN
add bridge=Bridge-LAN interface=ether4-LAN
add bridge=Bridge-LAN interface=ether5-LAN
add bridge=Bridge-LAN interface=Wifi2-2.4ghz
/interface list
add name=WAN
add name=LAN
/interface list member
add interface=ether1-WAN list=WAN
add interface=Bridge-LAN list=LAN
/ip pool
add name=dhcp_pool1 ranges=109.33.48.20-109.33.48.254
/ip address
add address=109.33.48.1/24 interface=Bridge-LAN network=109.33.48.0
/ip dhcp-server
add address-pool=dhcp_pool1 interface=Bridge-LAN name=dhcp1
/ip dhcp-client
add interface=ether1-WAN
/ip dhcp-server lease
add address=109.33.48.11 client-id=1:XX:XX:XX:XX:XX:XX comment=ADMIN
mac-address=XX:XX:XX:XX:XX:XX server=dhcp1
/ip dhcp-server network
add address=109.33.48.0/24 dns-server=109.33.48.1 gateway=109.33.48.1
/ip dns
set allow-remote-requests=yes
/ip firewall address-list
add address=109.33.48.11 comment=ADMIN list=Authorized
/ip firewall filter
add action=accept chain=input comment=“accept established,related,untracked”
connection-state=established,related,untracked
add action=drop chain=input comment=“drop invalid” connection-state=invalid
add action=accept chain=input comment=“accept ICMP” protocol=icmp
add action=accept chain=input comment=“admin access” src-address-list=
Authorized
add action=accept chain=input comment=“users to services” dst-port=53
in-interface-list=LAN protocol=udp
add action=accept chain=input comment=“users to services” dst-port=53
in-interface-list=LAN protocol=tcp
add action=drop chain=input comment=“drop all else”
add action=fasttrack chain=forward connection-state=established,related
add action=accept chain=forward comment=
“accept established,related,untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“drop invalid” connection-state=invalid
add action=accept chain=forward comment=“internet traffic” in-interface-list=
LAN out-interface-list=WAN
add action=drop chain=forward comment=“drop all else”
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1-WAN
hi, I am also interested in this. Are the summary settings in the last post above safe to use or is anything missing or should anything be modified?
anyone?
It is fine for the basic generic setup the OP was looking for in terms of:
TAKING the default firewall set of rules and
a. make them efficient
b. change concept to block all and identify needed traffic above block all rule.
If its good for your scenario, if different from a single subnet one bridge then one would have to make more adjustments.
Hi anav, thank you. In this case I will use whuupwhuup´s config as is
follow-up question, if i want make ipv6 as secure as possible, meaning not used at all or blocked entirely, will
/ipv6 settings set disable-ipv6=yes
be enough?
Or is it better to have it enabled and set the firewall rules below?
/ipv6 firewall filter
add action=drop chain=input comment=“Drop all IPv6 ICMP traffic” protocol=icmpv6
add action=drop chain=input comment=“Drop all other IPv6 traffic”
add action=drop chain=forward comment=“Drop all IPv6 forward traffic”
add action=drop chain=output comment=“Drop all IPv6 output traffic”
/ipv6 nd
set [ find default=yes ] disabled=yes
if so are the rules effective or is something missing?
anyone else which would have insights on this? anav seems busy