After a quick perusal comments are.
- input chain need some work and am not familiar with why you need port 22 input chain, what service is the router providing?
What is the requirement in works that drove you to include these rules??
- What is the same purpose with 8291???
- Your last rule makes no sense to me what are you trying to accomplish??
add action=drop chain=input comment=“defconf: drop all from WAN”
in-interface=ether1
- missing invalid rule for input chain
- Missing ipsec rules at the beginning of the forward chain.
Take a look at the default rules and my changes to them for example.
By the way I use IKE VPN to access my router and there is no need to open up winbox to the internet regardless, which is a very dangerous thing to do.
++++++++++++++++++++++++++++++++++++++++++
Default rules:
/ip firewall filter
Input chain:
add action=accept chain=input comment=
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=
“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
in-interface-list=!LAN
Forward chain:
add action=accept chain=forward comment=
“defconf: accept established,related, untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid”
connection-state=invalid
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
DONT FORGET your default source nat rule as well and for port forwarding any destination nat rules.
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade”
ipsec-policy=out,none out-interface-list=WAN
Which you will have to modify for pppoe / static wanip.
++++++++++++++++++++++++++++++++++++++++++++++
WITH MODIFICATIONS
then I tweak it… Now once you understand all the rules from the default, you can consider doing some tweaking.
For example, I take the default firewall rules which have a concept of allow everything unless its blocked TO, block everything unless I allow it. To me its safer and easier to read and I know that if I haven’t permitted it, it ain’t going to go through (vice relying on me knowing everything to block).
INPUT CHAIN
/ip firewall filter
add action=accept chain=input connection-state=established,related
add action=drop chain=input connection-state=invalid
add action=accept chain=input comment=protocol=icmp
add action=accept chain=input comment=“Allow ADMIN to Router” src-address-list=adminaccess {note: &&&&}
{add optional ***}
add action=drop chain=input comment=“Drop All Else”
Notes:
note: &&&&&
to allow admin access to config the router from fixed static IPs for example on any subnet).
/ip firewall address-list
add address=admin-desktop_IP list=adminaccess
add address=admin-laptop_IP list=adminaccess
add address=admin-ipad_IP list=adminaccess
note: *** optional:
a. Provide access to lan users ONLY for any services they require that the router provides (examples):
add action=accept chain=input comment=“Allow LAN DNS queries - TCP”
connection-state=new dst-port=53 in-interface-list=LAN protocol=tcp
add action=accept chain=input comment=“Allow LAN DNS queries-UDP”
connection-state=new dst-port=53 in-interface-list=LAN protocol=udp
b. provide VPN services, and thus any ports for IPSEC are entered here…
Discussion: The last rule ensures that no other traffic is permitted that wasn’t explicitly allowed above, which includes for example any wan to router traffic. Ensure that the admin access rules are in place before putting in the last rule otherwise one will lock themselves out of the router.
FORWARD CHAIN
/ip firewall filter
{Optional 1 +++}
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related
add action=drop chain=forward connection-state=invalid
{Optional 2 ###}
{Optional 3 ===}
add action=drop chain=forward comment=“drop all else”
Notes:
Option1 +++ If you do use IPSEC you will need…
add action=accept chain=forward comment=“defconf: accept in ipsec policy”
ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy”
ipsec-policy=out,ipsec
Option 2 ###
This is where you place traffic you wish to allow examples:
(a) allow lan to wan traffic (by subnet, by vlan, by interface etc.)
add action=accept chain=forward comment=“ENABLE HomeLAN to WAN”
in-interface=Home-LAN_V12 out-interface-list=WAN src-address=192.168.0.0/24
(b) allow subnet A to access shared printerS on subnet B
add action=accept chain=forward comment="allow VlanA Users_TO_Printers
dst-address-list=House_Printers in-interface=VLANA src-address=192.168.0.0/24
Option 3===
If you need port forwarding for any reason you can add this rule.
add action=accept chain=forward comment=“Allow Port Forwarding” connection-nat-state=dstnat
connection-state=new in-interface-list=WAN
Discussion: The last rule automatically blocks all traffic not allowed above including WAN to LAN traffic and it blocks any subnet to subnet or vlan to vlan traffic at Layer 3. For me done, no other rules are needed in the standard security config. Most other stuff is bloatware.