Im sure that suggestions for improving the firewall IPv4/IPv6 will be taken serious. For larger networks tr069 could be used to keep the routers up-to-date or streamline configs.
An user can interfere but that is something between the provider and the customer.
I agree Samot and co, I’m not really sure what Mikrotik can do about the kit out there that still isn’t patched. These routers probably haven’t been logged into at all for years. Unfortunately Mikrotik aren’t big enough for this to have been global big news like it might be with Netgear/TPlink or big enterprise giants like Cisco. Even then, a business or home user who had a Mikrotik installed years ago that hasn’t been touched since, and have never heard of Winbox, aren’t going to bother updating.
If users have a Mikrotik and it’s injecting crypto-mining into their traffic because they haven’t installed the fix, then really it’s on them. Unfortunate that it causes bad press for Mikrotik, but hopefully these articles have done their homework and point out it’s an issue that was fixed in a timely manner, causing problems because users haven’t followed advice to update.
There was a guy a few years ago who wrote an exploit for hacked IoT devices to brick them, because it was the only way to force owners to update them. He did get done for it though… (not that I’m suggesting that’s a good idea here, just that it’s near impossible to get 100% of people to update something that is working)
I think he means the default action of “if not filters apply”, which is a non issue given the factory “default” firewall filters.
Sent from Tapatalk
I think he means the default action of “if not filters apply”, which is a non issue given the factory “default” firewall filters.
I did think which reading this post that maybe the firewall should default to deny with no rules, so you have to explicitly allow everything you want to go through.
Some people would just stick an allow all in of course. It’s amazing how many people leave the router open (even IT people) because it’s easier for them to get remote access, or don’t want to spend the time creating rules to match only the specific services they need to use.
Yup! No matter how much I stress creating catch-all filters logging and dropping “the rest of the traffic”, many still don’t get it and call me in a panic about strange behavior. Even supposed “experts” put their customers in a bad position because they fail to create even the most basic FW rules. Very sad indeed, but it’s probably MT’s fault for some obscure reason… “sarcasm here” 
As it was already pointed out, the default firewall rules do that. They block all until allowed by the user.
/ip firewall filter
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=“defconf: accept established,related” connection-state=established,related
add action=drop chain=input comment=“defconf: drop all from WAN” in-interface=ether1
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related
add action=accept chain=forward comment=“defconf: accept established,related” connection-state=established,related
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=drop chain=forward comment=“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat connection-state=new in-interface=ether1
This is basically the set of default rules I have found on every device I’ve gotten from Mikrotik. Until I add proper rules, either firewall or NAT, I cannot access the router or the devices behind it remotely because it would drop all my traffic since it lacks proper rules.
As it was already pointed out, the default firewall rules do that. They block all until allowed by the user.
I was referring to a implicit block that everything hits even if the firewall is empty (of course thought would have to be put in to what to do if someone deletes all the rules). Lots of people replace the firewall rules, and for some reason some decide to try and block certain things, rather than just allow what they want and drop the rest. It’s also very common for people to mess with the firewall until their requirements work, but not consider what has been left open in the process. Not that I’m genuinely suggesting it; I like having full control over the firewall - but then I always end with a drop ALL forward/input anyway.
Also the default rules are all very well until you add a pppoe client for your wan and realise the traffic skips straight over the ether1 drop rule (even if you’re using that port, which may be a surprise to some users, especially new ones). They’d arguably be better off with an allow from bridge-lan, and a drop all.
If hackers can login and change the config. then all anybody else needs to do is login and update the software. Job done. Simple.
I can’t find the (older??) wiki page I have in mind (but found https://wiki.mikrotik.com/wiki/Manual:Default_Configurations) but fresh out of the box, configs vary. Some models may be shipped blank (as was the case for my RB1200), so it would be easy to forget FW filters.
What we are talking about?
Ask average user what router is … answers will be like “What?”, “YYYYaaaaayyyyaaa? What?”, to more sophisticated “Do you mean this white/blue/silver etc. box?” or “I have Internet from WiFi”.
This already addressed for quite some time using interface lists in default configuration.
As you stated “people to mess with the firewall”, default allow changed to default drop will not improve anything.
@AlainCasault
1200 is not a home router, if you buy it you have to know what you are doing.
This already addressed for quite some time using interface lists in default configuration
As you stated “people to mess with the firewall”, default allow changed to default drop will not improve anything.
Assuming you know to add the interface to the wan list… But yes this doesn’t improve anything as it’s up to the user to make sure it’s locked down and many don’t have the expertise. Any changes would just be altering the way the default config blocks wan access, until someone starts messing with it.
1200 is not a home router, if you buy it you have to know what you are doing.
You have to know what you’re doing with all this kit really unless you can just plug it in with the default config and not touch it, which goes back to the original issue. Lots of people buy this kit with no real expertise, and lots of people have these routers installed with no ongoing support and don’t even know what it is.
I agree with you, but my point was that some models have different behavior. And as stated in other replies, even so-called “experts” will miss basic steps setting up (corporate) devices. My comment is to emphasize that we can’t (always) rely on defaults.
P.S. what is the URL for the default parameters based on models??
Unfortunately the default configuration is determined when the device is first powered up.
So when you get a MikroTIk device that was manufactured before that change, then immediately update its software and start configuring it,
you will will be using the old firewall config, as is aptly shown above where user Samot pasts his default firewall which is the old vulnerable type.
It should be considered to do a reset to defaults when an update is done on a router that has fully default config, at least for the firewall.
(a similar issue exists in the IPv6 default config which is not loaded unless you reset to defaults AFTER enabling the IPv6 package, which
lots of users probably will not do, and they end up with an empty allow-all firewall for IPv6)
If you, as average driver using standard cars, buy big american truck with 24 or more step gearbox, do you expect that this truck will have all bells and whistles installed to protect itself from being destroyed? Should gearbox constructor expect that someone unfamiliar with this technology and untrained will use it with 30 ton load?
I don’t think the affected users are home users with a CCR, which would compare to untrained users buying a truck.
No, they are using a hAP or hEX as their home router and they have default config but they had to add a PPPoE client
and they mistakenly believed that this could be done by watching a youtube video.
E.g. videos like this https://www.youtube.com/watch?v=OTW2fOQ_pT0 have probably done a lot of damage to MikroTik
reputation. 79000 views, maybe 30000 victims? And look at the comments, they are sooo happy! But now they all
have been hacked.
Maybe someone should collect a list of those helpful videos posted by nitwits and ask youtube to take them down.
No idea if they would do that, maybe when you refer to risk of privacy or disruption of internet?
Since the post has gone away from the initial topic and deviated into trying to find solutions to improve the overall experience, this might be the time to argue that indeed there are place were Mikrotik could do better.
As already mentioned by default routers don’t have ipv6 enabled and enabling it will leave you with no default firewall rules. Resetting the router while ipv6 package is enabled will give you a starting point for a decent ipv6 firewall, which will even block bogus ipv6 addresses.
Maybe, router os could ask to enable the default firewall when someone enables ipv6 package for the first time. I seem to remember that it warns that enabling ipv6 will results in no firewall rules for it (correct me if I’m wrong) but yet it still leaves you without any default protection. It does not have to be something that is done automatically, but rather give the user the choice whether to enable or not the default ipv6 rules. This isn’t something groundbreaking but could help some people who are less tech savvy. It’s still up to the user whether to enable the rules or not, but could help to increase the default security in new installs and after router resets.
Give the user a choice and who knows, he might like the increased security.
That particular video has nothing to do with default configuration. He removes default configuration and makes everything from scratch, basically showing how not to configure your router.
True but this is just one video that I found by a quick search, I have seen another (that I did not find so quickly now) that works from a default config but still forgets to correct the firewall.
With a new default config that is not so much of a problem, but you will need a router which is manufactured and delivered with a fairly recent version to get that new config.
(because default config is not made by your updated routeros but by the routeros that happens to be on the device)
Besides, you have to understand that today’s home admin or wannabe WISP admin does not work from established procedures/manuals but watches Youtube.
So all that crap on Youtube is a major problem…
That was the basic firewall :
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept established,related" connection-state=established,related
add action=drop chain=input comment="defconf: drop all from WAN" in-interface=ether1
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related" connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface=ether1
and the one from a 6.42.6 :
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
So, starting from scratch with no-defaults=yes , is this latest sequence safer thus recommended ??