(1) All your DST NAT rules are missing the in-interface-list=WAN part of the rule ( dynamic ) or dst-address (static WANIP).
(2) why this duplicate nat rule..?
/ip firewall nat add action=dst-nat chain=dstnat dst-port=6669 protocol=tcp to-addresses=192.168.0.24
/ip firewall nat add action=dst-nat chain=dstnat dst-port=6669 protocol=udp to-addresses=192.168.0.24 to-ports=6669
(3) What is the purpose of this dst nat rule… functionally speaking what does it do? → dont need to know exactly what its used for…
/ip firewall nat add action=src-nat chain=srcnat protocol=tcp src-address=192.168.0.24 src-port=25 to-addresses=<external_ip> to-ports=25
(4) Dont understand your IP routes.
For simple primary failover should be like… (single recursive to make sure connectivity past the ISP is achieved (good practice).
Nothing more complicated…
The only additional route is for the mangled connection!
/ip route
add check-gateway=ping distance=3 dst-address=0.0.0.0/0 gateway=1.0.0.1 scope=10 target-scope=12
add distance=3 dst-address=1.0.0.1/32 gateway=PrimaryISP-gatewayIP scope=11 target-scope=11
add comment=SecondaryISP distance=10 dst-address=0.0.0.0/0 gateway=SecondaryISP-gatewayIP scope=10 target-scope=30
+++++++++++++++++++++++++++++
add dst-address=0.0.0.0/0 gateway=SecondaryISP-gatewayIP routing-table=useSecondary
Assuming:
/ip table
add fib name=useSecondary
/ip mangle
add chain=prerouting action= mark-connection connection-mark=no-mark
in-interface-list=LAN src-address=192.168.0.24 dst-port=443
new-connection-mark=https-conn passthrough=yes
add chain=prerouting action=mark-route connection-mark=https-conn
new-routing-mark=useSecondary passthrough=yes
Note: The connection marks is not strictly needed as one could go straight to the routing mark,
but I use the no-mark for other reasons (aka fastrack rule see below)
Where I may miss the mark is that your server does HTTPS port 443 to other local users ??? If so, then we need to adjust it further refined so we dont capture that traffic by accident…
by adding dst-address-type=!local to the first rule…
(5) Firewall filter rules and address lists… - simplify StART WITH THIS and add more later if there are issues,…
/ip firewall address-list { set static dhcp leases }
add address=AdminIP-1 list=TRUSTED comment=“admin desktop”
add address=AdminIP-2 list=TRUSTED comment=“admin laptop”
add address=AdminIP-3 list=TRUSTED comment=“admin smartphone”
/ip firewall filter
{Input Chain}
add action=accept chain=input comment=“defconf: accept established,related,untracked” connection-state=established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
add action=accept chain=input comment=“admin via SSH - crappy choice use Wireguard instead” dst-port=22 protocol=tcp
add action=accept chain=input in-interface-list=lan_and_wlan src-address-list=TRUSTED
add action=accept chain=input comment=“Allow LAN DNS queries-UDP & NTP”
dst-port=53,123 in-interface-list=lan_and_wlan protocol=udp
add action=accept chain=input comment=“Allow LAN DNS queries - TCP”
dst-port=53 in-interface-list=lan_and_wlan protocol=tcp
add action=drop chain=input comment=“drop all else”
{forward chain}
add action=accept chain=forward comment=“defconf: accept in ipsec policy” ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy” ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related connection-mark=no-mark
add action=accept chain=forward comment=“defconf: accept established,related, untracked” connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=forward comment=“allow internet traffic” in-interface-list=lan_and_wlan out-interface-list=WAN
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat
add action=drop chain=forward comment=“drop all else”
Note: Any traffic required not covered that is required above, add where the ********* are located.
Examples could be all users (both wlan and bridge) to shared printer or Admin IP or TRUSTED list to all subnets etc…
Final comment, if you didnt notice it in the config, suggest you use wireguard to access router remotely vice SSH and thus no worries about port 22 abuse.
Even still as a backup its not so bad but why on earth are you using the common default port. Do it on 2222 for example ???
I lied, final final comment, you should insist all your users coming into the servers provide you with either their:
a. fixed static WANIP OR if they dont have that
b. their dynamic IP via a DYNDNS service, there are many that are free so their is no excuse not to have one. You put these into a firewall address list and the mT router will resolve them.
This provides a better level of server security and also makes all the ports invisible on scans vice the normal visible but closed on scans.
