I recently purchased a Mikrotik hEX RB750Gr3 5-port Ethernet Gigabit Router. I reset default configuration and have the basic setup, eth0=wan and eth1 to eth4 as switch.
I need to get a basic firewall rule so my external IP is not visible from outside ping. I just need basic rules to protect me as a home user nothing fancy
I found this on tksja.com and implemented this as is. When I ping from outside, I get a reply. So I know something is wrong. Can anyone take look and help me here.
My AT&T hub has 192.168. 1.254 and in passs thru mode. My Mikrotik LAN subnet is 192.168.4.1/24.
/ip firewall address-list
add address=0.0.0.0/8 comment="Self-Identification [RFC 3330]" list=Bogons
add address=10.0.0.0/8 comment="Private[RFC 1918] - CLASS A # Check if you nee\
d this subnet before enable it" list=Bogons
add address=127.0.0.0/8 comment="Loopback [RFC 3330]" list=Bogons
add address=169.254.0.0/16 comment="Link Local [RFC 3330]" list=Bogons
add address=172.16.0.0/12 comment="Private[RFC 1918] - CLASS B # Check if you \
need this subnet before enable it" list=Bogons
add address=192.0.2.0/24 comment="Reserved - IANA - TestNet1" list=Bogons
add address=192.88.99.0/24 comment="6to4 Relay Anycast [RFC 3068]" list=\
Bogons
add address=198.18.0.0/15 comment="NIDB Testing" list=Bogons
add address=198.51.100.0/24 comment="Reserved - IANA - TestNet2" list=Bogons
add address=203.0.113.0/24 comment="Reserved - IANA - TestNet3" list=Bogons
add address=224.0.0.0/4 comment=\
"MC, Class D, IANA # Check if you need this subnet before enable it" \
list=Bogons
/ip firewall filter
add action=accept chain=forward comment="defconf: accept established,related" \
connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=accept chain=input port=69 protocol=udp
add action=accept chain=forward port=69 protocol=udp
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface=ether1
add action=drop chain=forward comment="Drop to bogon list" dst-address-list=\
Bogons
add action=accept chain=input protocol=icmp
add action=accept chain=input connection-state=established
add action=accept chain=input connection-state=related
add action=drop chain=input in-interface=ether1
Especially do not apply mass of rules you find anywhere, because you will make more bads than goods. If you do not understand everything, start with reset to defaults and go through the security guide. If you do understand, reset with blank config and make only those settings you need.
the default config has firewall rules already, should I still add the one in the link?
my LAN is 192.168.4.1, dhcp starts from 192.168.4.10 -100. I tried to run this command
/ip service set winbox allowed-address=192.168.4.0/24 but I get an error "expected end of command (line1 column 24).
how and what rule I need to apply to block my WAN from ping reply and ddos attacks? The default firewall does not have it. I can ping my IP from outside and I get reply.
I connect to winbox via 192.168.4.1 IP but my firewall doesn’t allow webfig using browser using the same IP. What rule do I need to be able to using browser to connect to router.
I’m still able to connect to winbox using 192.168.4.1 which is my win box IP.