(1) Add this…
/interface list member
add comment=defconf interface=ether1_WAN list=WAN
add interface=PPPoE_Out list=WAN
add interface=vlan100_intern list=LAN
add interface=vlan200_guests list=LAN
add interface=bridge list=LAN
(2) Change this from
add action=accept chain=input comment=“allow ICMP” in-interface=ether1_WAN
protocol=icmp
TO
add action=accept chain=input comment=“allow ICMP” protocol=icmp
If for some strange reason you want to block LAN to Router Ping, no reason to really it would be
add action=accept chain=input comment=“allow ICMP” protocol=icmp in-interface-list=WAN
(3) Modfy this to look like
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
(4) Modify this to look like
add action=drop chain=forward comment=
“drop access to clients behind NAT form WAN” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
(5) Set this to none. In the clear mac not really going to be used and not secure.
/tool mac-server
set allowed-interface-list=none
(6) Not an error but something I would change is your drop all rule, why are you not dropping all Traffic including LAN to router, and not just WAN to router.
There is no need for LAN users to have full access to the router.
It should be drop all period.
But to do this USE CAUTION. You must make an allow rule for admin access FIRST!! otherwise you will lock yourself out of the router.
You must also allow DNS traffic for udp/tcp for LAN users, in-interface-list=LAN.
(7) Suggestion:. To provide you with access to the router via ether10 in case the bridge every burps on you. Just plug in a laptop, give your laptop an IP of 192.168.45.3 or .5 etc… and you will be able to access the router for configuration from winbox on the laptop. After setting it up be sure to test it.
a. Change name of ether10 TO ether10-emerg
b. Remove ether10 from the bridge
c. give ether10-emerg an IP address, lets say 192.168.45.2
d. add ether10-emerg to the LAN Interface as a member
e. add ether10-emerg to an allow to router list (if changing input chain rules to only the admin with full access)
(8) What is interesting and not related to issues is that you have NTP servers identified on your DHCP Network settings.
I do not believe they are necessary or accurate.
If you have the NTP package on the router, then under System/ NTP Client you add the servers your router will use for source (as a client).
Under NTP Server all you need to do is select the check boxes of “ENABLED” and “MANYCAST”
THen in firewall rules you have to ensure that LAN users have access to the NTP Server that the router is running, which should look like this…if you have changed from default and have a drop all else rule as the last rule in the input chain:
add action=accept chain=input comment=“Allow NTP service” connection-state=new dst-port=123 in-interface-list=LAN
protocol=udp src-address-list=NTPserver
The source adddress list I use to narrow down access and identify only those devices that require NTP (AP or switch or Server etc…)
Thats it, there is no requirement to add NTP servers to DHCP networks from my experience.
. Sorry, I thought I would include this just now, but it dragged on a bit. Now everything should be fixed and ping is also working fine.
. Attached is a photo of the cable pile (I’ll make it clean in short).