Can someone please give me a rundown on how the chains work and apply? I kinda understand how they flow in a real simple config (such as the 951-2n I set up that will probably end up at my grandparents), but the next thing I need to set up, if I’m going to continue down the MikroTik path, is my home network.
To give you an idea where my confusion comes in, my network is as follows: I have my WAN, obviously, I have a second WAN that I could potentially use as a backup connection, but it’s not required so we could ignore it. Then I have LAN, DMZ, Wireless, and ‘Sandbox’ VLANs that get internet access.
In the pfSense, each interface has its own tab, so I can set the rules up as needed for each tab. The wireless, for example, is allowed to go out to the internet, but has no access to any other network. The DMZ is where some internet facing servers reside, and there are a few ‘pinholes’ that allow some specific traffic to enter the LAN from the DMZ. The LAN is allowed full access to the DMZ and the internet, of course. The ‘Sandbox’ is similar to the DMZ, except it’s heavily restricted in that it’s only allowed out to the internet, and there are a few connections allowed in from the LAN, but most everything is blocked.
With RouterOS, there isn’t the same segregation with regards to the interfaces, so how do the rules apply when you have multiple VLANs that need different access? I understand that the chains are processed from the top. Placing a drop invalid packets at the top prevents those packets from being processed or acknowledged, then the allow rules as once a rule matches the traffic, it’s used and the processing stops, then finally a drop everything at the end so that anything that doesn’t match an allow rule is then dropped.
With the simple, inside/outside config U have in this 951, it’s not hard to understand. In this simple context, it’s really not that different from the pfSense in general layout. But how would this work with the multiple interfaces? In the pfSense, in essence, each interface has its own set of chains that apply to it, whereas in RouterOS, they seem to get all lumped together.
In Cisco Firewalls, the rules are also ‘lumped together’, but they are clearly applied to specific interfaces. For Example:
access-list acl-in extended permit tcp any host 1.2.3.4 eq https
That would allow https traffic in on IP 1.2.3.4.
You would also have to have a static entry for said IP:
static (inside,outside) 1.2.3.4 192.168.1.11 netmask 255.255.255.255
But you would then apply the access list to an interface:
access-group acl-in in interface outside.
So now, any ACL that uses ‘acl-in’ would apply to the ‘outside’ interface. You could then have a ‘DMZ-in’ ACL, and apply it to the DMZ interface and so on.
I also have a VPN to my mother’s house, a VPN to my datacenter server and a VPN to my companies office. Those may or may not be tough to grasp setting up on RouerOS.
Like I said, I’ve read through most of ‘RouterOS By Example’, Ive searched around, and so far, nothing has helped me understand this aspect of RouterOS. Should each and every chain entry be bound to a specific interface? Even if that’s the case, how to they fit in with each other with regards to processing? Does it not matter what is where (on the forward chain, for example) provided it’s in between the ‘invalid > drop’ and ‘drop everything’ entries?