Everything correct except the firewall rules - the two rules you’ve posted are fine as such, but if they are the only rules in the filter, it makes a security hole at least in terms of the guests not being prevented from accessing the management services of the router itself. So post the complete anonymized export, see my automatic signature below.
In general, it is much safer to build the firewall as “deny everything except what you explicitly permit” than “permit everything except what you explicitly deny” because if you forget to permit something, your legal users will quickly notify you; if you forget to deny something, your illegal users will never let you know.
if you forget to permit something, your legal users will quickly notify you; if you forget to deny something, your illegal users will never let you know.
Effing brilliant. Luv it. Every IT person should have this over the entryway to their office.
A few errors.
(1) Missing Interface members
/interface list member add comment=defconf interface=Bridge_CORP list=LAN
add comment=defconf interface=“ether1 - gateway” list=WAN add Bridge_Public list=LAN
(2) Duplicate address, one needs to be removed.
/ip address
add address=192.168.88.1/24 comment=defconf interface=Bridge_CORP network=192.168.88.0
add address=192.168.1.2/24 interface=Bridge_CORP network=192.168.1.0
add address=192.168.100.10/24 interface=“ether1 - gateway” network=192.168.100.0
add address=10.10.10.1/24 interface=Bridge_Public network=10.10.10.0
(3) Dont see the purpose of this rule?? the default config does not block this traffic so you dont need one enabling it…if you get what I mean!!
add action=accept chain=input dst-port=8291 protocol=tcp
(4) Your rules will block traffic between the two subnets at Layer 3, should be fine.
(5) this can be set to NONE.
/tool mac-server
set allowed-interface-list=LAN
Is remove this rule… which basically says drop all traffic not coming from the LAN
(and by logic thus allow ALL USERS ACCESS TO THE ROUTER!!!)
add action=drop chain=input comment=“defconf: drop all not coming from LAN” in-interface-list=!LAN
Why? Because only the admin needs full access to the router, the rest of the users need some services, typically only DNS, and perhaps NTP…
SO…
In order replace by
add chain=input action=accept in-interface=Bridge-Corp (optional src-address-list=adminaccess)****
If you are happy with all users on Bridge-Crop having access, then fine if not and you want to limit to admins devices then create a firewall address list
add IPofAdmins desktop list=adminaccess
add IPofAdmins laptop list=adminaccess
add IPof Admins Ipad list=adminaccess
add IPofADmins smartphone list=adminaccess
Where the DHCP leases for these devices are set as Static.
+++++++++++++++++++++++++++++++++++++++++++++
Then you need to add DNS service for LAN users…
add action=accept chain=input comment=“Allow LAN DNS queries - TCP”
connection-state=new dst-port=53 in-interface-list=LAN protocol=tcp
add action=accept chain=input comment=“Allow LAN DNS queries-UDP”
connection-state=new dst-port=53 in-interface-list=LAN protocol=udp
Finally the last rule in the input chain should be, when the others are in place (otherwise you will lock yourself out of the router)
add chain=input action=drop comment=“drop all else”
WHat this does in effect is drop all other traffic both WAN to router and router to WAN.
Only what you have stated above is permitted.