Is my firewall setup ok?

RouterOS Beginner Basics
1

FILTER
0 ;;; IPTV igmp
chain=input action=accept protocol=igmp src-address=10.0.0.0/8
dst-address=224.0.0.0/4 in-interface=ether2

1 ;;; IPTV udp
chain=input action=accept protocol=udp src-address=10.0.0.0/8
dst-address=224.0.0.0/4 in-interface=ether2

2 ;;; LAN and router protection from WAN
chain=input action=drop in-interface=!ether7

NAT
0 chain=srcnat action=masquerade src-address=192.168.1.0/29
dst-address=0.0.0.0/0

I configured static WAN adress on ether2 interface and NAT with DHCP server on ether7 interface
All work just fine but maybe i forgot something to add?

2

Could someone comment the config above please? Main purpose just to have internet and iptv on LAN computer.

3

I think the minimal protection has to look so:

/ip firewall filter
add chain=input protocol=icmp action=accept comment=”Allow Ping”
add chain=forward protocol=icmp action=accept
add chain=input connection-state=established action=accept comment=”Accept established connections”
add chain=forward connection-state=established action=accept
add chain=input connection-state=related action=accept comment=”Accept related connections”
add chain=forward connection-state=related action=accept
add chain=input connection-state=invalid action=drop comment=”Drop invalid connections”
add chain=forward connection-state=invalid action=drop
add chain=input protocol=udp action=accept comment=”Allow UDP”
add chain=forward protocol=udp action=accept
add chain=forward src-address=192.168.1.0/29 in-interface=ether7 action=accept comment=”Access to Internet from local network”
add chain=input src-address=192.168.1.0/29 action=accept comment=”Access to Mikrotik only from our local network”
add chain=input action=drop comment=”All other drop”
add chain=forward action=drop
4

add chain=input protocol=icmp action=accept comment=”Allow Ping”
add chain=forward protocol=icmp action=accept
I don’t need icmp initiated from wan

add chain=input connection-state=established action=accept comment=”Accept established connections”
add chain=forward connection-state=established action=accept
add chain=input connection-state=related action=accept comment=”Accept related connections”
add chain=forward connection-state=related action=accept
as I understand in my config no initiated from wan connections are allowed so no sense to allow these

add chain=input connection-state=invalid action=drop comment=”Drop invalid connections”
add chain=forward connection-state=invalid action=drop
in my case all wan initiated connectios drops not just invalid

add chain=input protocol=udp action=accept comment=”Allow UDP”
add chain=forward protocol=udp action=accept
I dont need all udp from wan

add chain=forward src-address=192.168.1.0/29 in-interface=ether7 action=accept comment=”Access to Internet from local network”
I prefer nat masquerade instead of forwarding something to somewhere

add chain=input src-address=192.168.1.0/29 action=accept comment=”Access to Mikrotik only from our local network”
my permission to access the router is port based

add chain=input action=drop comment=”All other drop”
add chain=forward action=drop[/code][/quote]
actually I don’t understand what is the purpose of the forward chain.[/color]

5

actually I don’t understand what is the purpose of the forward chain.[/color][/quote]

Your original config is minimal, but should work.

6

Indeed it works but is it safe enough? Also with this config router localhost can’t go to the WAN/LAN ping etc don’t work.

7

Safe enough for what? That’s hard to answer without knowing what your doing with it.

Sent from my SCH-I545 using Tapatalk

8

As I wrote earlier “Main purpose just to have internet and iptv on LAN computer.”

9

The original rules posted don’t include any forward chain entries nor any connection state entries so it may “work” but certainly isn’t secure and technically isn’t really implementing a stateful packet inspection firewall.

10

This simple config pass all network tests from pcflank.com. With this config nmap network scanner from WAN can’t find any open port or service on external interface of the device or detect OS etc and if we assume that all connections initiated from LAN are legit why this config is insecure?
I don’t insist on my version but try to understand. Please don’t hesitate to post your version of the possible configuration and explain it.

11

Example - If somebody on your ISP upstream network points traffic at your router for an RFC1918 address on your LAN then your router will pass that traffic.

12

How can it be if any inbound is set to drop on WAN port?

13

The input chain only affects traffic to the router itself - not traffic forwarded through the router.

14

Then why my IPTV don’t work without adding two input rules as above? To make my IPTV working I added this two rules and IGMP-Proxy. Also i’m using NAT how traffic initiated from outside pass the NAT?

15

If traffic is being used on the router itself (e.g. IGMP Proxy) then it needs to be able to pass the input chain. Look at the information on filters here:

http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter

16

I saw this page but examples are poorly explained there. If I need to block any initiated from outside connection to router and LAN how should I change config? And why say nothing about NAT?

17

Bare minimum forward chain examples to add:

LAN > WAN - Allow New connections
Allow Related Connection
Allow Established connections
Drop other traffic

Also have a look at:

http://wiki.mikrotik.com/wiki/Securing_New_RouterOs_Router

18

ether2 - static WAN
ether7 - DHCP server LAN
NTP client and IGMP proxy are enabled

Now firewall setup looks like that.

FILTER

0 ;;; drop invalid connections
chain=input action=drop connection-state=invalid

1 ;;; drop invalid connections
chain=forward action=drop connection-state=invalid

2 ;;; Drop to bogon list
chain=forward action=drop dst-address-list=bogons in-interface=ether2

3 ;;; detect DoS attack
chain=input action=add-src-to-address-list protocol=tcp
address-list=black_list address-list-timeout=1d connection-limit=10,32

4 ;;; suppress DoS attack
chain=input action=tarpit protocol=tcp src-address-list=black_list
connection-limit=3,32

5 ;;; Port Scanners to list
chain=input action=add-src-to-address-list protocol=tcp psd=21,3s,3,1
address-list=Port_scanners address-list-timeout=1w in-interface=ether2

6 ;;; NMAP FIN Stealth scan
chain=input action=add-src-to-address-list
tcp-flags=fin,!syn,!rst,!psh,!ack,!urg protocol=tcp
address-list=Port_scanners address-list-timeout=1w

7 ;;; SYN/FIN scan
chain=input action=add-src-to-address-list tcp-flags=fin,syn
protocol=tcp address-list=Port_scanners address-list-timeout=1w

8 ;;; SYN/RST scan
chain=input action=add-src-to-address-list tcp-flags=syn,rst
protocol=tcp address-list=Port_scanners address-list-timeout=1w

9 ;;; FIN/PSH/URG scan
chain=input action=add-src-to-address-list
tcp-flags=fin,psh,urg,!syn,!rst,!ack protocol=tcp
address-list=Port_scanners address-list-timeout=1w

10 ;;; ALL/ALL scan
chain=input action=add-src-to-address-list
tcp-flags=fin,syn,rst,psh,ack,urg protocol=tcp
address-list=Port_scanners address-list-timeout=1w

11 ;;; NMAP NULL scan
chain=input action=add-src-to-address-list
tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg protocol=tcp
address-list=Port_scanners address-list-timeout=1w

12 ;;; Drop to port scan list
chain=input action=drop src-address-list=Port_scanners

13 ;;; Add Syn Flood IP to the list
chain=input action=add-src-to-address-list tcp-flags=syn protocol=tcp
address-list=Syn_Flooder address-list-timeout=30m connection-limit=30,32

14 ;;; Drop to syn flood list
chain=input action=drop src-address-list=Syn_Flooder

15 ;;; allow IPTV traffic in to router igmp proxy
chain=input action=accept protocol=igmp src-address=10.0.0.0/8
dst-address=224.0.0.0/4 in-interface=ether2

16 ;;; allow IPTV traffic in to router igmp proxy
chain=input action=accept protocol=udp src-address=10.0.0.0/8
dst-address=224.0.0.0/4 in-interface=ether2

17 ;;; allow all from LAN
chain=input action=accept src-address=192.168.1.0/29 in-interface=ether7

18 ;;; allow already established connections
chain=input action=accept connection-state=established

19 ;;; drop in all
chain=input action=drop

20 ;;; allow new connections from LAN
chain=forward action=accept connection-state=new
src-address=192.168.1.0/29

21 ;;; allow already established connections from LAN
chain=forward action=accept connection-state=established

22 ;;; allow related connections from LAN
chain=forward action=accept connection-state=related

23 ;;; IPTV
chain=forward action=accept protocol=udp src-address=10.0.0.0/8
dst-address=224.0.0.0/4

24 ;;; drop forward all
chain=forward action=drop



NAT
0 chain=srcnat action=masquerade src-address=192.168.1.0/29 out-interface=ether2


LIST ADDRESS TIMEOUT

0 ;;; Self-Identification [RFC 3330]
bogons 0.0.0.0/8
1 X ;;; Private[RFC 1918] - CLASS A # Check if you need this subnet before enable it
bogons 10.0.0.0/8
2 ;;; Loopback [RFC 3330]
bogons 127.0.0.0/16
3 ;;; Link Local [RFC 3330]
bogons 169.254.0.0/16
4 ;;; Private[RFC 1918] - CLASS B # Check if you need this subnet before enable it
bogons 172.16.0.0/12
5 X ;;; Private[RFC 1918] - CLASS C # Check if you need this subnet before enable it
bogons 192.168.0.0/16
6 ;;; Reserved - IANA - TestNet1
bogons 192.0.2.0/24
7 ;;; 6to4 Relay Anycast [RFC 3068]
bogons 192.88.99.0/24
8 ;;; NIDB Testing
bogons 198.18.0.0/15
9 ;;; Reserved - IANA - TestNet2
bogons 198.51.100.0/24
10 ;;; Reserved - IANA - TestNet3
bogons 203.0.113.0/24
11 X ;;; MC, Class D, IANA # Check if you need this subnet before enable it
bogons 224.0.0.0/4

  1. Is it correct now? Maybe rules are in wrong order or maybe I forgot something?

  2. Do I need to add this rule? And what practical purpose does it have?

add chain=input src-address=127.0.0.1 dst-address=127.0.0.1 action=accept comment=“accept localhost” disabled=no

  1. Why NAT counter shows incorrect values?