You are right. I'm sorry I bothered you.
Could you please help me with one more issue?
My Harpin Nat is not working. I moved this rule to the beginning of NAT, but it didn't help.
add action=masquerade chain=srcnat comment=HairpinNat dst-address=
192.168.77.0/24 src-address=192.168.77.0/24
I want the local hosts on the same LAN subnet as the server and other hosts, to access one of the hosts not by lan-ip address but by the router's public IP address.
Understood, you mean the server needs to be reached by local devices ( on the same LAN ) as well as external devices.
Can you post the current config for review please.
Again, I'm sorry I bothered you.
Harpin Nat rule works after I move it to the beginning of NAT.
The problem was my DNS setup - I use a ddns domain because it's easier to remember than a public ip address.
I blocked DDNS and this caused local hosts to be unable to find other local hosts by domain name (only using local IP) .
Good to hear!!
Hello Anav,
Could you please take a look at my updated config, especially the firewall?
I implemented a vlan to isolate one subnet (192.168.0.0/24) - it works, but I'm not sure if the security rules are correct.
Many thanks in advance.
2026-07-17 21:15:49 by RouterOS 7.21.5
software id = xxx
/interface bridge
add name=bridge vlan-filtering=yes
/interface ethernet
set [ find default-name=ether6 ] comment=WAN disable-running-check=no name=
ether1
set [ find default-name=ether7 ] comment=""
disable-running-check=no name=ether2
set [ find default-name=ether8 ] comment=""
disable-running-check=no name=ether3
set [ find default-name=ether9 ] disable-running-check=no name=ether4
set [ find default-name=ether10 ] comment=""
disable-running-check=no name=ether5
set [ find default-name=ether1 ] disable-running-check=no name=ether6
set [ find default-name=ether3 ] comment="" disable-running-check=
no name=ether7
set [ find default-name=ether4 ] comment="" disable-running-check=no
name=ether8
set [ find default-name=ether2 ] comment="" disable-running-check=
no name=ether9
set [ find default-name=ether5 ] comment=""
disable-running-check=no name=ether10
/interface vlan
add interface=bridge name=vlan10 vlan-id=10
/interface list
add name=WAN
add name=LAN
/ip pool
add name=dhcp ranges=192.168.77.10-192.168.77.70
add name=pool_vlan10 ranges=192.168.0.10-192.168.0.20
/ip dhcp-server
add address-pool=dhcp interface=bridge name=dhcp
add address-pool=pool_vlan10 interface=vlan10 name=dhcp_vlan10
/queue type
add cake-diffserv=besteffort cake-flowmode=dual-dsthost cake-nat=yes
cake-rtt=30ms cake-rtt-scheme=regional kind=cake name=cake-rx
add cake-ack-filter=filter cake-diffserv=besteffort cake-flowmode=
dual-srchost cake-nat=yes cake-rtt=30ms cake-rtt-scheme=regional kind=
cake name=cake-tx
/queue simple
add max-limit=1000M/1000M name=queue1 queue=cake-rx/cake-tx target=ether1
total-queue=default
/interface bridge port
add bridge=bridge interface=ether2
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
add bridge=bridge interface=ether6
add bridge=bridge interface=ether7
add bridge=bridge interface=ether8
add bridge=bridge interface=ether9
add bridge=bridge interface=ether10
/ip neighbor discovery-settings
set discover-interface-list=all lldp-mac-phy-config=yes lldp-max-frame-size=
yes lldp-vlan-info=yes
/interface bridge vlan
add bridge=bridge tagged=bridge,ether10 vlan-ids=10
/interface detect-internet
set detect-interface-list=all
/interface list member
add interface=ether1 list=WAN
add interface=bridge list=LAN
/ip address
add address=192.168.77.1/24 interface=bridge network=192.168.77.0
add address=192.168.0.1/24 interface=vlan10 network=192.168.0.0
/ip dhcp-client
add default-route-tables=main interface=ether1
/ip dhcp-server lease
...
/ip dhcp-server network
add address=192.168.0.0/24 dns-server=192.168.0.1 gateway=192.168.0.1
add address=192.168.77.0/24 dns-server=192.168.77.1 gateway=192.168.77.1
netmask=24
/ip dns
set allow-remote-requests=yes doh-max-server-connections=10 use-doh-server=
https://dns.nextdns.io/... verify-doh-cert=yes
/ip dns static
add address=45.0.0.0 name=dns.nextdns.io type=A
add address=45.0.0.0 name=dns.nextdns.io type=A
add address=2a0:c0:: name=dns.nextdns.io type=AAAA
add address=2a0:c1:: name=dns.nextdns.io type=AAAA
/ip firewall address-list
add address=192.168.77.10 list=Authorized
add address=192.168.77.11 list=Authorized
...
add address=192.168.0.10 list=Authorized
add address=192.168.0.11 list=Authorized
add address=192.168.0.12 list=Authorized
add address=192.168.0.13 list=Authorized
...
/ip firewall filter
add action=accept chain=input comment=
"Accept: established, related, untracked." connection-state=
established,related,untracked
add action=drop chain=input comment="Drop invalid." connection-state=invalid
add action=accept chain=input comment="Accept ICMP." protocol=icmp
add action=accept chain=input comment=Loopback. dst-address=127.0.0.1
add action=accept chain=input comment="Authorized hosts - VLAN10."
src-address=192.168.0.0/24 src-address-list=Authorized
add action=accept chain=input comment="Authorized hosts." in-interface-list=
LAN src-address-list=Authorized
add action=accept chain=input comment="DNS udp." dst-port=53
in-interface-list=LAN protocol=udp
add action=accept chain=input comment="DNS tcp." dst-port=53
in-interface-list=LAN protocol=tcp
add action=accept chain=input comment=
"Accept: Winbox from WAN - temporary for tests." disabled=yes dst-port=
8291 in-interface=ether1 protocol=tcp
add action=drop chain=input comment="Drop all else."
add action=fasttrack-connection chain=forward comment=Fasttrack.
connection-state=established,related
add action=accept chain=forward comment=
"Accept: established, related, untracked." connection-state=
established,related,untracked
add action=drop chain=forward comment="Drop invalid." connection-state=
invalid
add action=drop chain=forward comment="Block VLAN10 to LAN." dst-address=
192.168.77.0/24 src-address=192.168.0.0/24
add action=accept chain=forward comment="Allow VLAN10 to Internet."
out-interface-list=WAN src-address=192.168.0.0/24
add action=accept chain=forward comment="Internet traffic."
in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="Port forwarding."
connection-nat-state=dstnat
add action=drop chain=forward comment="Drop all else."
/ip firewall nat
add action=masquerade chain=srcnat comment=HairpinNat. dst-address=
192.168.77.0/24 src-address=192.168.77.0/24
add action=masquerade chain=srcnat comment=Masquerade. out-interface-list=WAN
add action=dst-nat chain=dstnat comment="Forward to pc2." dst-address=
x.x.x.x.x dst-port=12000 protocol=tcp to-addresses=192.168.77.48
/ip route
add disabled=yes dst-address=0.0.0.0/0 gateway=192.168.77.1
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set winbox port=9999
/system clock
set time-zone-name=Europe/Paris
/system identity
set name=mikrotik1
/system package update
set channel=long-term
/system scheduler
add interval=5d name=ExportConfig on-event=ExportConfig policy=
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon
start-date=2026-06-22 start-time=06:00:00
/system script
add dont-require-permissions=no name=ExportConfig owner=admin policy=
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":
local databiezaca [/system clock get date]
\n:local dzien [ :pick $databbiezaca 4 6 ]
\n:local mies [ :pick $databbiezaca 0 3 ]
\n:local rok [ :pick $databbiezaca 7 11 ]
\n:local plik ""
\n#:set plik ("$[/system identity get name]"."_"."$rok"."$mies"
."$dzien")
\n:set plik ("$[/system identity get name]")
\n:log info "Eksportuje konfiguracje $plik"
\n/export file=$plik
\n/system backup save name=$plik
\n:delay 5
\n/tool e-mail send to="x@x.com" subject=("Konfiguracja $pli
k ($[/system resource get architecture-name]/$[/system resource get vers
ion]) @ $[/system clock get date] $[/system clock get time]") file=("
$plik.rsc","$plik.backup")"
/tool e-mail
set certificate-verification=no from=x@x.com port=587 server=
mail.x.com user=x@x.com
I will look but not after some effort on your part.
Look above you still have settings such as detect-internet-all which you already got advice on and ignored.
Come back with a better config based on advice given.
Honestly, just configuring the VLANs took a lot of work, but I'm not complaining.
The "interface detect-internet" feature, I had already disabled it, but I don't know why it was enabled again.
/interface detect-internet set detect-interface-list=none
Below is my new configuration. Basically, I changed two rules to add additional borders:
add action=accept chain=input comment="Authorized hosts - VLAN10." src-address=192.168.0.0/24 src-address-list=Authorized
into:
add action=accept chain=input comment="Authorized hosts - VLAN10." in-interface=vlan10 src-address-list=Authorized
and
add action=accept chain=forward comment="Allow VLAN10 to Internet." out-interface-list=WAN src-address=192.168.0.0/24
into:
add action=accept chain=forward comment="Allow VLAN10 to Internet." in-interface=vlan10 out-interface-list=WAN
Many thanks in advance for your feedback.
2026-07-19 13:34:18 by RouterOS 7.21.5
software id = xxxx
/interface bridge
add name=bridge vlan-filtering=yes
/interface ethernet
set [ find default-name=ether6 ] comment=WAN disable-running-check=no name=
ether1
set [ find default-name=ether7 ] comment=""
disable-running-check=no name=ether2
set [ find default-name=ether8 ] comment=""
disable-running-check=no name=ether3
set [ find default-name=ether9 ] disable-running-check=no name=ether4
set [ find default-name=ether10 ] comment=""
disable-running-check=no name=ether5
set [ find default-name=ether1 ] disable-running-check=no name=ether6
set [ find default-name=ether3 ] comment="" disable-running-check=
no name=ether7
set [ find default-name=ether4 ] comment="" disable-running-check=no
name=ether8
set [ find default-name=ether2 ] comment="" disable-running-check=
no name=ether9
set [ find default-name=ether5 ] comment=""
disable-running-check=no name=ether10
/interface vlan
add interface=bridge name=vlan10 vlan-id=10
/interface list
add name=WAN
add name=LAN
/ip pool
add name=dhcp ranges=192.168.77.10-192.168.77.70
add name=pool_vlan10 ranges=192.168.0.10-192.168.0.20
/ip dhcp-server
add address-pool=dhcp interface=bridge name=dhcp
add address-pool=pool_vlan10 interface=vlan10 name=dhcp_vlan10
/queue type
add cake-diffserv=besteffort cake-flowmode=dual-dsthost cake-nat=yes
cake-rtt=30ms cake-rtt-scheme=regional kind=cake name=cake-rx
add cake-ack-filter=filter cake-diffserv=besteffort cake-flowmode=
dual-srchost cake-nat=yes cake-rtt=30ms cake-rtt-scheme=regional kind=
cake name=cake-tx
/queue simple
add max-limit=1000M/1000M name=queue1 queue=cake-rx/cake-tx target=ether1
total-queue=default
/interface bridge port
add bridge=bridge interface=ether2
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
add bridge=bridge interface=ether6
add bridge=bridge interface=ether7
add bridge=bridge interface=ether8
add bridge=bridge interface=ether9
add bridge=bridge interface=ether10
/ip neighbor discovery-settings
set discover-interface-list=all lldp-mac-phy-config=yes lldp-max-frame-size=
yes lldp-vlan-info=yes
/interface bridge vlan
add bridge=bridge tagged=bridge,ether10 vlan-ids=10
/interface list member
add interface=ether1 list=WAN
add interface=bridge list=LAN
/ip address
add address=192.168.77.1/24 interface=bridge network=192.168.77.0
add address=192.168.0.1/24 interface=vlan10 network=192.168.0.0
/ip dhcp-client
add default-route-tables=main interface=ether1
/ip dhcp-server lease
...
/ip dhcp-server network
add address=192.168.0.0/24 dns-server=192.168.0.1 gateway=192.168.0.1
add address=192.168.77.0/24 dns-server=192.168.77.1 gateway=192.168.77.1
netmask=24
/ip dns
set allow-remote-requests=yes doh-max-server-connections=10 use-doh-server=
https://dns.nextdns.io/ verify-doh-cert=yes
/ip dns static
add address=45.xxx name=dns.nextdns.io type=A
add address=45.xxx name=dns.nextdns.io type=A
add address=2axxx:: name=dns.nextdns.io type=AAAA
add address=2axxx:: name=dns.nextdns.io type=AAAA
/ip firewall address-list
add address=192.168.77.10 list=Authorized
add address=192.168.77.11 list=Authorized
add address=192.168.77.12 list=Authorized
...
add address=192.168.0.10 list=Authorized
add address=192.168.0.11 list=Authorized
add address=192.168.0.12 list=Authorized
...
/ip firewall filter
add action=accept chain=input comment=
"Accept: established, related, untracked." connection-state=
established,related,untracked
add action=drop chain=input comment="Drop invalid." connection-state=invalid
add action=accept chain=input comment="Accept ICMP." protocol=icmp
add action=accept chain=input comment=Loopback. dst-address=127.0.0.1
add action=accept chain=input comment="Authorized hosts - VLAN10."
in-interface=vlan10 src-address-list=Authorized
add action=accept chain=input comment="Authorized hosts." in-interface-list=
LAN src-address-list=Authorized
add action=accept chain=input comment="DNS udp." dst-port=53
in-interface-list=LAN protocol=udp
add action=accept chain=input comment="DNS tcp." dst-port=53
in-interface-list=LAN protocol=tcp
add action=accept chain=input comment=
"Accept: Winbox from WAN - temporary for tests." disabled=yes dst-port=
8291 in-interface=ether1 protocol=tcp
add action=drop chain=input comment="Drop all else."
add action=fasttrack-connection chain=forward comment=Fasttrack.
connection-state=established,related
add action=accept chain=forward comment=
"Accept: established, related, untracked." connection-state=
established,related,untracked
add action=drop chain=forward comment="Drop invalid." connection-state=
invalid
add action=drop chain=forward comment="Block VLAN10 to LAN." dst-address=
192.168.77.0/24 src-address=192.168.0.0/24
add action=accept chain=forward comment="Allow VLAN10 to Internet."
in-interface=vlan10 out-interface-list=WAN
add action=accept chain=forward comment="Internet traffic."
in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="Port forwarding."
connection-nat-state=dstnat
add action=drop chain=forward comment="Drop all else."
/ip firewall nat
add action=masquerade chain=srcnat comment=HairpinNat. dst-address=
192.168.77.0/24 src-address=192.168.77.0/24
add action=masquerade chain=srcnat comment=Masquerade. out-interface-list=WAN
add action=dst-nat chain=dstnat comment="Forward to terminal." dst-address=
x.x.x.x dst-port=12000 protocol=tcp to-addresses=192.168.77.48
/ip route
add disabled=yes dst-address=0.0.0.0/0 gateway=192.168.77.1
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set winbox port=9999
/system clock
set time-zone-name=Europe/Paris
/system identity
set name=mikrotik1
/system package update
set channel=long-term
/system scheduler
add interval=5d name=ExportConfig on-event=ExportConfig policy=
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon
start-date=2026-06-22 start-time=06:00:00
/system script
add dont-require-permissions=no name=ExportConfig owner=admin policy=
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":
local databiezaca [/system clock get date]
\n:local dzien [ :pick $databbiezaca 4 6 ]
\n:local mies [ :pick $databbiezaca 0 3 ]
\n:local rok [ :pick $databbiezaca 7 11 ]
\n:local plik ""
\n#:set plik ("$[/system identity get name]"."_"."$rok"."$mies"
."$dzien")
\n:set plik ("$[/system identity get name]")
\n:log info "Eksportuje konfiguracje $plik"
\n/export file=$plik
\n/system backup save name=$plik
\n:delay 5
\n/tool e-mail send to="x@x.pl" subject=("Konfiguracja $pli
k ($[/system resource get architecture-name]/$[/system resource get vers
ion]) @ $[/system clock get date] $[/system clock get time]") file=("
$plik.rsc","$plik.backup")"
/tool e-mail
set certificate-verification=no from=x@x.com port=587 server=
x.com user=x@x.com
I found another possible fix.
The following rule is probably unnecessary, as the vlan10 interface isn't part of the LAN anyway, so traffic between networks (from 192.168.0.0 to 192.168.77.0) is blocked anyway.
add action=drop chain=forward comment="Block VLAN10 to LAN." dst-address=
192.168.77.0/24 src-address=192.168.0.0/24
Waiting for your feedback. Thanks.
I have no idea why you need a vlan for ether10?
Remove it and modify the following.
a. remove ether10 from bridge.
b. adjust the IP address and /ip dhcp-server:
add address=192.168.0.1/24 interface=ether10 network=192.168.0.0
add address-pool=pool_vlan10 interface=ether10 name=dhcp_vlan10
c. ADD ether10 as a list member of the LAN.
d. modify the associated two firewall rule (input chain) to simply one rule.
add chain=input action=accept comment="admin access" src-address-list=Authorized.
e. Correct Block rule is not required for ether10 to Bridge or Bridge to ether10, as its covered by a single drop all rule at the end of the forward chain.
f. Single rule needed for WAN access
add chain=forward action=accept comment="internet" in-interface-list=LAN out-interface-list=WAN
DONT include your winbox port settings or SSH port settings etc, on public config. Just a good habit.
g. Since you require admin access to the config from both subnets,
Ensure you include both subnets on the winbox settings,
Then add this...
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN
h. aDJUST
/ip neighbor discovery-settings
set discover-interface-list=LAN
I. did you set netmask, not required, remove if so, otherwise the router just puts that there.
add address=192.168.77.0/24 dns-server=192.168.77.1 gateway=192.168.77.1
netmask=24
Hello Anav,
I hope you are doing well.
At first I preferred the solution proposed by you (separating the interface), as it was easier for me - but I have read that vlan is the correct preferred approach to separate the second subnet (industry-standard / modern best practice).
Vlan topic was new to me and went in this direction probably more out of curiosity than a reasonable, simpler approach.
However now, after your with recommendations, I started having doubts and started looking into this topic again.
So, I've now found information that explains and confirms your approach: If there is an dedicated physical port to an isolated segment, then separating the this interface from the bridge makes sense instead of a VLAN.
Thanks for the tip, I'm aware not to display sensitive information.
The Winbox port in the rule here is outdated, so I didn't remove it when pasting it into the post. The actual port is different from the beginning.
Done.
Here's the problem. I don't know why this single drop all rule at the end of the forward chain doesn't work. When I'm connected to a separate network (ether10), I have access to the main network, which shouldn't be the case. Could you please help me in this situation?
Thank you again for your help and your time and I kindly ask you to take a look at my updated config.
2026-07-22 14:04:43 by RouterOS 7.21.5
software id = xxx
/interface bridge
add name=bridge vlan-filtering=yes
/interface ethernet
set [ find default-name=ether6 ] comment=WAN disable-running-check=no name=
ether1
set [ find default-name=ether7 ] comment=""
disable-running-check=no name=ether2
set [ find default-name=ether8 ] comment=""
disable-running-check=no name=ether3
set [ find default-name=ether9 ] disable-running-check=no name=ether4
set [ find default-name=ether10 ] comment=""
disable-running-check=no name=ether5
set [ find default-name=ether1 ] disable-running-check=no name=ether6
set [ find default-name=ether3 ] comment="" disable-running-check=
no name=ether7
set [ find default-name=ether4 ] comment="" disable-running-check=no
name=ether8
set [ find default-name=ether2 ] comment="" disable-running-check=
no name=ether9
set [ find default-name=ether5 ] comment=""
disable-running-check=no name=ether10
/interface list
add name=WAN
add name=LAN
/ip pool
add name=dhcp ranges=192.168.77.10-192.168.77.70
add name=dhcp2 ranges=192.168.0.10-192.168.0.20
/ip dhcp-server
add address-pool=dhcp interface=bridge name=dhcp
add address-pool=dhcp2 interface=ether10 name=dhcp2
/queue type
add cake-diffserv=besteffort cake-flowmode=dual-dsthost cake-nat=yes
cake-rtt=30ms cake-rtt-scheme=regional kind=cake name=cake-rx
add cake-ack-filter=filter cake-diffserv=besteffort cake-flowmode=
dual-srchost cake-nat=yes cake-rtt=30ms cake-rtt-scheme=regional kind=
cake name=cake-tx
/queue simple
add max-limit=1000M/1000M name=queue1 queue=cake-rx/cake-tx target=ether1
total-queue=default
/interface bridge port
add bridge=bridge interface=ether2
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
add bridge=bridge interface=ether6
add bridge=bridge interface=ether7
add bridge=bridge interface=ether8
add bridge=bridge interface=ether9
/ip neighbor discovery-settings
set discover-interface-list=LAN lldp-mac-phy-config=yes lldp-max-frame-size=
yes lldp-vlan-info=yes
/interface list member
add interface=ether1 list=WAN
add interface=bridge list=LAN
add interface=ether10 list=LAN
/ip address
add address=192.168.77.1/24 interface=bridge network=192.168.77.0
add address=192.168.0.1/24 interface=ether10 network=192.168.0.0
/ip dhcp-client
add default-route-tables=main interface=ether1
/ip dhcp-server lease
...
/ip dhcp-server network
add address=192.168.0.0/24 dns-server=192.168.0.1 gateway=192.168.0.1
add address=192.168.77.0/24 dns-server=192.168.77.1 gateway=192.168.77.1
/ip dns
set allow-remote-requests=yes doh-max-server-connections=10 use-doh-server=
https://dns.nextdns.io/ verify-doh-cert=yes
/ip dns static
add address=x name=dns.nextdns.io type=A
add address=x name=dns.nextdns.io type=A
add address=x name=dns.nextdns.io type=AAAA
add address=x name=dns.nextdns.io type=AAAA
/ip firewall address-list
add address=192.168.77.10 list=Authorized
add address=192.168.77.11 list=Authorized
add address=192.168.77.12 list=Authorized
...
add address=192.168.0.10 list=Authorized
add address=192.168.0.11 list=Authorized
add address=192.168.0.12 list=Authorized
...
/ip firewall filter
add action=accept chain=input comment=
"Accept: established, related, untracked." connection-state=
established,related,untracked
add action=drop chain=input comment="Drop invalid." connection-state=invalid
add action=accept chain=input comment="Accept ICMP." protocol=icmp
add action=accept chain=input comment=Loopback. dst-address=127.0.0.1
add action=accept chain=input comment="Authorized hosts." in-interface-list=
LAN src-address-list=Authorized
add action=accept chain=input comment="DNS udp." dst-port=53
in-interface-list=LAN protocol=udp
add action=accept chain=input comment="DNS tcp." dst-port=53
in-interface-list=LAN protocol=tcp
add action=accept chain=input comment=
"Accept: Winbox from WAN - temporary for tests." disabled=yes dst-port=
8291 in-interface=ether1 protocol=tcp
add action=drop chain=input comment="Drop all else."
add action=fasttrack-connection chain=forward comment=Fasttrack.
connection-state=established,related
add action=accept chain=forward comment=
"Accept: established, related, untracked." connection-state=
established,related,untracked
add action=drop chain=forward comment="Drop invalid." connection-state=
invalid
add action=accept chain=forward comment="Internet traffic."
in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="Port forwarding."
connection-nat-state=dstnat
add action=drop chain=forward comment="Drop all else."
/ip firewall nat
add action=masquerade chain=srcnat comment=HairpinNat. dst-address=
192.168.77.0/24 src-address=192.168.77.0/24
add action=masquerade chain=srcnat comment=Masquerade. out-interface-list=WAN
add action=dst-nat chain=dstnat comment="Forward to terminal." dst-address=
x.x.x.x.x dst-port=12000 protocol=tcp to-addresses=192.168.77.48
/ip route
add disabled=yes dst-address=0.0.0.0/0 gateway=192.168.77.1
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set winbox address=192.168.77.0/24,192.168.0.0/24 port=xxx
/system clock
set time-zone-name=Europe/Paris
/system identity
set name=mikrotik1
/system package update
set channel=long-term
/system scheduler
add interval=5d name=ExportConfig on-event=ExportConfig policy=
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon
start-date=2026-06-22 start-time=06:00:00
/system script
add dont-require-permissions=no name=ExportConfig owner=admin policy=
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":
local databiezaca [/system clock get date]
\n:local dzien [ :pick $databbiezaca 4 6 ]
\n:local mies [ :pick $databbiezaca 0 3 ]
\n:local rok [ :pick $databbiezaca 7 11 ]
\n:local plik ""
\n#:set plik ("$[/system identity get name]"."_"."$rok"."$mies"
."$dzien")
\n:set plik ("$[/system identity get name]")
\n:log info "Eksportuje konfiguracje $plik"
\n/export file=$plik
\n/system backup save name=$plik
\n:delay 5
\n/tool e-mail send to="x@com" subject=("Konfiguracja $pli
k ($[/system resource get architecture-name]/$[/system resource get vers
ion]) @ $[/system clock get date] $[/system clock get time]") file=("
$plik.rsc","$plik.backup")"
/tool e-mail
set certificate-verification=no from=x@com port=xxx server=
x.com user=x@.com
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Just curious.
What are these firewall rules for?
Well you have two choices, for a single subnet only being used on one ethernet port and the rest being connected to a bridge lan one can.
A. Create two vlans; OR
B. Create two separate subnets with one attached to the single interface and the other to the bridge.
What you did was neither, although possible its messy and confusing to assigne one vlan, then use it for one ether port, while the other subnet is associated with the LAN ( and presumably even this subnet is also assigned to the etherport the vlan is using............ like wrongly constructed hybrid port).
The only reason to go for A, in this topic, is that you are going to add more vlans down the road and getting started on it now only makes sense.
There should be no ability for devices on either of the two subnets to reach each other.
If you want authorized persons to be able to reach both subnets, then add a forward rule prior to the drop all rule at the end...
add chain=forward action=accept in-interface-list-list=LAN src-address-list=Authorized out-interface-list=LAN
As for why the input chain rules, they are normally required for users to be able to access the routers DNS services.
Thanks for the clarification.
I don't plan on implementing more VLANs, so I'll stick with solution B: "Create two separate subnets with one attached to the single interface and the other to the bridge." This is consistent with what I've read more.
You're right. These two subnets are isolated.
I had access from the secondary network to the main network, but only because the laptop I was using to test the configuration had access to the main network via a mesh VPN service. I figured it out after two days.
I have another question.
I have a managed switch connected to Ethernet 10, which is for the secondary (isolated) network 192.168.0.0/24. The switch's IP address is 192.168.0.10.
Why can't the switch management software find it automatically from the main network (192.168.77.0/24), of course after applying the rule below? However, when I enter the switch's IP address in a browser, the configuration panel immediately opens.
chain=forward action=accept src-address=192.168.77.0/24 dst-address=192.168.0.0/24 log=no log-prefix=""
Good question, perhaps different protocols>?
The browser is using http and the software is using????
However your rule is far to broad as almost no reason to have two separate networks with something that allows all of one to reach the other. Limit to a source address list of finite addresses on the 77 network to a finite list of devices to be reached.
add chain=forward action=accept in-interface=subnetA src-address-list=DevicesWithMgmtSoftware out-interface=SubnetB dst-address=Switch.