RB4011 Edge WAN - ASUS Router setup - NAT Port forwarding

RouterOS Beginner Basics
1

Hi,

I have setup an RB4011 as my edge router. WAN - RB4011 (10.10.1.1)- Asus RT88 (192.168.1.1).
Currently Asus runs DNS, DHCP, firewall.

  1. How would I setup the firewall to secure the RB4011? This is what I have now:
/ip firewall filter
#forward
add chain=forward action=fasttrack-connection connection-state=established,related comment="FastTrack all forwarded established/related connections. Reduces CPU usage significantly."
add chain=forward action=drop connection-state=invalid comment="Drop invalid forwarded connections."
#input
add chain=input action=accept in-interface-list=MGMT comment="!!!LOCAL ACCESS DO NOT DELETE OR DISABLE!!! Allow traffic to router itself from MGMT port."
add chain=input action=accept in-interface-list=DMZ comment="!!!LOCAL ACCESS DO NOT DELETE OR DISABLE!!! Allow traffic to router itself from DMZ port."
add chain=input action=drop comment="Drop remaining traffic to router itself."
#output
  1. NAT port forwarding
    I have setup a rule to forward all traffic to the ASUS but it seems that ports are not forwarded.
    How do I get it to work that ports are forwarded from the RB4011 to the client IP? I would need incoming port 48200 TCP to through the Aus to 192.168.1.35
    On the Asus I have a few port forwarding rules setup to forward from 10.10.1.1 to 192.168.1.x
    On the RB4011 I have this:
/ip firewall nat
add chain=srcnat action=masquerade out-interface-list=ONT comment="Send all traffic: DMZ -> ONT"
add chain=dstnat action=dst-nat in-interface-list=ONT to-addresses=10.1.10.2 comment="Send all traffic: ONT -> DMZ"

I’m new to mikrotik so if anyone could be bothered to help me figure this out, I would much appreciate it.

cheers
Gnommon

2

Hi there,
So you are looking for some basic firewall rules on the RB4011 and how to ensure traffic is port forwarded from the internet to servers on the ASUS.
Confirm the RB4011 is not used then other than a edge device between the ISP modem and the main router the ASUS?
Personally I would chuck the ASUS into the garbage unless you need it as an Access Point (for its wifi).

3

Happy to do that if I just knew how. So for the time being I was hoping to just use the RB4001 as an edge switch.