I build my first MikroTik firewall, would like to check if I missed anything major or over-engineered it
Goal is to;
Allow internet for the LAN Clients
Allow Wiregaurd remote VPN with Access to the other LAN Clients
Allow a port DNAT for only certain IP Address
Drop everything else
/interface list
add name=WAN
add name=LAN
/interface list member
add interface=internet list=WAN
add interface=bridge1 list=LAN
add interface=wireguard1 list=LAN
/ip firewall filter
add action=accept chain=forward comment="Allow new connections to the internet from LAN" connection-state=new in-interface-list=LAN
add action=accept chain=forward comment="Allow established,related,untracked" connection-state=established,related,untracked
add action=accept chain=forward comment="Allow port 8086 only for the address list Remote_Probes" dst-port=8086 protocol=tcp src-address-list=Remote_Probes
add action=drop chain=forward comment="Drop All Forwarded"
add action=accept chain=input comment="Allow DNS traffic from LAN to router" in-interface-list=LAN port=53 protocol=udp
add action=accept chain=input comment="Allow DNS traffic from LAN to router" in-interface-list=LAN port=53 protocol=tcp
add action=accept chain=input comment="Allow WireGuard traffic" dst-port=13231 protocol=udp
add action=accept chain=input comment="Allow traffic from LAN interface list to the router" in-interface-list=LAN
add action=drop chain=input comment="Drop All New"
/ip firewall nat
add action=masquerade chain=srcnat comment="Enable NAT on WAN interface" out-interface-list=WAN
add action=dst-nat chain=dstnat comment="Destination NAT to forward traffic on port 8086 to 172.16.10.3" dst-port=8086 in-interface-list=WAN dst-nat protocol=tcp to-addresses=172.16.10.3 to-ports=8086
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set h323 disabled=yes
set sip disabled=yes
You’re following the concept “allow what’s needed, drop everything else”, which is good.
From performance point of view your rules would benefit of some reworking. Rules are evaluated top-to-bottom (inside each chain) so performance-wise it’s good to make rules, which will deal with most packets, higher on the list. You’re missing fasttrack rules (those particularly boost performance). Default firewall rule set is very good at these aspects, so I’m recommending you to have a look at default and try to understand how it performs. And then adjust your firewall rules accordingly.
Personally I’d start from default (not only it’s good performance wise, it’s also pretty secure) and adjust/add needed rules. Starting from scratch does sound fun, but it’s easier to miss things as well.
Keep chains together and order is important overall. One should have a source originating traffic and an endpoint destination for that traffic.
Traffic that is port forwarded should not normally be placed in forward chain but in dstnat chain. The fw forward chain only needs a general rule allowing port forwarding.
