firewall prerouting

RouterOS Beginner Basics
1

I have strange behavior.

MikroTik: 10.254.254.253
VPN users: 172.16.0.0/16

in ip firewall filters I have this rule for ssh & winbox

add action=reject chain=services comment=“Reject fule for ‘services’ ports” dst-port=8291 log=yes log-prefix=Winbox protocol=tcp reject-with=tcp-reset src-address-list=!whitelist
add action=reject chain=services connection-state=new dst-port=22 log=yes log-prefix=SSH protocol=tcp reject-with=tcp-reset src-address-list=!whitelist

Network 172.16.0.0/16 isn’t added to whitelist at all because it’s the aggregation of two subnets , 172.16.0.0/24 and 172.16.1.0/24. So I’ve added it to FIREWALL RAW
And so I’ve added

add action=notrack chain=prerouting dst-address=10.254.254.253 log=yes log-prefix=notrack src-address=172.16.0.0/24

And when SSH works fine and I see on notrack logs that I can get in but doesn’t appear to be the same with Winbox which doesn’t work at all.

It gets logged by Winbox firewall rule and also it is passed to prerouting rule.
Strange because if I disable that prerouting rule completely and of course VPN networks aren’t whitelisted in address-list than I get what I supposed to get

ssh: connect to host 10.254.254.253 port 22: Connection refused

And I see in the logs:

Why SSH works on prerouting and Windbox Doesn’t?

2

Your SSH rule does not work because you are trying to use connection tracking features for non tracked connection (hint connection-state=new ).

3

A better way to approach this is not to show us any configuration but put in words what functionality you would like to have without discussing solution.

ex.
I want to only allow SSH and winbox connections outbound (lan to wan) for the admin only.

Second, express your concerns.
I am afraid of…
Or I want to ensure that X doesnt happen…

4

I know that but that’s not what I’m asking. I was asking about Winbox. Why Winbox doesn’t work if it also included in that no track rule the same as for SSH. SSH it’s not my concern here. It works like I wanted. If set rule for network which isn’t whitelisted in /ip firewall raw SSH let me through but Winbox doesn’t. Question is Why?

5

I already did.

6

That is a problem because you think you explained what you wish to accomplish and all you did was ask why isnt some configuration working and the unexpected results you are getting.
None of which has anything to do with your requirements. As I requested state your requirements on a use case basis without referring to the configuration or solution at all.
Posting your config will show us how you attempted to address the requirements.
/export hide-sensitive file=yourconfigmar01

7

It was already explained like I said.