Port forwarding to VLAN

RouterOS General
1

Normally when I do a port forward on a simple single network setup I don’t need to add anything else to make it work but recently I’ve had to setup a solution for a multi tenanted building using a CCR with each tenant in their own VLAN and each VLAN is isolated from one another with the exception of a management VLAN that has full access. I went down the approach of (other rules have been missed out):-

/ip firewall filter
add action=accept chain=forward comment="Allow Management to any Subnet" \
    src-address=192.168.88.0/24
add action=drop chain=forward comment="Drop VLAN to VLAN"

This is fine and all works the way I want. But when I then want to port forward to one of the VLAN’s which are NAT’d I have to add the NAT rule and a firewall rule for it to work.

/ip firewall filter
add action=accept chain=forward comment="Phone System tcp/8081" dst-address=\
    192.168.200.2 dst-port=8081 in-interface-list=WANs protocol=tcp 

/ip firewall nat
add action=netmap chain=dstnat comment="Phone System tcp/8081" dst-port=8081 \
    in-interface-list=WANs log=yes log-prefix=Voice protocol=tcp to-addresses=\
    192.168.200.2 to-ports=8081

Now I understand why I need the filter rule due to my ‘Drop VLAN to VLAN’ rule above but is there a more efficient yet still equally secure way so that port forwards to be allowed without having to add a separate filter rule for each port forward?

Would the following be safe:-

/ip firewall filter
add action=accept chain=forward comment="Allow Port forwards to VLAN 200" dst-address=\
    192.168.200.0/24 in-interface-list=WANs

and repeat this for each VLAN that needs port forwards or will this add a gaping security hole? If it wasn’t NAT’d I would never do this but does the NAT add the protection to only allow the specified ports to the specified IP’s?

If this is not right, how best can I set this up so all I have to do is just add the NAT rule or do I just have to put up with the way it is now?

2

You can have one rule for all forwarded ports:

/ip firewall filter
add action=accept chain=forward connection-nat-state=dstnat
3

Perfect, i’ll give that a test.

4

Seems to work perfectly, thanks

5

Thank you, this was very useful.

Here’s what I had to get port forwarding w/ VLANs to work and w/ multiple ISPs

/ip firewall nat
add chain=dstnat  action=dst-nat protocol=tcp in-interface-list=WAN dst-port=443 to-addresses=192.168.120.2 comment="port forward https to server"

/ip firewall filter
add chain=forward action=accept               connection-nat-state=dstnat comment="For port forwarding to VLANs"
add chain=forward action=drop                 connection-nat-state=!dstnat connection-state=new in-interface-list=WAN