From Mikrotik to Ubiquiti UniFi and back to Mikrotik

RouterOS General
21

As for the config.
(1) This is new in that have not seen this set before…???
/ip firewall connection tracking set enabled=yes

(2) Missing dns-server for IOT vlan ???
/ip dhcp-server network
add address=10.10.1.0/24 comment=VPN gateway=192.168.73.1 netmask=24
add address=10.10.50.0/24 comment=“VLAN500 IoT Network” gateway=10.10.50.1 \ Dns???
netmask=24
add address=192.168.73.0/24 comment=defconf dns-server=192.168.73.226
gateway=192.168.73.1 netmask=24

(3) Purpose of all these being allowed to router?? Why are they all admin IT folks??
/ip firewall address-list
add address=192.168.73.2-192.168.73.254 list=allowed_to_router
add address=10.10.50.2-10.10.50.254 list=allowed_to_router
add address=10.10.1.1-10.10.1.10 list=allowed_to_router

(4) Input chain rules can be simplified, so many block rules, JUST use as last rule a drop all else rule!
As to the above (3), the allowed list SHOULD ONLY BE FOR ADMIN ACCESS.
you will still need the LAN users to access DNS services of the router.

Adjusted the order…

ip firewall filter
add action=accept chain=input comment=
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=
“address-list for IP addresses, that are allowed to access router;”
src-address-list=allowed_to_router
add action=accept chain=input comment=VPN dst-port=1194 protocol=tcp ???******
add action=accept chain=input comment=“Allow LAN DNS queries - TCP”
connection-state=new dst-port=53 in-interface-list=LAN protocol=tcp
add action=accept chain=input comment=“Allow LAN DNS queries-UDP”
connection-state=new dst-port=53 in-interface-list=LAN protocol=udp
add action=drop chain=input comment=“drop all else”

What is the purpose of the VPN rule, just asking as its a non-standard ipsec port…

(5) Forward chain rules… Moved Forward chain vlan rule mixed in with input chain rules further down, The Vlan500 rule is not required as you have it covered with the drop all rule at the end of the forward chain. Destination NAT rule is also not required in a drop format as you have the drop rule at the end covering that. So I modified it to allow DST NAT in the accept format.

add action=accept chain=forward comment=“defconf: accept in ipsec policy”
ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy”
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related
add action=accept chain=forward comment=
“defconf: accept established,related, untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid”
connection-state=invalid
add action=accept chain=forward comment=“Forward VPN to LAN” dst-address=
192.168.73.0/24 src-address=10.10.1.0/24
add action=accept chain=forward comment=“allow port forwarding”
connection-nat-state=dstnat connection-state=new in-interface-list=WAN
add action=drop chain=input comment=
“Drop any input packets that get this far”

22

Not sure what that is. I assume that is a default setting as I don’t recall enabling this.


For the networks without DNS explicitly set, it appears they get the DNS as the gatewayIP and the .226 server which i have set as my DNS server (PiHole). Sincethe time i posted this, i explicitly set a DNS address(.226) for the VPN Network.


I thought this was to allow traffic through the router…this is new to me. Should i remove this address list and firewall rule all together? I assume i will still be able to manage the router from the webfig correct?


I will work on adjusting the order of the rules. Most of those are default rules that were set up with the router.


I will add the Allow LAN DNS rules you put in BOLD. This might be why something i was playing with (Static DNS) wasnt working. :smiley:


The VPN rule was just what the OpenVPN instructions i found had in the instructions. (https://www.micu.eu/ovpn-server/)


I will have to read through this a bit to make sure i cover all the rules. Thank you for the review.


Thank you for reviewing this. I really appreciate it. Coming from Ubiquiti i never saw all the rules written out. This is quite a learning experience.

23

it is the switch i had so i used it. I was thinking of getting a different one. Somehow though i got it to work. I created a VLAN (50) for ports 5-8 untagged, tagged port1 if i revcall and then PVID 50 on port 5-8. i just tried to get to the management webpage though and cant now…so…on to figure that out.


Do you recommend a switch to put in the TL place? I was just going to order an RB260GS however i will use up all the ports on it. Maybe the CSS610 but dont know much about the cloud switches

24

When you add the drop all rule at the end of the INPUT CHAIN as recommended,
AND you dont have allow rules for the admin to access the router, prior to that last rule you will be locked out of the router
I just didnt understand the purpose of the allow list you had as it didnt seem to be related to Admin access for example.
The only thing users typicallky need access to on the router is DNS services.

25

:slight_smile: I did just that…locked out of router but luckily had a terminal session open to the router and could re-enable the rule.

26

I dont know what i did but now my IoT network cant get anywhere. I can connect to it and it gets the right IP address and DNS but no internet. some really weird stuff going on now too. i put everything back to what it was and no luck.

dang…i should have stopped while ahead



got it going again…now back to the suggestions :slight_smile:

27

I probably should have stated this up front…some of the firewall rules i added were suggested by the internet…like the block dns from WAN and again…i have never written firewall rules before…or dug this deep into it.

if i understand the input chain…anything coming into the router that isnt explicitly allowed will be dropped when it hits my ‘drop all else’ rule so in regards to someone on the internet doing a DNS query on my public IP…it would drop because there was no accept rule for it in the input chain.

I also understand the forward chain is kind of the same way though it applies to traffic/packet for another NIC on the local network. For packets routed through the local server.

what it looks like what i dont understand is that i have a rule that is forward VPN to LAN, which i thought i needed however i dont. i turned that rule off and can still get to my LAN from VPN. This leads me to test the ‘drop VLAN50’ and find that unless that is turned ON that i can get to my LAN from VLAN. this leads me to think that traffic is allowed unless explicitly dropped (like i was doing with DNS from WAN).

is input drop unless explicitly allowed and forward allow unless explicitly dropped?

anav, you indicated that the drop at the end of the list would take care of the VLAN50 rule. it was set on the input chain (duplicate of one above) so i switched it to the forward chain but that didnt allow me to access the internet but could get to the local LAN (from LAN) do i disabled it.

This is where i am getting confused. Please take a look at my FW rules
FW.2021.06.22.txt (2.89 KB)
and see if you can see what i am missing. it works the way it is set up right now but i want to make sure i am not doing something that will get me in trouble later.

28

I dont like looking at parts of a config only as they are all related… and its not in winbox export format either??
You have added some of the new rule but kept the old ones which in the end does not do the job.

29

Thanks anav. I thought it would be easier to review just doing a /ip firewall filter print to a file than the whole thing. I have attached my current export.

I added all the new rules and thought I removed/disabled the ones you recommended. Which ones do you see that are causing an issue.

These are the differences in the input chain from what you recommended.
Rule 0 (Fasttrack)…should this be removed?
Disabled(not removed) 6 and 7 (drop external DNS queries)
Rule 10, accept to local loopback (for CAPsMAN) i kept since it was a default rule. i don’t know if i need it or not since i don’t use CAPsMAN
Rule 11, drop all not coming from LAN, default rule so i kept this

These are the differences in the forward chain from your recommendation…
Rule 18, I disabled(though you kept) the Forward VPN to LAN because it seems like i didn’t need it. I could VPN in from my phone and get to stuff on my 192.168.72.0 network.
Rule 19, i disabled the default rule drop all from WAN not DSTNATed at your suggestion ‘do not use the drop format and use the accept format’, your allow port forwarding rule which is Rule 21 is enabled.
Rule 20 i kept enabled as it didn’t seem rule 23 was dropping VLAN50->LAN traffic. If i understood your recommendation, rule 20 wasn’t needed because of rule 23 however in testing, if 23 is enabled and 20 disabled, i am able to get to the LAN from VLAN50 however as soon as i re-enable 20 it is blocked.
Rule 22 is disabled, i was just messing around with drop rules that didn’t work
Rule 23 is the last rule you recommended (added this AM) that drops any input at that point.

So, in the end, i think i implemented all of your recommendations and explained why i implemented the differences. From what i have tested it seems to ‘work’ meaning i can get to what I want and cant get to what i don’t want. However I just don’t want people that shouldn’t get to stuff to have access to stuff :-). In the quoted post you end with “does not do the job” and that is what i want to understand…what am i missing…what part of the job am i failing at. I am very thankful that you are taking your time to help me. Thank you Thank you Thank you!


CyBuzz
2021.06.23.2.rsc (8.19 KB)

30

(1) /ip dhcp-server network
add address=10.10.1.0/24 comment=VPN dns-server=192.168.73.226 gateway=
192.168.73.1 netmask=24
add address=10.10.50.0/24 comment=“VLAN500 IoT Network” gateway=10.10.50.1
netmask=24

dns server for vlan500, ???


(2) Get rid of these… not required
add action=drop chain=input comment=“Drop external DNS requests” disabled=yes
dst-port=53 in-interface=ether1 protocol=tcp
add action=drop chain=input comment=“Drop external DNS requests” disabled=yes
dst-port=53 in-interface=ether1 protocol=udp

(3) Yes you can delete this if you dont use capsman
add action=accept chain=input comment=
“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1

(4) Delete this rule…it serves no purpose
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
in-interface-list=!LAN

WHY BECAUSE THE DROP ALL RULE follows it!!!
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
in-interface-list=!LAN
add action=drop chain=input comment=“drop all else”

(5) Duplicate input chain rule at the very bottom of the forward chain can be removed…
add action=drop chain=input comment=
“Drop any input packets that get this far”

(6) These two rules can be removed… as you already have port forwarding handled and with the drop all rule vlan to subnet traffic is automatically blocked at L3.
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new disabled=yes in-interface-list=WAN
add action=drop chain=forward comment=
“Drop any traffic from VLAN50 not going to the internet” in-interface=
vlan50 out-interface=!ether1

(7) What is missing is a forward chain rule to allow LAN to WAN traffic.

31

Thanks anav.

Attached is my new export.

Your Recommendations:

  1. Added DNS servers
  2. Deleted rules “Block external DNS”
  3. Deleted rule “loopback for capsman”
  4. Deleted rule “default drop if not coming from LAN”
  5. Deleted rule “drop all input” duplicate
  6. Deleted rules “drop WAN not DSTNATed” and “drop VLAN50 not to internet”
  7. Added rule to allow LAN to Internet(ether1)

I also added a drop forward chain rule at the end to drop anything that gets that far. I did this to ‘match’ the input chain rule. Doing so, blocked my VLAN from getting to the internet so i added a rule to allow that. When I set up the LAN to WAN forward i did it bridge → ether1 in hopes this covered the VLAN50 (it is listed as an interface under bridge) but it didnt work, probably my lack of VLAN/router/bridge knowledge. I also had to set up an all ppp (VPN) to internet(ether1) so i could get out to the internet.

Again, thank you for the time you are spending working through this with me.
2021.06.23.4.rsc (7.58 KB)

32

This is too funny but my spidey sense just tingled!!!

I was looking at why you still had this rule…
add action=accept chain=forward comment=
“Allow VLAN50 traffic to the internet(ether1)” in-interface=vlan50
out-interface=ether1

You have defined vlan50 as being part of the bridge but HAVE NOT DEFINED WHICH PORTS the vlan will use?
To be honest I get confused by people who
a. use the bridge do dhcp
b. then use separate vlan to do dhcp etc.
I prefer to use vlans for all traffic except maybe keeping one port for emergency access off the bridge.

Oh and yes a VLAN is NOT a bridge port and thus this line must be removed…
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10
add bridge=bridge comment=defconf interface=sfp-sfpplus1
add bridge=bridge comment=VLAN50 interface=vlan50

Be that as it may it should be doable as basically you have the bridge giving out DHCP on all the etherports which is fine.
We just need to define which ports you want your vlan to run on and
a. if the port is going to a dumb device OR
b. if the port is going to smart device.

So please let me know where v50 is going and to what devics??

33

Additional points..

(1) I don’t have this rule on my config set on my router, nor have seen it on other config, so just stating not sure what that does??
/ip firewall connection tracking
set enabled=yes
I checked on winbox, and the closest thing I could find was
IP Firewall CONNECTIONS TAB, there is a box selection for tracking when I click on that the entries are AUTO and loose TCP tracking is checked.
The loose tcp tracking maybe related to the fact that under services I have RP Filter: “Loose” as the selection.
Funny nothing shows on the config line so maybe tis so minor as not required to mention??
In any case probably fine leaving as it is.

The second one can be set to LAN no harm.
/ip neighbor discovery-settings
set discover-interface-list=none

(2) For security purposes recommended to DISABLE , there is no reason I am aware of to make such services available.
ip service
set telnet address=192.168.73.0/24 disabled=yes
set ftp disabled=yes
set www address=192.168.73.0/24,10.10.1.0/24 port=8080
set ssh address=192.168.73.0/24 port=2200
set www-ssl address=192.168.73.0/24
set api address=192.168.73.0/24 disabled=yes
set winbox address=192.168.73.0/24
set api-ssl address=192.168.73.0/24 disabled=yes

(3) for Winbox access this should be set to LAN or MANAGEMENT and since VLAN50 is part of LAN recommend creating a Management interface listing.

/tool mac-server mac-winbox
set allowed-interface-list=Management

/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=Management

/interface list member
add comment=“defconf - WAN” interface=ether1 list=WAN
add comment=“VLAN50 for IoT Network” interface=vlan50 list=LAN
add comment=“defconf - LAN” interface=bridge list=LAN
add interface=bridge list=Management

34

What was last MikroTik AP you deployed and tested against Unifi lineup? MT getting better and making a “SLOW” comeback…

I no longer trust UBT.

Back to OP Topic -

Great success on your transition over to the RB4011.

35

anav, thank you for that reply. It is a lot to consume. I will take a look and see what i can comprehend tonight. it sounds like i have set up my router and bridge incorrectly and i have many questions about that…remember…i am very new to this and it doesnt surprise me that i may have done something wrong :-). I think i read in another post that you have a similar set up (UBNT APs, Switch and 4011). can you share your config with me so i can take a look?

I will try and get a diagram put together if that will help.

CyBuzz

36

yes the diagram will be very helpful.
No your config is not that far off the mark and its a matter, as usual, of understanding the requirements correctly which then a design can be prescribed.

37

This is my inexperience with setting this up. If i need to set up a vlan for all traffic then i will have to figure out how that will work. I also am not quite sure i understand the bridge or its purpose. I thought it was just a grouping for whatever interfaces you put in it so i could create Bridge1 to house ports 2-5 and Bridge 2 to house ports 6-10…not sure if that is right thought.


I removed this VLAN from the bridge


Again, my lack of knowledge shows through here. my VLAN50 is ‘defined’ in my access points on particular SSIDs. For the UAP-nanoHDs i created a network in the controller software called IOT and made it a VLAN 50 and then the SSIDs are on that network. In my TPLink EAP225 i enabled VLAN on the SSIDs and gave them a VLANID of 50. I then set up the VLAN in the router with an interface, address, DHCP, etc. I am not sure what you mean by what port. the port that the EAP-225 comes in on is port 10 on the router and the UAP-nanoHDs are on ports on the US-16-150W. There are also SSIDs that arent on a VLAN on each of the access points. I am not sure what you mean by a smart/dumb device. When i get my RB260GSP i am going to make 3 of those ports VLAN50 and the others not on a vlan(normal network). would the APs and RB260 be ‘smart’ devices? Does the router need to know what port that device is on even through there are VLANed and non VLANed interfaces on it?

Attached is a rough network diagram. I have never done one of these before so be kind :slight_smile:


I dont use WinBox as I am on a linux machine. I use webfig and it is also under firewall/connections/tracking. Loose TCP tracking is checked on the tracking screen.


I will make that change


i need the www ones there because i use the webfig not winbox


I am not quite sure i follow this Management interface. On that note, should i have made a VLAN50 interface list for my IoT VLAN?

Anyway, thanks for your help…yet again.
Visio-ND.vsd.pdf (229 KB)

38

Very nice diagram!
Questions.

  1. Do you have a guest wifi for visitors?
  2. Why do you have some devices on your home lan, like direcTV, ip camera, roku etc. Put them on a media VLAN for example.
    In general you should shave off any devices that you do not control that has internal software from the home network (non-trusted) devices but not necessarily evil though.
  3. Why do you not have a separate work network, if one or the other is infected one should ensure appropriate barriers are in place to prevent contamination in either direction but mostly home to work for example.

So looking at your layout I would have one more wlan for guests, maybe one for media, and an appropriate number of vlans added.
The only thing I cannot comment on is the unifi controller but hoping its a smart device so that you send it vlans.
(vlans for wifi and vlan which it gets its IP from for management purposes aka like home vlan if thats the managment vlan).

39

Not yet. I need to do that. I also need to have a ‘Kids’ network. Both of those are ‘I really need to do this’ items.


Those are wired and i didnt know how or wasnt able to vlan them. I think i may(if i can figure it out) be able to VLAN the ports that the DirecTv and IP Camera are on. They are on my US-16-150W so i should be able to VLAN the port through the controller software. The others, on the wired network connecting to the TPLink will get VLANed this weekend when my RB260 arrives.


Another thing i should do. Same reasoning i should get the kids on their own network.



i still need to understand the Bridge and what you mean by telling the VLANs what ports to run on…i still dont get those concepts. Additionally i need to figure out the “Native VLAN” concept.

As for wlans/ssids, it appears i can not have more than 4 SSIDs on my UAP-nanoHDs…so i need to figure that out now. I was thinking i needed more than that to separate out stuff and have them all on their own VLAN.

SSID1 - Main Network
SSID2 - Work Network
SSID3 - Kid1
SSID4 - Kid 2
SSID5 - IoT/Media
SSID6 - Guest
SSID7 - Management


Edited to attach new diagram with Future state
Visio-ND.vsd(1).pdf (449 KB)

40

If you got Mikrotik APs, you might be able to have all those SSIDs by creating “virtual interfaces” which you then link the VLANs to.