Please help with weird configuration

RouterOS General
1

Will this configuration work, please advice? I know this not how we should configure routers, I’m planing to make configuration proper, but I just can’t do it for now. There are to many objective reasons.
At one of my customers I’ll replace Cisco with Mikrotik and Cisco is configured this way - export of Mikrotik conf is bellow. I hate to do it this way but I have no other option for now. As I said: in future I’ll correct configuration.

Weirdness is in that I have uplink and LAN on same interface - ether1. Ethernet1 is connected to WAN switch and WAN switch is connected to LAN switch. On eth1 there is also local subnet and dhcp server and some vlans and respective ip configuration. I’m a bit worried how will work srcnat and dstnat. And I have also have to make two ipsec tunnels on this router. Will standard ipsec configuration work on this mess?

/interface ethernet
set [ find default-name=ether1 ] comment=Uplink

/interface vlan
add  interface=ether1 name=vlan56 vlan-id=56
add  interface=ether1 name=vlan57 vlan-id=57
add  interface=ether1 name=vlan100 vlan-id=100

/ip pool
add name=dhcp_pool0 ranges=192.168.53.100-192.168.53.254
add name=dhcp_pool1 ranges=192.168.56.100-192.168.56.254
add name=dhcp_pool2 ranges=10.3.37.100-10.3.37.249,10.3.37.251-10.3.37.254

/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=ether1 name=dhcp1
add address-pool=dhcp_pool1 disabled=no interface=vlan56 name=dhcp2
add address-pool=dhcp_pool2 disabled=no interface=vlan57 name=dhcp3

/ip firewall connection tracking
set enabled=yes

/ip address
add address=WANpublicIP-X interface=ether1 network=X.X.X.X
add address=192.168.53.1/24 interface=ether1 network=192.168.53.0
add address=192.168.56.1/24 interface=vlan56 network=192.168.56.0
add address=192.168.100.1/24 interface=vlan100 network=192.168.100.0
add address=10.3.37.250/24 interface=vlan57 network=10.3.37.0

/ip dhcp-server network
add address=10.3.37.0/24 dns-server=z.z.z.z gateway=10.3.37.250
add address=192.168.53.0/24 dns-server=z.z.z.z gateway=192.168.53.1
add address=192.168.56.0/24 dns-server=z.z.z.z gateway=192.168.56.1

/ip firewall address-list
add address=192.168.53.0/24 list=LocalSubnets
add address=10.3.37.0/24 list=LocalSubnets
add address=192.168.56.0/24 list=LocalSubnets

/ip firewall filter
add action=accept chain=forward connection-state=established
add action=accept chain=forward connection-state=related
add action=accept chain=input connection-state=established
add action=accept chain=input connection-state=related
add action=add-src-to-address-list address-list=knockers address-list-timeout=30s chain=input dst-address=WANpublicIP-X dst-port=zzzz in-interface=ether1 protocol=tcp
add action=accept chain=input dst-port=8291 in-interface=ether1 protocol=tcp src-address-list=knockers
add action=drop chain=input dst-address=WANpublicIP-X dst-port=8291 in-interface=ether1 protocol=tcp

/ip firewall nat
add action=src-nat chain=srcnat dst-address-list=!LocalSubnets src-address=192.168.53.0/24 to-addresses=WANpublicIP-X
add action=src-nat chain=srcnat dst-address-list=!LocalSubnets src-address=192.168.56.0/24 to-addresses=WANpublicIP-X
add action=src-nat chain=srcnat dst-address-list=!LocalSubnets src-address=192.168.100.0/24 to-addresses=WANpublicIP-X
add action=src-nat chain=srcnat dst-address-list=!LocalSubnets src-address=10.3.37.0/24 to-addresses=WANpublicIP-X
add action=dst-nat chain=dstnat dst-address=WANpublicIP-X dst-port=zz protocol=tcp to-addresses=192.168.53.44 to-ports=zz

/ip route
add distance=1 gateway=PublicIP-Y
2
  • the NAT rules seem fine to me, they properly match on src-address and dst-address rather than out-interface. The dst-nat rule doesn’t check from where the request comes, but it does not seem harmful in the context (or maybe vice versa, more is missing if you want to access the service running at 192.168.53.44:zz from your other LAN subnets).
  • 192.168.100.0/24 is missing on the LocalSubnets list - is that an intention or an omission?
  • the filter rules in chain forward are totally useless, as packets not matching them are accepted anyway: in RouterOS, the default handling in firewall chains is accept, so what doesn’t match to any rule in the chain gets accepted. NAT alone is not a 100% protection against attacks from outside.
  • the filter rules in chain forward only protect access to Winbox, whereas all other services (ssh, telnet, http, dns, …) remain open for access from anywhere, for the same reason as above. Unless you have disabled all other services at /ip service level, some filth from the network may squat in within minutes after connecting the box to the internet.
  • there is no reason why IPsec should not work, it doesn’t care about subnet to VLAN mapping at all. Just for the case, set local-address on the /ip ipsec peer row(s) to WANpublicIP-X. But I recommend not to connect the box to the internet, let alone create any VPN configuration, before putting the firewall in shape.
3

Thanks for the missing subnet on the address list, I overlooked it.
About those accept rules in filter: I’m ‘‘old school’’, when cpu cycles were expensive :slight_smile: and learned back then, that first two rules should always be those two, so firewall is working only with new connections…
About protection: yes I’ll make some aditional rules, I posted partial config, only to discuss this peculiar config where LAN and WAN are on same interface…

Why do you think service at 192.168.53.44:zz won’t be accessible from local subnets? DSTnat rule shoul ‘‘catch’’ only packets from internet - dst-address=PublicWANip

4

I think you need hairpin nat for the dst-nat rule

5

I think you need hairpin nat for the dst-nat rule
Yes you’re both correct…

6

The CPU is still expensive, no doubt about that. So use a single rule action=accept connection-state=established,related rather than one rule per connection-state - this possibility has been added several years ago.

I didn’t suspect it was just a subset of firewall rules given that you’ve shown those Winbox ones :slight_smile: