So far, I have been using the default firewall because it is generally considered to provide very good protection. However, for beginners it is not very clear, especially when you want to introduce isolating rules, e.g. main network from guest network etc. So, with the help of a network expert, we created our own firewall rules and so far I haven’t noticed any problems.
Firewall:
/ip firewall connection tracking
set udp-timeout=10s
/ip firewall filter
add action=drop chain=input connection-state=invalid in-interface-list=WAN
add action=accept chain=input comment="Start - Firewall for WAN" \
connection-state=established,related in-interface-list=WAN
add action=accept chain=input dst-port=8291 in-interface-list=WAN \
protocol=tcp
add action=accept chain=input in-interface-list=WAN protocol=icmp
add action=drop chain=input comment="End - Firewall for WAN" \
in-interface-list=WAN
add action=accept chain=input comment="Start - Blocking guest network acces\
s to the router and main gateway." connection-state=\
established,related in-interface-list=Guest
add action=accept chain=input comment="Allowing guests to DNS query" \
dst-port=53 in-interface-list=Guest protocol=udp
add action=drop chain=input comment=\
"End - Blocking guest network access to the router and main gateway." \
in-interface-list=Guest
add action=accept chain=forward in-interface-list=Guest \
out-interface-list=WAN
add action=accept chain=forward connection-state=established,related \
in-interface-list=WAN out-interface-list=Guest
add action=drop chain=forward in-interface-list=Guest
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
Unfortunately, since yesterday I have had a problem connecting Node-RED with Home Assistant. To be precise, it returns me the following message: [error] Unable to listen on http://127.0.0.1:1880/
[error] Error: port in use
I even changed the default port 1880 to 2741, but the same thing happens every time. I suspect it’s the fault of the firewall or loopback, which is set by default in the RouterOS configuration.
Why do you allow winbox access (TCP port 8291) from WAN? Winbox is not a very secure protocol.
The implicit action of firewall is to accept packets which were not dropped due to explicit rules. Your rules only deal with some specific packets, so they will slip some traffic.
So your firewall is not as bullet-proof as you wish it would be. But I agree that default could be better as well by having explicit drop all rule as the last rule instead of having a combined “dtop everything which is not dst-nated coming from WAN”. Using two rules instead would make it more readable and more versatile for additions such as you need.
Regarding the error message: where does the http client run? You have to check that host because 127.0.0.1 is always “localhost” and if host’s networking is not totaly fubar, that traffic never leaves that nachine. So nothing to do with Mikrotik and its firewall.
Not much!
In fact if port 8291 is your winbox port, your FW is a piece of trash.
Also you have no clue on the importance of order of firewalls and finally its hard to read being disorganized mixing up the chains.
Finally without seeing the rest of the config and subnets/vlans its hard to really comment otherwise.
@Mkx, the default firewall rules ARE ONLY for a person who does not change the config.
WAN on ether1, all other ports on the bridge on the same LAN subnet.
Its not meant for anything else.
What MT fails to do is make this clear.
Not sure what you mean by vlan1, but if you are using vlans then use all vlans ( but not vlan1 for data).
Thus make it vlan10.
Remember with a drop all rule at the end of the forward chain all subnets are automatically isolated at L3, and thus for the config below you
only need to add to the above, one rule!
I admit that I was afraid of creating a very complicated firewall, but after reading your https://forum.mikrotik.com/viewtopic.php?t=180838 guide, I see that it is not that difficult at all. You rely on the default firewall configuration and simply additionally seal it with your own rules.
So how can you restore the default firewall rules without having to restore the rest of the RouterOS settings?
Loopback is internal to the router and should not have any ill effects for your traffic.
See what Mkx states two posts below, he actually knows stuff…I just read listen and believe what he and very select few others say.
The name of interface doesn’t matter. What matters is that 127.0.0.1 address always refers to the machine itself where you execute command using this address. So if you use a web browser and enter that URL, then Node-RED should be running on the very same machine. And the traffic doesn’t leave local machine so whatever tge outcome, it isn’t affected by router at all.
Not without the complete config shown
/export file=anynameyouwish ( minus router serial number, public WANIP information, keys, long dhcp lease lists )
Unfortunately I cannot comment as I dont use or are familiar with vlans using datapaths and capsman.
I will say that bridge vlan filtering does not seem to be turned on, and I dont see any /interface bridge vlan settings…
If vlan-filtering is not enabled, certain things which don’t rely on it still work. As it’s usual with partial config. I suggest you to follow advice by @anav … he’s a very experienced user (even though he likes things done exactly his way).
