Trying to make a basic router setup to get started - no default config, no vpns, eth 2-5 bridged, assigned local IPs in the 10.1.0.10-254 range, eth1 on wan, and I want eth 2-5 to be able to connect to the internet.
Client device is getting assigned a desirable IP (10.1.0.254 on the local network) and can ping the router at 10.1.0.0; however, client cannot ping any public IP.
As an example, router can ping 9.9.9.9 just fine, client cannot. Router can get DNS records, sync NTP, etc., client can't do any of that. Router is also getting blasted with script kiddies trying to brute force passwords...as expected.
(I'm sure the last 3 firewall rules are redundant, I put them there intending to use them for logging purposes. ipv6 firewall rules are just there for the script kiddies, I will deal with that later.)
When the client pings a public IP, there are no rules matched in the forward chain, however Torch is able to record that it happened - so clearly the router is seeing something, but if the firewall isn't dropping it, and the NAT logic is in place, how can I use logging to identify what is in fact missing here?
Full firewall config below:
# RouterOS 7.23.1
# model = RB750Gr3
/interface bridge
add name=bridge1
/interface list
add comment=intranet name=lan
add comment=internet name=wan
/ip pool
add name=dhcp_pool1 ranges=10.1.0.10-10.1.0.254
/ip dhcp-server
add address-pool=dhcp_pool1 interface=bridge1 name=dhcp1
/ip smb
set enabled=no
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=lan
/interface list member
add interface=bridge1 list=lan
add interface=ether1 list=wan
/ip address
add address=10.1.0.0/24 interface=bridge1 network=10.1.0.0
/ip dhcp-client
add interface=ether1 name=client1 use-peer-dns=no use-peer-ntp=no
/ip dhcp-server network
add address=10.1.0.0/24 dns-server=10.1.0.0 gateway=10.1.0.0
/ip dns
set allow-remote-requests=yes servers=9.9.9.9
/ip dns static
add address=10.1.0.0 name=router.lan type=A
/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=drop chain=input in-interface-list=!lan
add action=accept chain=forward connection-state=\
established,related,untracked log=yes
add action=drop chain=forward connection-state=invalid log=yes
add action=accept chain=forward connection-nat-state=dstnat
add action=drop chain=forward connection-nat-state=!dstnat connection-state=\
new in-interface-list=wan log=yes
add action=accept chain=forward log=yes
/ip firewall nat
add action=masquerade chain=srcnat ipsec-policy=out,none log=yes log-prefix=\
masqystuff out-interface-list=wan
/ip ssh
set host-key-type=ed25519 strong-crypto=yes
/ipv6 firewall filter
add action=drop chain=input
add action=drop chain=forward
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.pool.ntp.org
add address=1.pool.ntp.org
add address=2.pool.ntp.org
add address=3.pool.ntp.org
/tool mac-server
set allowed-interface-list=lan
/tool mac-server mac-winbox
set allowed-interface-list=lan
