Please check my firewall & network config..

RouterOS Beginner Basics
1

Hello everyone,
I got myself a mikrotik router and started a second adventure. I failed the first time. The second time, the tvbox almost made me give up on this adventure. dhcp client saved me. Why did I have to manually add the second wan ip (iptv) in the pppoe client connection? This really bothered me.

You can see my home network in the figure. I am a beginner for mikrotik router. I copied the firewall configuration from the internet. My request: If there is anything missing, redundant or incorrect in the configurations, can you correct it?

thanks..

out2.jpg
aragone.rsc (5.42 KB)
aragone-fw.rsc (2.22 KB)

2

In terms of the first one, that is one approach, and the changes I see are about pppoe connection:

/ip dhcp-client { NOT REQUIRED, you create the ISP termination via pppoe not dhcp client - disable this!! )
add interface=“bridge E1-E2”

/ip dhcp-server network
add address=10.XX.XX4.0/20 gateway=10.XX.XXX.40 ( If this is your pppoe conection ensure you remove, not required )
add address=192.168.88.0/24 gateway=192.168.88.1

What is not clear to me is the purpose of vlan35 and vlan55.
Assuming vlan35 is internet and vlan55 is TV, they should be associated with interface bridge E1-E2 I would think.
/interface vlan
add interface=bridgeE1-E2 name=vlan1 vlan-id=55
add interface=bridgeE1-E2 name=vlan35 vlan-id=35

If vlan35 is your internet then:
/interface pppoe-client
add add-default-route=yes disabled=no interface=vlan35 name=
pppoe-out-1 use-peer-dns=yes user=XXXXXXXXXXXXXXXXXXXXXXXXX@ttnet

Missing vlan-filtering=yes on the bridge after you complete BOTH /interface bridge ports and /interface bridge vlans.

/interface bridge vlans
add bridge=bridgeE1-E2 tagged=bridgeE1-E2,ether1 vlan-ids=35 { internet comes in on ether1, and is terminated on pppoe }
add bridge=bridgeE1-E2 tagged=bridgeE1-E2,ether1,ether2 vlan-ids=55 { tv comes in on ether1, and out to ether2 }

3

FW
/interface list
add name=WAN
add name=LAN
/interface-list members
add interface=pppoe-out-1 list=WAN
add interface=bridgeE3-E4 list=LAN

/ip firewall address-list { using static dhcp leases }
add address=192.168.88.X list=Authorized comment=“admin PC”
add address=192.168.88.Y list=Authorized comment=“admin laptop”
add address=192.168.88.Z list=Authorized comment=“admin smartphone/ipad”
/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input comment=" defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=“admin access” src-address=Authorized
add action=accept chain=input comment=“users to services” in-interface-list=LAN dst-port=53 protocol=udp
add action=accept chain=input comment=“users to services” in-interface-list=LAN dst-port=53 protocol=tcp
add action=drop chain=input comment=“drop all else”
+++++++++++++++++
add action=fasttrack-connection chain=forward connection-state=established,related disabled=yes { disabled due to queues }
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat { disable or remove if not required }
add action=drop chain=forward comment=“drop all else”