(1) What is is this??
/interface lte apn
add apn=publicip.net.il name=PUB
add apn=PUB name=apn1
Is that part of the lte wan connection?? If so it needs to be added to
WAN interface member list.
(2) Try disabling this rule to see if there is any effect, not sure of its purpose/value??
/interface detect-internet
set detect-interface-list=all
(3) I prefer not to show folks my winbox port and thus I only have it as required in IP services (and remove it for any configs I show) and not in any firewall rules. In IP services you configure the winbox port and where it can be configured from. This can be the subnet for example, and have the firewall rule limit to specific IPs. You also under TOOLS have MAC_SERVER - here you can select the mac_winbox-server and can limit access to INTERFACE LIST of your choice!! So lots of way to provide security.
/ip firewall filter
add action=accept chain=input comment=“WinBox Wan Administration” dst-port=
8291 protocol=tcp src-address=x.x.x.x
Also, as admin you need full access to the router not just the winbox port.
Use of firewall address list vice single address is handy because you can add or subtrack devices quickly without monkeying with the firewall rule.
(your desktop, smartphone using MT app, tablet, laptop etc…)
Also I have no idea what kind of IP address the src-address you got there, as your range is 192.168.88.x… I hope that is not some outside WAN IP???
Finally, I would change the default port number to something else, like 34221.
(4) The NAT rules look messy! Did you do this??
The first set have duplicates unless you have forgotten to make one set UDP and the second set TCP??
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade”
ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=9981 in-interface=ether1 protocol=
tcp to-addresses=192.168.88.200 to-ports=9981
add action=dst-nat chain=dstnat dst-port=9982 in-interface=ether1 protocol=
tcp to-addresses=192.168.88.200 to-ports=9982
add action=dst-nat chain=dstnat dst-port=9981 in-interface=ether1 protocol=
tcp to-addresses=192.168.88.200 to-ports=9981
add action=dst-nat chain=dstnat dst-port=9982 in-interface=ether1 protocol=
tcp to-addresses=192.168.88.200 to-ports=9982
add action=dst-nat chain=dstnat dst-port=22 in-interface=ether1 protocol=tcp
to-addresses=192.168.88.249 to-ports=22
add action=dst-nat chain=dstnat dst-address=test dst-port=9981 \ ???
protocol=tcp to-addresses=192.168.88.200
The stuff below is really grotesque!!
add action=masquerade chain=srcnat out-interface=ether1 (DUPLICATE and can get rid of)
add action=dst-nat chain=dstnat dst-address= dst-port=9982
protocol=tcp to-addresses=192.168.88.200
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat dst-address=192.168.88.200 dst-port=9981
out-interface=bridge protocol=tcp src-address=192.168.88.0/24
add action=masquerade chain=srcnat dst-address=192.168.88.200 dst-port=9982
out-interface=bridge protocol=tcp src-address=192.168.88.0/24
add action=dst-nat chain=dstnat comment=“allow remote mikrotik” dst-address=
dst-port=80 in-interface=ether1 protocol=tcp src-address=
1.1.1.1 to-addresses=192.168.88.1 to-ports=80
add action=dst-nat chain=dstnat comment=“allow remote 8291” dst-port=8291
in-interface=ether1 protocol=tcp to-addresses=192.168.88.1 to-ports=8291
add action=dst-nat chain=dstnat disabled=yes dst-port=443 in-interface=ether1
protocol=tcp to-addresses=192.168.88.1 to-ports=443
add chain=srcnat
These below are particularly worrisome. Are you opening up winbox unencrypted tot he outside world??
Not sure which device resides on 192.168.88.1 ?? Same with 443.
add action=dst-nat chain=dstnat comment=“allow remote 8291” dst-port=8291
in-interface=ether1 protocol=tcp to-addresses=192.168.88.1 to-ports=8291 ???
add action=dst-nat chain=dstnat disabled=yes dst-port=443 in-interface=ether1
protocol=tcp to-addresses=192.168.88.1 to-ports=443 ???
