Is my config good?

RouterOS General
1

Hello, Everyone! Im new to Mikrotik and wants to know more about it each day, I did some configurations and had it improved by someone I paid, I would like to know if its good, hehe, sorry for the trouble!

# 2025-09-13 00:29:57 by RouterOS 7.16.2
# software id = 0E3Y-65FW
#
# model = RB5009UG+S+
# serial number = 
/interface bridge
add name=bridgeLAN protocol-mode=none
/interface ethernet
set [ find default-name=ether1 ] loop-protect=off mac-address=CC:89:5E:9E:4A:F4 \
    name=ISP rx-flow-control=on tx-flow-control=on
set [ find default-name=ether2 ] loop-protect=off name="ether2 - Switch"
set [ find default-name=ether3 ] loop-protect=off
/interface pppoe-client
add add-default-route=yes disabled=no interface=ISP keepalive-timeout=disabled \
    name=pppoe-out1 user=6012809
/interface list
add name=WAN
add name=LAN
/ip pool
add name="LAN POOL" ranges=192.168.18.2-255.255.255.254
add name=dhcp_pool1 ranges=192.168.18.2-192.168.18.254
/ip dhcp-server
add address-pool=dhcp_pool1 interface=bridgeLAN lease-time=8h name=dhcp1
/interface bridge port
add bridge=bridgeLAN interface="ether2 - Switch"
add bridge=bridgeLAN interface=ether4
add bridge=bridgeLAN interface=ether3
add bridge=bridgeLAN interface=ether5
add bridge=bridgeLAN interface=ether6
add bridge=bridgeLAN interface=ether7
add bridge=bridgeLAN interface=ether8
/interface list member
add interface=pppoe-out1 list=WAN
add interface=ISP list=WAN
add interface=bridgeLAN list=LAN
/ip address
add address=192.168.18.1/24 interface=bridgeLAN network=192.168.18.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=1m
/ip dhcp-server network
add address=192.168.18.0/24 dns-server=8.8.8.8,1.1.1.1 gateway=192.168.18.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.4.4.8
/ip firewall address-list
add address=192.168.18.0/24 list=LAN
add address=hxxxxxxxxx.sn.mynetname.net list=WAN
add address=192.168.18.34 list=game-servers
add address=192.168.18.27 list=game-servers
add address=192.168.18.29 list=game-servers
add address=192.168.18.37 list=game-servers
add address=192.168.18.12 list=cloudflared-servers
add address=192.168.18.29 list=cloudflared-servers
add address=192.168.18.34 list=cloudflared-servers
add address=192.168.18.37 list=cloudflared-servers
add address=118.99.111.197 list=cloudflared-servers
/ip firewall filter
add action=accept chain=forward comment="Allow TCP single ports to game servers" \
    connection-state=established,related,new disabled=yes dst-address-list=\
    game-servers dst-port=53,22,80,2022,2023,2223,2225,3306 protocol=tcp
add action=accept chain=forward comment="Allow TCP 4060040700" connection-state=\
    established,related,new disabled=yes dst-address-list=game-servers dst-port=\
    40600-40700 protocol=tcp
add action=accept chain=forward comment="Allow TCP 70007100" connection-state=\
    established,related,new disabled=yes dst-address-list=game-servers dst-port=\
    7000-7100 protocol=tcp
add action=accept chain=forward comment="Allow TCP 1470014800" connection-state=\
    established,related,new disabled=yes dst-address-list=game-servers dst-port=\
    14700-14800 protocol=tcp
add action=accept chain=forward comment="Allow TCP 1520015300" connection-state=\
    established,related,new disabled=yes dst-address-list=game-servers dst-port=\
    15200-15300 protocol=tcp
add action=accept chain=forward comment="Allow udp single ports to game servers" \
    connection-state=established,related,new disabled=yes dst-address-list=\
    game-servers dst-port=22,80,2022,2023,2223,2225,3306 protocol=udp
add action=accept chain=forward comment="Allow udp 4060040700" connection-state=\
    established,related,new disabled=yes dst-address-list=game-servers dst-port=\
    40600-40700 protocol=udp
add action=accept chain=forward comment="Allow udp 70007100" connection-state=\
    established,related,new disabled=yes dst-address-list=game-servers dst-port=\
    7000-7100 protocol=udp
add action=accept chain=forward comment="Allow udp 1470014800" connection-state=\
    established,related,new disabled=yes dst-address-list=game-servers dst-port=\
    14700-14800 protocol=udp
add action=accept chain=forward comment="Allow udp 1520015300" connection-state=\
    established,related,new disabled=yes dst-address-list=game-servers dst-port=\
    15200-15300 protocol=udp
add action=accept chain=forward comment="cloudflared -> Cloudflare HTTPS" \
    disabled=yes dst-port=443,7844 protocol=tcp src-address-list=\
    cloudflared-servers
add action=accept chain=forward comment="cloudflared -> Cloudflare QUIC" \
    disabled=yes dst-port=7844,53012 protocol=udp src-address-list=\
    cloudflared-servers
add action=drop chain=forward comment=\
    "Drop access to game servers except from cloudflared servers" disabled=yes \
    dst-address-list=game-servers log=yes src-address-list=!cloudflared-servers
/ip firewall mangle
add action=mark-connection chain=prerouting disabled=yes dst-address-list=WAN \
    new-connection-mark=HairpinNAT passthrough=yes src-address-list=LAN
/ip firewall nat
add action=masquerade chain=srcnat comment=HairPinNat src-address=\
    192.168.18.0/24
add action=masquerade chain=srcnat comment="Test 2" out-interface=pppoe-out1
add action=dst-nat chain=dstnat comment=" 1 Server Ports TCP" \
    dst-address-list=WAN dst-port=40600-40700,2022,22,3306,80 protocol=tcp \
    to-addresses=192.168.18.37 to-ports=0-60000
add action=dst-nat chain=dstnat comment=" 3 Server Ports TCP" \
    dst-address-list=WAN dst-port=7000-7100,2023 protocol=tcp to-addresses=\
    192.168.18.34 to-ports=0-60000
add action=dst-nat chain=dstnat comment=" 4 Server Ports TCP" \
    dst-address-list=WAN dst-port=14700-14800,2223 protocol=tcp to-addresses=\
    192.168.18.27 to-ports=0-60000
add action=dst-nat chain=dstnat comment=" 5 Server Ports TCP" \
    dst-address-list=WAN dst-port=15200-15300,2225,19132 protocol=tcp \
    to-addresses=192.168.18.29 to-ports=0-60000
add action=dst-nat chain=dstnat comment=" 1 Server Ports UDP" \
    dst-address-list=WAN dst-port=40600-40700,3306 protocol=udp to-addresses=\
    192.168.18.37 to-ports=0-65535
add action=dst-nat chain=dstnat comment=" 3 Server Ports UDP" \
    dst-address-list=WAN dst-port=7000-7100 protocol=udp to-addresses=\
    192.168.18.34 to-ports=0-60000
add action=dst-nat chain=dstnat comment=" 4 Server Ports UDP" \
    dst-address-list=WAN dst-port=14700-14800 protocol=udp to-addresses=\
    192.168.18.27 to-ports=0-60000
add action=dst-nat chain=dstnat comment=" 5 Server Ports UDP" \
    dst-address-list=WAN dst-port=15200-15300,19132 protocol=udp to-addresses=\
    192.168.18.29 to-ports=0-60000
add action=dst-nat chain=dstnat comment=Winbox dst-address-list=WAN dst-port=\
    8291 protocol=tcp to-addresses=192.168.18.1 to-ports=8291
add action=masquerade chain=srcnat disabled=yes out-interface=pppoe-out1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api address=192.168.18.0/24
set api-ssl disabled=yes
/ip traffic-flow
set enabled=yes
/system clock
set time-zone-name=Asia/Jakarta
/system identity
set name=
/system note
set show-at-login=no
2

Do not share your confidential data as serials, passwords etc.

3

For starters, you have a non-existent firewall :+1:

Please introduce at least the default one or you will have plenty of unexpected visitors on your network.

Secondly, the myriad of disabled firewall rules you currently have is not necessary since you will be doing port forwarding, which is covered by one of the default firewall rules that you need to import.

Thirdly, the hairpin NAT rule is incorrect. It should look something like:

/ip firewall nat
add action=masquerade chain=srcnat dst-address=192.168.18.0/24 src-address=192.168.18.0/24

Fourthly, this pool entry should be removed immediately:

add name="LAN POOL" ranges=192.168.18.2-255.255.255.254

4

You should request your money back as the config provided was not safe, besides all the errors already noted!!

It would seem you are attempting to run game servers?
This is very problematic as you will get hacked attempting such a thing as they attract malicious actors.
There is a reason for places like Steam etc, where they have the equipment to deal with such things, a Mikrotik router is not that.

What I suggest is that users come in on a VPN such as wireguard to access servers and that is at least a secure method of access to your LAN.

Is the gaming a few friends or are you providing some services for payment??

5

My first suggestion is to update the RouterOS and RouterFirmware to 7.19.4 Stable.

6

Please ask for a refund. Leaving your router without a firewall is unprofessional.

7

Nice scammer...

8

I'm impressed rextended, when Normis said to be kind, you are even being polite even to scammers. :wink:
"Nice Scammer"

9

Thanks For The Reminder!

10

Thanks TheCat12 for the checkup, I do Notice it but I dont know what it does haha

11

Hi anav,

after reading you message, this was really surprising, since the person I paid for has an MTCNA & MTCRE Certificate.

The VPN Idea is nice but, Yes, Im Providing services to my school friends for money especially game hosting, I thought that Mikrotik was the right choice for my Internet Security and with VPN, its going to be a hassle to get everyone to use it.

Thanks anav!

12

Hi Infabo,
Hahahah, Ill just let it be, don't worry, Won't use his service any longer.

Thanks Infabo

13

Hi, patrikg!

I will Follow your Suggestion and have it upgraded

Thanks Patrikg!

14

The config is obviously not suitable for the purpose. It's an added disappointment that someone who ought to know better sold this to you as adequate. I can only suggest that if you are serious about providing this service, try to find someone who is more trustworthy to help you set it up.

For this sort of application, a VPN is unfortunately non-negotiable. Wireguard is really easy to set up both on your end and your friends'. ZeroTier is also a really popular choice for this sort of application, and it's also very well supported on most any system.

Whatever the choice, of course the setup should not be the typical one, where all traffic is routed to the VPN server; in your case the appropriate setup is to only route things to the gaming server through the tunnel. Both wg and zerotier can readily be configured for this.

Probably the only good thing is that your choice of router is spot on. The rb5009 is able to handle this sort of thing without any difficulty.

15

:rofl: You always manage to put me in a good mood... Thanks

16

I should charge for therapy!!

@Lurker, one would think zerotier may be the better option of the two. It pushes the security and connection through zerotier servers, which in my mind is probably optimal.
What I have no clue on will be the speeds comparing gamers coming to his servers over zerotier or over wireguard. I am really curious about that!!

17

IMHO
From a security point of view, direct wireguard is the better option.
Zerotier = 3th party servers.

From a flexibility point of view, zerotier may or may not be better, depending on needs.

18

Well, considering even BTH uses wireguard relays, in terms of risk and attacks, is it not better that zerotier is targetted and thus able to handle it vice the home user setting up wireguard.

19

This merits some clarification. Both for BTH and ZeroTier the connection is end-to-end, and in case of both, if a relay is used, it only sees opaque encrypted data (to which it does not possess the necessary keys to decrypt.)

With Wireguard (including BTH) trust is established by both sides having administrative knowledge of the peer's public key.

For ZeroTier, the situation is a bit more complex because - for easier setup - trust is certified by the network controller. In case you choose to have the network controller run by ZT, then yes, trust lies with them. If you run your own controller (which Mikrotik coincidentally has built in) then you are in control of the trust relationship.

20

Let me be clearer, if someone is ddosing, or other types of attacks, and a zerotier controller is in the mix, would it not be better handled then if the same attacks were directly to the MT itself....... (via port forwarding in the clear, or wireguard hosted on the router )