I first created an address-list and put a few IPs in there, then I set a firewall rule in order to drop any IPs but those of my list to reach my server:
;;; Block every IPs to Server but Server IPs chain=forward action=drop connection-state=new dst-address=192.168.3.10
src-address-list=!Server-IPs log=yes log-prefix=""
I placed it almost at the top of the firewall list in order to avoid any position rule issue and check it.
(I don’t know why my image doesn’t show up above correctly. Anyway it’s a thumbnail, just click on it to see it)
Unfortunately it seems not to be working even though I see counters for it.
I mean, Other devices that are not in the list can reach the server’s services’ weblogin pages, i.g. 192.168.3.10:9000 (portainer) or 192.168.3.10:32400 (plex server dashboard)
I am still wondering what I did wrong. Could you help me please?
Thanks
First we do not work with crystal balls, tarot cards, or ouji boards.
Please post your config for review.
/export hide-sensitive file=anynameyouwish
Also one must understand how port forwarding for servers works in MT configurations.
There is only one rule germane in the firewall rules (forward chain) and that is to allow any connection-nat-state=dstnat.
Which basically tells the router, for any unsoliticited traffic (originated from the net or possibly from users on the LAN using the public IP for access to the server) inbound, let it through the firewall if it has a destination port also defined in the NAT rules.
The NAT rules and specifically destination nat rules are where one can ADD the source-address-list of authorized users to that server.
Note that the IP addresses of your authorized users can be in the form of public IP address (if they have a static fixed public IP) or the router can accept in the IP address entry a DYNDNS name (url), for the case of dynamic public IPs. The router will resolve the name to the proper IP for you.
Given the position of the rule in the chain, and given that it counts and logs, I’d assume that those clients that can reach the server although they are not in the address-list are in the same subnet like the server, so the send packets to the server directly, not via the router.
If the above is not the case, it could be that connections established before you’ve added the rule continue working but new ones cannot establish - the rule matches on connection-state=new, so it ignores mid-connection packets.
In general your firewall rules are a mess and the biggest heartache is the improper order of rules and also the fact that they are not clearly grouped together all the input and all the forward etc..
What the heck are you trying to say or do with this rule???
add action=drop chain=forward comment=
“Block every IPs to Server but Server IPs” connection-state=new
dst-address=192.168.3.10 log=yes src-address-list=!Server-IPs
Why are you allowing port 80 inbound on the INPUT chain??
What is the purpose of these two rules: Doesnt the second rule already include the first rule so the first one would not be necessary??
add action=accept chain=input comment=“From pfsense LAN” log=yes src-address=
192.168.5.0/24
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
in-interface-list=!LAN log=yes
Same question on these two… The second rule drops ALL else, why bother with the dropping on the first rule just make it ALLOW connections for connection-nat-state.
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN log=yes
add action=drop chain=forward comment=“Drop all else” disabled=yes
The only source nat entry I sorta understand is the first one… (assuming ether5 is the name of your wan interface)
Can you tell me the purpose of the others??
Destination NAT rules, missing dst-address=fixed public IP, On first rule, but what the heck are you doing a port forward for wireguard here ???
I know that they look a mess. I told you that I am experimenting with my Home LAB. Anyway, most of them have always worked as I expected
What the heck are you trying to say or do with this rule???
add action=drop chain=forward comment=
“Block every IPs to Server but Server IPs” connection-state=new
dst-address=192.168.3.10 log=yes src-address-list=!Server-IPs
I’d want to block any connection attempts coming from IPs in my LAN other than those in my server-IPs list (my own devices basically)
Why are you allowing port 80 inbound on the INPUT chain??
It is actually a block rule and I don’t even remember the reason why it is still there, but i don’t think it has anything to do withy my problem.
What is the purpose of these two rules: Doesnt the second rule already include the first rule so the first one would not be necessary??
add action=accept chain=input comment=“From pfsense LAN” log=yes src-address=
192.168.5.0/24
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
in-interface-list=!LAN log=yes
Same question on these two… The second rule drops ALL else, why bother with the dropping on the first rule just make it ALLOW connections for connection-nat-state.
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN log=yes
add action=drop chain=forward comment=“Drop all else” disabled=yes
The only source nat entry I sorta understand is the first one… (assuming ether5 is the name of your wan interface)
Can you tell me the purpose of the others??
Destination NAT rules, missing dst-address=fixed public IP, On first rule, but what the heck are you doing a port forward for wireguard here ???
Again, I can’t see how this setup above has anything to do with my problem, sorry.
Yes, they are in the same subnet like the server. I’d like to know if I can block IPs of devices that connect to my LAN occasionally, without setting VLANs or separate an ethernet port from the bridge and set a different subnet on it, then create rules to block unwanted traffic coming from it. Thanks
Still dont understand what you are trying to accomplish and why…
You have one subnet.
You wish to block segments of that subnet (some users within the same LAN ) from accessing your servers also on the LAN
You would prefer not to have to create different subnets or create vlans to separate those users off the lan to achieve that separation.
It would be accurate to say that the only LANIPs that you want connecting to the servers are the ones associated with your PC/laptop/smartphone/ipad etc…
The traffic to the server from devices in the same subnet can be blocked using /interface bridge filter rules or, because your Mikrotik model supports that, using /interface ethernet switch rule rules. To make this possible, the server must be connected to another Ethernet port of your Mikrotik device than the devices you want to prevent from accessing the server.
The bridge “firewall” cannot be made stateful like the IP one, i.e. no connection-state can be tracked and referred to in rules, and address-list matching is also not supported. Besides, if you want to use /interface bridge filter rules, you have to disable switch chip forwarding at least on the port to which the server is connected; if you want to use /interface ethernet switch rule rules, bear in mind that they are matched as the frame enters the switch chip, i.e. you must hook them to all ports of the bridge except the one to which the server is connected. Switch chip rules work at wirespeed, but their number is very limited (30 if I remember correctly).
Yes, right. I’ve realized that there is nothing to “forward” really on the same subnet; my bad.
I know that I could have created a different subnet on a separate (from the bridge) ethernet port, then set rules on it. VLANs is not an option now. I’m going to use VLANs when I buy a vlan-capable switch to connect to my Mikrotik.
As they said, there would be another way to accomplish that by enabling "use IP firewall” on the port, but it would put more stress on the CPU. I don’t think it si worth it.
So, for the time being at least, a separate port from the bridge with a new subnet on it is probably the best way to go.
Setting firewall rules directly on the linux server accepting only a list of IPs would be a different, yet still effective way to reach my purpose maybe.
Thanks
Are you talking about the "“use IP firewall” in the bridge setting?
The bridge “firewall” cannot be made stateful like the IP one, i.e. no > connection-state > can be tracked and referred to in rules, and > address-list > matching is also not supported.
Yes, I got it now.
Besides, if you want to use > /interface bridge filter > rules, you have to disable switch chip forwarding at least on the port to which the server is connected; if you want to use > /interface ethernet switch rule > rules, bear in mind that they are matched as the frame enters the switch chip, i.e. you must hook them to all ports of the bridge except the one to which the server is connected. Switch chip rules work at wirespeed, but their number is very limited (30 if I remember correctly).
Understood, but it isn’t worth it, I guess.
I think I’ll separate an ethernet port from the bridge and set a new subnet on it. Thanks
