How to backup Mikrotik without full admin privileges

[Fuad]

@ZeroByte

Here are some ideas:

1. This is my recommended one - if you have only 1 wan interface, your forward chain in the filter table should be like this:

• allow established,related (no interfaces specified, no addresses - just allow anything that’s already been permitted)
• allow out-interface=wan1
• deny all

This is a simple set of 3 rules which will allow any arbitrary number of LANs to access the Internet, but block all from each other. You can add more LANs later and you won’t need to touch these rules - they’ll automatically work for new lans too. If you add a second WAN for backup, load sharing, policy routing, whatever, then just insert another rule before deny all, which allows out-interface=wan2
If you want to allow inbound connections for internal addresses (NAT pinholes) then you allow these before the deny-all, but after the established,related rule…
e.g. allow protocol=tcp, dst-port=80 in-interface=wan1

2. If you use 192.168.x.0/24 as your LAN addresses, then you can match on that:

• allow established,related
• deny src-address=192.168.0.0/16 dst-address=192.168.0.0/16

I prefer to use interface names and not addresses. The LAN is plugged into this interface - anything “this way” is LAN, and should be subject to LAN rules… so why compare addresses? This allows you to change IP addressing, or even add routes via some gateway in the LAN direction - and it will all have the policy. Even spoofed IP addresses will be subjected to the same rule, because the IP doesn’t matter.

if you don’t mind, i would like to get some help. Our Mikrotik router were configured by a guy who we paid for it. when i tried to backup it says "Operation not permitted (9). Even it says the same when i tired to open the terminal. I’m attaching the Commands that he used to configure the router.

/ip firewall mangle add action=accept chain=prerouting comment=“SEM BALANCE” disabled=no dst-address-list=sem_balance in-interface=Local

/ip address add address=192.168.0.1/24 interface=Local

/ip address add address=192.168.1.100/24 interface=wlan1
/ip address add address=192.168.2.100/24 interface=wlan2

/ip firewall mangle add chain=input in-interface=wlan1
action=mark-connection new-connection-mark=wlan1_conn

/ip firewall mangle add chain=input in-interface=wlan2
action=mark-connection new-connection-mark=wlan2_conn

/ip firewall mangle add chain=output in-interface=wlan1_conn
action=mark-routing new-routing-mark=to_wlan1

/ip firewall mangle add chain=output in-interface=wlan2_conn
action=mark-routing new-routing-mark=to_wlan2

/ip firewall mangle add chain=prerouting dst-address=192.168.1.0/24 action=accept in-interface=local

/ip firewall mangle add chain=prerouting dst-address=192.168.2.0/24 action=accept in-interface=local

/ip firewall mangle add chain=prerouting dst-address-type=!local in-interface=local per-connection-classifier=both-addresses:11/0
action=mark-connection new-connection-mark=wlan1_conn passthrough=yes

/ip firewall mangle add chain=prerouting dst-address-type=!local in-interface=local per-connection-classifier=both-addresses:11/1
action=mark-connection new-connection-mark=wlan2_conn passthrough=yes

/ip firewall mangle add chain=prerouting dst-address-type=!local in-interface=local per-connection-classifier=both-addresses:11/2
action=mark-connection new-connection-mark=wlan2_conn passthrough=yes

/ip firewall mangle add chain=prerouting dst-address-type=!local in-interface=local per-connection-classifier=both-addresses:11/3
action=mark-connection new-connection-mark=wlan2_conn passthrough=yes

/ip firewall mangle add chain=prerouting dst-address-type=!local in-interface=local per-connection-classifier=both-addresses:11/4
action=mark-connection new-connection-mark=wlan2_conn passthrough=yes

/ip firewall mangle add chain=prerouting dst-address-type=!local in-interface=local per-connection-classifier=both-addresses:11/5
action=mark-connection new-connection-mark=wlan2_conn passthrough=yes

/ip firewall mangle add chain=prerouting dst-address-type=!local in-interface=local per-connection-classifier=both-addresses:11/6
action=mark-connection new-connection-mark=wlan2_conn passthrough=yes

/ip firewall mangle add chain=prerouting dst-address-type=!local in-interface=local per-connection-classifier=both-addresses:11/7
action=mark-connection new-connection-mark=wlan2_conn passthrough=yes

/ip firewall mangle add chain=prerouting dst-address-type=!local in-interface=local per-connection-classifier=both-addresses:11/8
action=mark-connection new-connection-mark=wlan2_conn passthrough=yes

/ip firewall mangle add chain=prerouting dst-address-type=!local in-interface=local per-connection-classifier=both-addresses:11/9
action=mark-connection new-connection-mark=wlan2_conn passthrough=yes

/ip firewall mangle add chain=prerouting dst-address-type=!local in-interface=local per-connection-classifier=both-addresses:11/10
action=mark-connection new-connection-mark=wlan2_conn passthrough=yes

/ip firewall mangle add chain=prerouting connection-mark=wlan1_conn in-interface=local action=mark-routing new-routing-mark=to_wlan1

/ip firewall mangle add chain=prerouting connection-mark=wlan2_conn in-interface=local action=mark-routing new-routing-mark=to_wlan2

/ip route add dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-mark=to_wlan1 check-gateway=ping

/ip route add dst-address=0.0.0.0/0 gateway=192.168.2.1 routing-mark=to_wlan2 check-gateway=ping

/ip route add dst-address=0.0.0.0/0 gateway=192.168.1.1 distance=1 check-gateway=ping

/ip route add dst-address=0.0.0.0/0 gateway=192.168.2.1 distance=2 check-gateway=ping

/ip firewall nat add action=masquerade chain=srcnat
src-address=192.168.0.0/24 comment=“MASCARAMENTO PCC” disabled=no

/ip firewall nat add chain=srcnat
out-interface=wlan1 action=masquerade

/ip firewall nat add chain=srcnat
out-interface=wlan2 action=masquerade

Thanks

[ZeroByte]

This needed to be a new topic, so I split it off of the old thread.

Your problem is that you’re logging into the Mikrotik using an account that does not have full admin privileges. Get the guy to give you the full access account.

If those commands you posted are truly the full set of commands he used, then that’s all you really need to build the same configuration on any other Mikrotik.