I’m relative newby to Mikrotik, so this maybe a simple question, but I hope someone can help me out.
I’m trying to create a base setup that I can use in multiple environments and am currently playing around on my 750G r3 to increase my knowledge. I have setup the Filter Rules to allow access to the internet to a bridge called LAN-WIFI. Here are the rules:
My question is in the example above you can see that there is a drop rule for anything not on the LAN-WIFI bridge. If I were to introduce another subnet on another Bridge to handle a DMZ type network, how can I do that without including the new subnet in the LAN-WIFI bridge?
/ip firewall filter
add action=drop chain=input comment=\
"M7 Default Rule: Drop all NOT coming from LAN" in-interface=!LAN-WIFI
can be transcribed to two rules:
/ip firewall filter
add action=accept chain=input comment="M7 Default Rule: allow all coming from LAN" in-interface=LAN-WIFI
add action=drop chain=input comment="ultimate rule: drop anything not explicitly accepted by previous rules"
With changed rules it’s easy to add another rule accepting appropriate traffic from other in interfaces by placing it above the last “drop all” rule. And be as specific as it gets (e.g. only accept UDP ports 123 and 53 - that’s NTP and DNS).
Another possibility is to use interface lists … so instead of “… in-interface=!LAN-WIFI” you would use … in-interface-list=!LAN-interfaces". However I find the “not” rules a bit unflexible replacement for the two rules I wrote above.
Sorry to be a pain, but I have one more question regard the multi subnet setup.
If I wanted to have the LAN subnet (bridge LAN-WIFI), let’s say 10.0.10.0/24 have one way access to the Security Camera subnet of 192.168.18.0/24 (bridge SEC-SYS) how can this be achieved? I don’t want the security system to be able to have access to the LAN side of things, but I want the LAN side to be able view the cameras and administer the Security system via HTTP.
Typically I recommend narrowing down access only to those that need it ->> if not all users require access and that access is only required for a few IPs, make two firewall address lists. Access and Cameras.
(2) An ‘allow’ rule only permits ORIGINATED traffic to reach the other side. Return traffic (answers to the query are permitted as RELATED traffic). Thus the camera system would only be able to answer requests from the lan wifi bridge. The camera would not be permitted to originate traffic and send it to the bridge
Note: All rules I have are predicated upon the fact that all traffic is dropped by my last rule in the forward chain ( a drop all rule ), and thus I have only to make allow rules for the traffic I wish to allow above this rule.
Thanks anav. I’ve noted that, but it doesn’t matter where I place the forward rule, I can access both side of the connection from either side. It doesn’t make sense. I’ve even placed this rule last and still can access both sides.