Blignaut - Tried to answer via email - the email got returned…
Well let’s first try some filtering to get your bandwidth under control and then we’ll get to the rest of it…
Everything here is in Winbox. I generally start with a ’ / ’ to indicate a menu item on the left hand menu of Winbox, the ‘commands’ after that are the menu item, and any sub item, and/or ‘tab’ in the window that pops up once the menu item is selected. Generally - if the entire word is CAPITALIZED then it is the name of something and that means an action on your part to usually change this to the appropriate name.
First; /bridge, ‘settings’ button click this, now click on Use IP Firewall - a check mark should appear. Say ‘Ok’.
Ok - to start - let’s do some filters.
/ip firewall filter(tab).
‘+’ to add new ones
add - src-addr= your network 10.5.50.0/24 (I believe that is your current network) in-interface=bridge (your bridge interface name) P2P=all, Action Tab, action=drop
This rule will drop ALL Point-to-Point protocols like WAREZ, Limewire, Rhapsody, Rapidshare, etc. That should help you right away.
Next you need to figure out what protocols you are willing to let run on your system. You have to have DNS (port 53), most likely you’ll need http - 80, https-443, pop-110, smtp-25/587, ftp-21, ntp123, snmp-161 & 162, ssh-22, winbox-8291(TCP). There are a lot of other protocols - so you need to do a little research to find the ones you want to allow besides the short list I put here… A couple of rules to setup some chains first - but these are after the above rule for P2P dropping.
The below is loosely based on this wiki article; http://wiki.mikrotik.com/wiki/Dmitry_on_firewalling I made the below one short and to the point. You will want to study this wiki (and the others) on Firewalling with MT.
I recommend that you add each of these rules and have them entered in - in a disabled state. That way you can turn them all on at once.
chain=forward src-addr=YOUR NETWORK in-interface=BRIDGE connection-state=established action(tab) action=accept
chain=forward src-addr=YOUR NETWORK in-interface=BRIDGE connection-state=related action(tab) action=accept
Allow established and related connections
chain=forward src-addr=YOUR NETWORK protocol=tcp in-interface=YOUR BRIDGE action(tab) action=jump jump-target=tcp
all the tcp type requests will go through this branch.
chain=forward src-addr=YOUR NETWORK protocol=udp in-interface=YOUR BRIDGE action(tab) action=jump jump-target=udp
all udp will go through this chain
TCP Chain
chain=tcp protocol=tcp scr-port=1024-65535 dst-port=53 action(tab) action=accept
chain=tcp protocol=tcp scr-port=1024-65535 dst-port=80 action(tab) action=accept
chain=tcp protocol=tcp scr-port=1024-65535 dst-port=25 action(tab) action=accept
now continue will all the TCP type protocols you want to let your clients use.
chain=tcp src-addr=YOUR NETWORK in-interface=BRIDGE connection-state=new action(tab) action=accept
chain=tcp action(tab) action=drop Here we drop any TCP services we did not allow…
UDP chain
chain=udp protocol=udp scr-port=1024-65535 dst-port=53 action(tab) action=accept
chain=udp protocol=udp scr-port=1024-65535 dst-port=123 action(tab) action=accept
now continue will all the UDP type protocols you want to let your clients use.
chain=udp src-addr=YOUR NETWORK in-interface=BRIDGE connection-state=new action(tab) action=accept
chain=udp action(tab) action=drop Here we drop any UDP services we did not allow…
Ping - allow
chain=forward protocol=icmp action(tab) action=accept
Now to drop anything that made it through that we don’t want…
chain=forward action(tab) action=drop
FROM THE FORUM:
Tom
I have Update my Router with the Complete Package 3.14 .
I have the 532A with 64Mb Memory.
What RB should I used at main AP and for the Repeaters to Keep the cost of the repeaters down. ? RB433AH probably when you need to add new ones… At the main AP - as soon as you can afford it, swap the 532 for a RB433AH- they are about 10 times faster than the RB532.
What Solar Equipment do I need to Run the Repeater , 1 x 35Watt Panel , Regulator and 12 V Batt ? I don’t know what your solar conditions are where you reside…you need at least (typically) twice the wattage that your equipment draws - so for RBs (not the 1000) 40 watts should be good for one RB. You also need a regulator that will maintain your battery output at 12vdc - and will turn off if the battery voltage drops below 11vdc (to keep your battery from being destroyed). Your batteries will also have to be ‘deep cycle’ type batteries to withstand the constant charging/discharging. You also need the ‘input’ or charging regulator as you already mentioned.
Running Hotspot , Can some on still access a Printer @ 10.5.50.100 , If you are connected at 10.5.50.20 with out putting in your username and password ? I don’t know… Right now with your hotspot setup the way it is (from what I can tell) you probably have to do that. When we get everything through the Usermanager/Hotspot and routed instead of bridged, I believe we can use MAC authentication, no username or password required, it will then depend on where those two units are (same AP or different AP). I would personally not plan on having that capability - more than likely you’ll need to setup a site to site VPN connection for that to happen, if it can be done, there is also ‘Internet printing’, using the shared printing feature in Windows that well may work for you…