Routerboard remote access

RouterOS Beginner Basics
1

I have RB951Ui-2HnD
I have ADSL modem/router working in bridge mode connected to the phone line, i have two public static IPs.

From the moment i bought the routerboard i was able to access it over the internet without any modifications (it just worked the way i wanted).

I have upgraded the routeros to version 6.32.4.

Today i was trying to access it remotely as normal, but a i couldn’t.

Then i have discovered the following firewall rule (last rule in the list)
1.png
2.png
When i disable that rule i can normally access the routerboard over the internet.


Now i have two question.

First one:
How Securely Allow remote access without completely disabling that rule (which i think is a bad idea, since it is a default one).

Second One:
On which version does mikrotik added that rule? and if it an old one, why it doesn’t affect my ability to access the router remotely and now it does?

2

post all firewall rules:

/ip firewall filter print

3

Please note that i have disabled the last rule.


Flags: X - disabled, I - invalid, D - dynamic
0 D ;;; special dummy rule to show fasttrack counters
chain=forward

1 ;;; default configuration
chain=forward action=fasttrack-connection
connection-state=established,related log=no log-prefix=“”

2 ;;; default configuration
chain=forward action=accept connection-state=established,related log
log-prefix=“”

3 ;;; default configuration
chain=forward action=drop connection-state=invalid log=no log-prefix

4 ;;; default configuration
chain=forward action=drop connection-state=new
connection-nat-state=!dstnat in-interface=ether1-gateway log=no
log-prefix=“”

5 chain=input action=accept protocol=icmp log=no log-prefix=“”

6 chain=input action=accept connection-state=established log=no log-pr

7 chain=input action=accept connection-state=related log=no log-prefix

8 X chain=input action=drop in-interface=pppoe-out1 log=no log-prefix=“”

4

This rule is there for all RouterBOARD devices since many years. This is to protect your router from public internet.

If you want to allow yourself the access to SSH from PPPoE, you must add a new rule, not change this one.

Add one rule above the last one, with parameters “chain=input, action=allow, src-address=xx.xx.xx.xx (yours), action=accept”

5

Thanks for response, but Could you please answer the rest of my second question?

and if it an old one, why it doesn’t affect my ability to access the router remotely and now it does?

  • please note that i started with routeros 6.24.2, and i was completely able to connect using winbox and web browser over the internet.

  • Also since i don’t have any specific IP address to use in your suggested rule (since usually connect using USB modem). can i specify my laptop MAC address or any thing else that doesn’t include IP address?