Interesting config, so attempting to get vlan6 to port X…
Not sure I would use a bridge to do so but lets give it a shot…
(A) You you have to assign the vlan to the bridge and not ether1 with a bridge approach…
/interface vlan
interface=TVBridge name=TV-VLAN6 vlan-id=6
(1) You will note I have renamed the vlan, TV-VLAN6 for clarity.
OKAY the real problem here is that its VLAN 6 coming from the WAN side you dont want to PVID this end its a trunk port end…
The Port X, will be the pvid end, aka your TV or tv box. However if you tv box is expecting VLAN6 than that port will also need to be a trunk port.
Thus its either
add bridge=TVBridge ingress-filtering=no interface=ether1
add bridge=TVBridge ingress-filtering=no interface=ether5 pvid=6 (tv or tv box does not read vlans)
OR
add bridge=TVBridge ingress-filtering=no interface=ether1
add bridge=TVBridge ingress-filtering=no interface=ether5 (tv or tv box has to read vlans)
(2) The vlan6 interface is technically coming in on the wan interface, but may not be required.
/interface list member
add interface=bridge list=LAN
add interface=ether1 list=WAN
add interface=TV-WAN list=WAN (not needed unless no tv traffic working and then enter it to see if it helps)
If the tv signals go from ISP to box and back without the above addition then dont add it…
(3) You are missing /interface bridge vlan rules for IPTV.
/inteface bridge vlans
add bridge=TVBridge tagged=TVBridge,ether1 untagged=ether5 vlan-ids=6 (assumes tv or tv box cannot read vlans).
add bridge=TVBridge tagged=TVBridge,ether1,ether5 vlan-ids=6 (assumes tv or tv box can read vlans).
(4) Finally after completing the above you have to activate vlan filtering…
add name=TVBridge vlan-filtering=yes
(5) Again out of my league but I dont think you can ipsec a bridge ???
/ip address
add address=10.0.70.1/24 interface=bridge-loopback network=10.0.70.0
++++++++++++++++++++++++++++
FW RULES- input
a. (Not sure why you are blocking port 53 DNS?? ) I have not seen this done and there is no need to do so,
with a proper set of input chain rules. You will see why eventually.
b. I dont think you need to specify the destination IP for ipsec but I could be wrong. IM pretty sure based on your various internal router ipsec settings that is covered but not sure.
c. I am more sure in that you don’t allow public IP complete access to your router, that defeats the purpose of IPSEC.
You allow a port to the router and the router internally then takes care of security, to me this is a RED SECURITY FLAG
d. the last rule is okay but THERE IS BETTER.
The most obvious is simply being clear and not overly clever with these two rules…
add chain=input action=accept in-interface-list=LAN
add chain=input action=drop comment=“drop all else”
better is a drop all RULE for both LAN and WAN. To do this you have to be sure Two things FIRST and foremost, you as admin to maintain access to the router so you need something like…
add chain=input action=accept in-interface-list=LAN src-address=IP-of_admin_PC (or src-address-list=authorized where authorized might be comprised of admin PC, admin laptop, admin smartphone etc.)
Then you need to ensure essential services are provided to the LAN users (who dont need access to the router but for example to dns services).
add chain=input action=accept in-interface-list=LAN protocol=tcp port=53
add chain=input action=accept in-interface-list=LAN protocol=udp port=53
Then add the last rule only when the above ones are in place.
add chain=input action=drop comment=“drop all else”
/ip firewall filter
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=
“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
add action=accept chain=input comment=
“Allow UDP 500,4500IPSec for 22.22.22.22” dst-address=22.22.22.22
dst-port=500,4500 protocol=udp
add action=accept chain=input comment=“Allow IPSec-esp for 22.22.22.22”
dst-address=22.22.22.22 protocol=ipsec-esp
add action=accept chain=input comment=
“IKE2: Allow ALL incoming traffic from 10.0.70.0/24 to this RouterOS”
ipsec-policy=in,ipsec src-address=10.0.70.0/24
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
in-interface-list=!LAN
++++++++++++++++++++++++++++
Forward chain -----\
what are you trying to attempt to do here?
come in on vpn tunnel to this device and then access internet and home network??
If so the second rule does the same thing as the first rule (it includes it)
add action=accept chain=forward comment=
“IKE2: Allow ALL forward traffic from 10.0.70.0/24 to HOME network”
dst-address=192.168.100.0/24 ipsec-policy=in,ipsec src-address=10.0.70.0/24
add action=accept chain=forward comment=
“IKE2: Allow ALL forward traffic from 10.0.70.0/24 to ANY network”
dst-address=0.0.0.0/0 ipsec-policy=in,ipsec src-address=10.0.70.0/24
The last rule is another one I despise… its too tricky for its own good and is a half measure on the drop side.
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
Much better and clearer to do the following.
add action=accept chain=forward in-interface-list=LAN out-interface-list=WAN comment=“allow internet traffic”
add action=accept chain=forward connection-nat-state=dstnat comment=“allow allow port forwarding”
add action=drop chain=forward comment=“drop all else”
