Mikrotik Client and User security options (Web protection, DPI...)

RouterOS General
1

Hi!

we moved over the last years from SOPHOS (SG & XG) to Mikrotik - and we’re very happy!

Only the Websurfing options for Clients and Users is not like the “Next Gen” Firewalls.
On Sophos we have lot’s of issues with Online Banking while TLS Encryption is enabled.
But some AV Scanning, Webcontrol, DNS protection or DPI would be nice. → https://www.sophos.com/en-us/products/next-gen-firewall/features

Well known that Mikrotiks are primary Routers, we want do add more “Security” for our Clients and Users.

What are most common tools (or settings) to get some extra security?

Only forward Port 80 and 443 to WAN?
Or redirect to a Appliance/VM which do the Next-Gen stuff? Any recommendations? OpenSource? :slight_smile:
Some tools i’ve googled but not tested is Wazuh or CrowdSec… but perhaps one of you guys had already some experience…

Best Regards!

2

MT is not DPI and thus good security is the basics.
Only allow needed traffic block all else.
Dont open up ports to the internet ( port forwarding ) if at all possible.
a. use wireguard to allow clients to connect to servers instead
b. use CHR in cloud if need be
c. use zerotier to connect users to servers

IF stuck with port forwarding at least ensure you use source address list for each DSTNAT rule,
( users should have a fixed WANIP, or can get a free dyndns domain name to provide you for the source address list )

d. dont use default ports for winbox or any protocol
e. dont use default admin password
f. dont connect to the internet until security is in place.