Hello,
I configured my Mikrotik using guidelines on internet. Everything is working except that often web pages do not load at first attempt - I get blank page and after refresh it loads.
Installed OS version: 6.43.2
Should I post the Support Output File to this forum?
I found out it is compromised - new user added, firewall rules disabled, strange scripts added.
It was hacked before firmware upgrade. I upgraded it on hacked configuration, then restored my old configuration backup.
Changed service accessibility:
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh address=192.168.1.0/24 port=22
set api disabled=yes
set winbox address=192.168.1.0/24
set api-ssl disabled=yes
Could someone help me to review my firewall rules? I have a web server on my local network and forward ports 22, 80 and 443
/ip firewall address-list
add address=0.0.0.0/8 comment=RFC6890 list=NotPublic
add address=10.0.0.0/8 comment=RFC6890 list=NotPublic
add address=100.64.0.0/10 comment=RFC6890 list=NotPublic
add address=127.0.0.0/8 comment=RFC6890 list=NotPublic
add address=169.254.0.0/16 comment=RFC6890 list=NotPublic
add address=172.16.0.0/12 comment=RFC6890 list=NotPublic
add address=192.0.0.0/24 comment=RFC6890 list=NotPublic
add address=192.0.2.0/24 comment=RFC6890 list=NotPublic
add address=192.168.0.0/16 comment=RFC6890 list=NotPublic
add address=192.88.99.0/24 comment=RFC3068 list=NotPublic
add address=198.18.0.0/15 comment=RFC6890 list=NotPublic
add address=198.51.100.0/24 comment=RFC6890 list=NotPublic
add address=203.0.113.0/24 comment=RFC6890 list=NotPublic
add address=224.0.0.0/4 comment=RFC4601 list=NotPublic
add address=240.0.0.0/4 comment=RFC6890 list=NotPublic
/ip firewall filter
add action=accept chain=input comment="Accept established and related packets" connection-state=established,related
add action=accept chain=input comment="Accept all connections from local network" in-interface=bridge1
add action=drop chain=input comment="Drop invalid packets" connection-state=invalid
add action=drop chain=input comment="Drop all packets which are not destined to routes IP address" dst-address-type=!local
add action=drop chain=input comment="Drop all packets which does not have unicast source IP address" src-address-type=!unicast
add action=drop chain=input comment="Drop all packets from public internet which should not exist in public network" in-interface=eth1-wan src-address-list=NotPublic
add action=accept chain=forward comment="Accept established and related packets" connection-state=established,related
add action=drop chain=forward comment="Drop invalid packets" connection-state=invalid
add action=drop chain=forward comment="Drop new connections from internet which are not dst-natted" connection-nat-state=!dstnat connection-state=new in-interface=eth1-wan
add action=drop chain=forward comment="Drop all packets from public internet which should not exist in public network" in-interface=eth1-wan src-address-list=NotPublic
add action=drop chain=forward comment="Drop all packets from local network to internet which should not exist in public network" dst-address-list=NotPublic in-interface=bridge1
add action=drop chain=forward comment="Drop all packets in local network which does not have local network address" in-interface=bridge1 src-address=!192.168.1.0/24
/ip firewall nat
add action=masquerade chain=srcnat comment="default config" out-interface=eth1-wan
add action=dst-nat chain=dstnat comment="ssh" dst-address=88.89.87.86 dst-port=22 in-interface=eth1-wan protocol=tcp to-addresses=192.168.1.2 to-ports=22
add action=dst-nat chain=dstnat comment="http" dst-address=88.89.87.86 dst-port=80 in-interface=eth1-wan protocol=tcp to-addresses=192.168.1.2 to-ports=80
add action=dst-nat chain=dstnat comment="https" dst-address=88.89.87.86 dst-port=443 in-interface=eth1-wan protocol=tcp to-addresses=192.168.1.2 to-ports=443