I’ve been trying to get the configuration to work, but after a week, I’m really fed up… I was searching for similar topics, trying to glue the configuration but without a luck.
I also followed this article http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
and no luck.
Could you help me to get the router to work, please?
# VLAN Overview
###############
# VLAN_10: Backend devices - 10.0.10.0/24
# - Linux device - Controller for UniFi
# - UniFi AP device
# Services:
# - Pi-hole as DNS forwarder - for all VLANs
#
# VLAN_20: Media Services (TV modem) - 10.0.20.0/24
# - Access to the Internet
# - Blocked access to other VLANs
#
# VLAN_30: Wi-Fi Home users - 10.0.30.0/24
# - Access to the Internet
# - Access to IoT VLAN to the printer (AirPrint)
# - Access to VLAN_10 ports (22,53,80,443)
# - Access to VLAN_50 ports (22,80,443,3389)
#
# VLAN_40: Wi-Fi Guest - 10.0.40.0/24
# - Access only to the Internet (80,443)
# - Access to VLAN_10 DNS server (53)
#
# VLAN_50: IoT (printer as well?) - 10.0.50.0/24
# - Access to the Internet
# - DNS for devices 1.1.1.1
# - Printer IP: 10.0.50.2
#
# VLAN_60: DMZ - 10.0.60.0/24
# - Access to the Internet
# - Access to VLAN_10 DNS server (53)
# - Access from the Internet: exposed ports to the Internet (8888) from IP 10.0.60.2
#
# VLAN_100: Management port ether8 - 10.0.100.0/24
# - Outgoing: Access to all VLANs and Internet
# - Incoming: Blocked from other VLANs
# Port overview
# ether1 - WAN (dhcp client)
# ether2 - Backend devices (VLAN_10 Access)
# ether3 - Unifi AP device (VLAN_10 Access, VLAN_30 SSID:HOME, VLAN_40 SSID:GUEST, VLAN_50 SSID:IoT)
# ether4 - Linux device (VLAN_20 Access)
# ether5 - Linux Device (VLAN_60 Access)
# ether6 - Management port (VLAN_100)
# VPN: OpenVPN Server
# - Access to the Internet
# - Access to VLAN_10 to ports (53, 443, 22)
# - Access to VLAN_30 to IP 10.0.30.2 (3389)
# - Access to VLAN_50 to printer 10.0.50.2 (AirPrint)
# - Access to VLAN_60 to ports 22,3389
what i dont get on your diagram is why is vlan10 which seems to be home users, not used for home wifi?
Why change to vlan30 for home users. What is the purpose of vlan20… IOT devices, media devices?
Or is vlan10 the stated vlan for your ISP connection on ether1 ???
Its making more sense now thanks!
Except for the DMZ, what do you mean by that specifically what will you be using it for… will it need internet access for example??
Here is a sample setup…
I didnt have the IP address of the pihole server…
Also its easier to allow a lan subnet or users to access a particular IP or set of IP addresses in another LAN, doing it by ports alone is unknown to me.
I’ve applied the following config and PC cannot obtain IP from DHCP on ports: ether2 and ether3 - getting IP 169.254.x.x. On the ether4 and ether5 DHCP works fine.
What could be wrong?
Also its easier to allow a lan subnet or users to access a particular IP or set of IP addresses in another LAN, doing it by ports alone is unknown to me.
Yes, you were right @anav& @Buckeye.
Everything works as expected now - a HUGE THANK YOU@anav for your support!
I’m trying to understand the config and firewall rules, and of course there are multiple questions, but I have to dive into the documentation first, and so far, I would like to ask for the following:
This rule allows ICMP to WAN from the Internet, I changed action to drop, and there is no option to PING WAN port from the Internet, but this blocked ping to the VLAN Gateways. What to do Sir?
There is a rule to allow ICMP;
Code: Select all
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
This rule allows ICMP to WAN from the Internet, I changed action to drop, and there is no option to PING WAN port from the Internet, but this blocked ping to the VLAN Gateways. What to do Sir?
The solution is to be more “specific”. After all, also your “vlan gateways” will be “hit” with this rule since they are part of the router and the default rules does not specify interfaces etc.
So DUPLICATE this rule, and on the top one edit the rule and add the incoming WAN/Internet interface! (so be more specific that you want to drop ICMP coming in from Internet
Then edit the rule below, change it to “allow” again (you changed it to “drop”, change that) and you should be able to ping all your VLAN-gateways from internally your LAN.
The other rules with the DNAT is to prevent the DNAT-action to be executed specifically on the packets coming from your PIHOLE itself. (which sits on the “LAN”).
Your PIHOLE should be the only device that can remotely do “dns” from the Internet without being intercepted/dnat’ted to itself
Any other device on the network (= src-address-list=!exclude-pihole) doing DNS (either UDP or TCP) on 53 will be “intercepted” / NAT’ted and delivered to your Pihole on 10.0.10.2
I do not recommend to block ICMP its valid to allow and it performs useful functions and should be left at is.
Any other advice is questionable and what is the source of that advice??
As to the the second question you will note that to use pi-hole there is a two part strategy,
one is to assign pi hole as the dns-server in the dhcp-server network settings and the second are the 2 rules to ensure that people cannot bypass what you have set in the dns-server!!
As you can see below, all the subnets are assigned to the pihole EXCEPT the IOT subnet which you wanted to use 1.1.1.1.
Furthermore the dns server for the subnet which the pi-hole is in is set to the gateway as we dont want to corral the pi-hole and send it to itself.
So the users of IOT based on this will go to 1.1.1.1 and the users on 10.0.10.0/24 will use the routers IP DNS services 8.8.8.8,1.1.1.1
So in step 2, we have to ensure that
a. users cannot bypass the entries above and
b. we have to then force the OTHER USERS in 10.0.10.0/24 ( but not the pi-hole) to also use the pi-hole.
Hence the identification of the targetted IPs, to exclude from these destination rules ( the pi-hole and the 10.0.50.0 subnet )
Then by the below rules any user from the LAN that needs DNS services ( like browsing ) will be “forced” to the pi-hole address.
/ip firewall nat
add chain=dstnat in-interface-list=LAN src-address-list=!exclude-pihole protocol=udp dst-port=53 action=dst-nat to-addresses=10.0.10.2
add chain=dstnat in-interface-list=LAN src-address-list=!exclude-pihole protocol=tcp dst-port=53 action=dst-nat to-addresses=10.0.10.2.
However we also in the same rule besides saying all users from the LAN, we add the other statement or condition for the rule to be true and the action to be carried out AS.
everybody NOT on the source address list.
ALL USERS ON LAN AND ALL USERS NOT ON SOURCE ADDRESS LIST ----------> if true then carry out the action.
So the two conditions are almost the same, the first one says all users on the LAN, and the second in effect ANY user except those identified on list).
(the ! symbol is not to be used lightly however as in the wrong hands it can create a mess of unintended consequences )
I started this post, then didn’t finish it until @anav had several new post, so he already found this
Now that you mention it, I just did a comparison of the two configs with winmerge, and there are some other differences as well, and this is also missing from matumatu’s config, and it also looks significant to the problem:
It’s easy to stop looking once you find a problem that could cause the problem, even if there are more things that could also cause the same problem.
It appears that there are other difference things removed (wireguard and firewall), but it does look like he fixed an unfinished edit you made in the /ip pool section where some of the 192.168 substrings didn’t get changed to 10.0. and a few syntax fixes (changed admit- to admit-only-)
But I am quite impressed by @anav’s ability to create complete configs without being able to test them, so I am not meaning to throw stones; I didn’t notice them until WinMerge showed the differences. The config @anav posted in post #10 got @matumatu going in the correct direction.
Does it really enhance security? Probably not as long as you don’t have other problems in your config. The intent is to reduce the knocking on the door. It doesn’t prevent the scanning for open ports, but it probably does reduce the quantity. Similar to not putting your phone number on checks, which used to be recommended, but isn’t any longer. Or publishing your email address on forums. Some people also recommend using “hidden” SSIDs for the same reason. These measures make it marginally less convenient for war drivers.
What is ironic is that some users block icmp echo-requests, but then expose their router’s webfig to the internet, which is a much bigger risk.
I cannot control the ability to copy and paste LOL.
But I do understand the difficulty for a new person having made the mistake to find it easily.
That is why I prefer clean and organized configs that one can then more easily spot errors.
What you stated though is a useful exercise for anyone, to compare configs.
I do this using notepadd++ which has that capability.
In can be found in PLUGINS and the function of COMPARE!
++++++++++++++++++++++++++++++++++++++++++++++++ But I am quite impressed by @anav’s ability to create complete configs without being able to test them,
I have an internal CHR
