(1) Firewall rules need work some missing (the most important one is in blue!!) , order not right, duplicates…
(2) INPUT CHAIN
/ip firewall filter
add action=accept chain=input comment=“accept established, related” connection-state=established,related (order)
add action=drop chain=input comment=“Drop all invalid packets from WAN” connection-state=invalid
add action=accept chain=input comment=“Allow Mgmt_VLAN Full Access” in-interface=Mgmt_VLAN (order)
add action=accept chain=input comment=“Allow VLAN” in-interface-list=VLAN (add what specific services needed or remove only admin should have full access)
(for example DNS usually applies, protocol tcp/udp dest port=53
add action=drop chain=input disabled=yes (enable this rule its better security and will eliminate all unauthorized wan to router and lan to router traffic for example)
FORWARD CHAIN
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” \ (missing need to add)
connection-state=established,related
add action=accept chain=forward comment=“Allow Estab & Related” connection-state=established,related
add action=drop chain=forward comment=“Drop all invalid packets from LAN” connection-state=invalid (order)
add action=accept chain=forward comment=“VLAN Internet Access Only” connection-state=new in-interface-list=VLAN out-interface-list=WAN
add action=accept chain=forward comment=“Allow Port Forwarding” connection-nat-state=dstnat
connection-state=new in-interface-list=WAN
add action=drop chain=forward disabled=yes (enable which blocks all VLAN to VLAN traffic not specifically allowed above at layer 3, and any unwanted traffic wan to lan etc).
(5) Duplicates in forward chain removed.
add action=accept chain=forward connection-state=related (duplicate remove)
add action=accept chain=forward connection-state=established (duplicate remove)
(6) Forward chain rules that seem to serve no purpose and are way to wide open. You have already allowed vlan to wan traffic. What else do they need for example??
add action=accept chain=forward connection-state=new src-address-list=Mgmt_VLAN
add action=accept chain=forward connection-state=new src-address-list=Business_VLAN
add action=accept chain=forward connection-state=new src-address-list=Home_VLAN
add action=accept chain=forward connection-state=new src-address-list=Guest_VLAN
add action=accept chain=forward connection-state=new disabled=yes src-address-list=“”
add action=accept chain=forward connection-state=new src-address-list=Mgmt_VLAN
add action=accept chain=forward connection-state=new src-address-list=Business_VLAN
add action=accept chain=forward connection-state=new src-address-list=Home_VLAN
add action=accept chain=forward connection-state=new src-address-list=Guest_VLAN
(7) Destination NAT rules. Better to use in-interface-list=WAN vice interface=eth1.
You can simplify the rules if you desire, otherwise nothing seems wrong. I would be concerned about opening so many ports, and assume you have encrypted logins not plaintext passwords.
/ip firewall nat
add action=masquerade chain=srcnat comment=“Default masquerade” out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=80,443,6602,65500,65510-65515,65520,65532 in-interface-list=WAN log=yes protocol=tcp to-addresses=192.168.1.200
(8) Assume you let friends and family access your server, suggesting that you
a. create a list of allowable domain names for those folks.
b. get those folks to get free domain names available on the net, its really a simple ask.
c. create firewall address list.
/ip firewall address-list
add address=freedomain.net comment=george list=allowedusers
add address=myfreeorg.com comment=parents list=allowedusers
add address=nocosthome.org comment=sister list=allowedusers
Note: The router will resolve domain names to IP addresses automatically!!
Destination nat rule becomes.
add action=dst-nat chain=dstnat dst-port=80,443,6602,65500,65510-65515,65520,65532 in-interface-list=WAN log=yes protocol=tcp to-addresses=192.168.1.200
source-address-list=allowedusers
