How to isolate devices behind Mikrotik from devices connected to ISP router

RouterOS Beginner Basics
1

Hi guys. I'm pretty new, I'm wanting to start a homelab where I will eventually expose ports to host my own website and video game servers for friends.

I bought a MikroTik hEX S to put my server behind. I understand that exposing ports can carry risks, hence I bought the MikroTik in hopes that if my server is compromised, the hEX can stop any nastiness from spreading to the devices on the rest of the network.

My current setup is as follows:

Internet -> Router -> Everyone else's devices + (hEX S -> Server)

Most of the tutorials I've seen online tell me to separate everything via VLAN's, however, this assumes the hEX S is between the internet and the router. I currently live with a few special needs individuals who will get extremely upset if I attempt to do this. It will take a lot of convincing and time in order to make this happen so this is very much a last resort.

Is there any way I can create a sort of "quarantine" subnet?

Apologies if this is a basic question. I am really new to this and I spent the whole day searching this up but ultimately failed so any help is appreciated greatly.

2

What a punny username: MikroDik.

3

Anyway, draw your network.

I dont understand where is the modem (internet), any router?, 1 hEX, server (what server?), pc and other devices.

4

This should not be difficult.
Some assumptions.

  • You are starting with the default firewall ruleset.
  • The ISP router IP range is 192.168.1.0/24 (change below as required to match actual)
  • Using winbox to manage router.

In /ip firewall filter
Add a new firewall rule in the forward chain to drop all traffic from LAN to 192.168.1.0/24

/ip firewall filter
add action=drop chain=forward comment="drop all traffic from LAN to 192.168.1.0" \
   in-interface-list=LAN dst-address=192.168.1.0/24

Then in winbox move this rule to the end of the forward chain rules. (so, keeping the forward chain rules together)

Test from a LAN client.

5

Thanks for this reply and yes I was starting on default firewall rulesets so this is very useful!

I've added this in as well as a drop all traffic from the ISP IP range to my LAN too. To test it, I logged on from my laptop connected directly to the ISP router and pinged a laptop connected to the hEX S and vice versa. Both pings failed.

Is this sufficient in showing that the two devices are isolated then?

6

NetworkDiag
NetworkDiag477×692 27.5 KB

Is this any good? The server is just my homelab which I'd like to eventually expose services on once I'm comfortable.

7

No, it isn't.
To have (say) port 8291 open to your server, you need to configure the Mikrotik Hex S to let it pass through, but to get to the Hex S, it needs to be allowed on the ISP router, but if it passes through the ISP router it will be connected at the same time to the Hex S AND to Flatmate devices.

You want instead:

ISP router
|
Mikrotik Hex S _________
|                      |
DO NOT               ALLOW
ALLOW                 Port
Port                   |
|                      |
Flatmate             Server
devices
8

Agree with @jaclaz if you also want 'the people with the special need' are allowed to access your game server. But if you want to separate internet connection for them with your own homelab, than go with your diagram.

Make sure you can utilize second port on ISP router, or ask your internet provider to open up the second port for you. Most ISP router has 4 ports, I think...

9

Yep, but - possibly apart a few exceptions - they are usually assembled together into a bridge (or switch) and cannot be set/modified individually.
The block diagram (simplified) of a common ISP router is:

WAN 
Ethernet/ADSL/VDSL/Whatever Modem/Converter
   |
Firewall
   |
  NAT
   |   
4 port "dumb" switch
LAN
10

My original plan was to port forward from the ISP router to the hEX S then the hEX S can forward traffic to the server. Could my flatmates access my game server just not over LAN this way?

As I said I'm just trying to create an "unsafe zone" such that if my server gets compromised no one else is affected. Is this achievable with the setup here?

What do you mean by being able to utilize the second port on the ISP router? When I logged onto the ISP web GUI for the router, it says under the LAN tab that all 4 ports are in "route mode" and the "bridge mode" box is unticked. I was able to plug in the hEX S into the router and when I plug my laptop into the hEX S, I can browse the internet and just go online as per usual.

Thanks for sticking around to help too, I appreciate it at lot!

11

Sorry if this is dumb but what's wrong with the ISP router being connected to my flatmates devices and the hEX S at the same time? Is this a big security risk even if I do what rplant told me to do?

12

No security issues. Everything runs as usual, except there is another device (Hex) added to ISP router.

Do you have access to your ISP router?
Is it DHCP or PPPOE?
Do you get public IP? static or dynamic?

13

I have got access to my router, it's DHCP. I have a public IP. It is dynamic although, I've got no idea how often it changes right now.

14

Presumably you have a firewall inside your ISP router.
Hopefully It Is "secure" or "secure enough" and It prevents something from reaching LAN from WAN, including the "whatever" you want to reach your server.
But since you want this "whatever" to reach your server, you need to drill a hole in the ISP router firewall to allow It to pass through.
But on "this side" of that firewall you have LAN which makes no distinction among devices connected, so the "whatever" can reach ALL the devices.
If you insert an additional filter (the hex) between the ISP router (LAN) and the server you can only (further) restrict what arrives to the server, and anything will be able to reach Flatmate devices.
If you instead insert It like in my proposed scheme you can choose what passes through the hex allowing the "whatever" to reach the server BUT preventing It from reaching the Flatmate devices.
The alternative Is to insert the filter between the ISP router and the Flatmate devices, letting the server and ISP router directly connected.

15

Is this really the case even with these firewall rules applied? If it is, I guess I have some convincing to do...

16

If you plan carefully, its only a blip second internet goes down when you unplug the rj45 from your isp router and plug it into the Hex.

17

Which rules?
Applied to WHAT?

A filter can only let pass LESS than the whole input, so you apply It to the "pipe" where you want less flow/pressure (and cleaner water).

19

The ones mentioned in this reply by rplant:

20

Believe me, it won't be this simple. :confused:

21

Fuck it. Just had a sick leg session at the gym.

I'll just stay up late to unplug the router tonight and put the hEX behind it... hopefully no one will notice it...soon. CBA to waste anymore time trying to create a shitty solution that will prob get hacked by some North Korean geezer anyway.