(1) Your firewall rules are a godly mess, out of order and stepping all over each other, especially the input chain.
Put the chains together and you can see issues more clearly and troubleshoot later
(2) Well I dont understand your DNS input chain setup or fears..
_add action=drop chain=input comment=“Prevent DNS Open Resolver Attack”
dst-port=53 protocol=udp src-address=!192.168.0.0/16
add action=drop chain=input comment=“Prevent DNS Open Resolver Attack”
connection-state=new dst-port=53 in-interface-list=WAN protocol=tcp
add action=drop chain=input comment=“Prevent DNS Open Resolver Attack”
connection-state=new dst-port=53 in-interface-list=WAN protocol=udp
add action=accept chain=input comment=_
The first rule you drop everything heading to port 53 not from your LAN, nothing wrong with that!
So why the need to drop everything from WAN…
In the last rule you then open up your entire router to the WAN, which is a big no no.
Highly recommend something a bit more logical and understandable with two simple rules.
add action=accept chain=input in-interface-list=LAN
add action=drop chain=input comment=“drop all else”
Basically allow LAN access to the router including DNS etc.
Block everything else.
If you want more granular control as an admin then simply change this to
add action=accept chain=input in-interface-list=Authorized src-address-list=AdminAccess
add action=accept chain=input comment=“Allow LAN DNS queries-UDP” \ {and NTP *** services if required etc}
dst-port=53 in-interface-list=LAN protocol=udp
add action=accept chain=input comment=“Allow LAN DNS queries - TCP”
dst-port=53 in-interface-list=LAN protocol=tcp
add action=drop chain=input comment=“drop all else”
This approach allows the admin only full access to the router,
THen allows LAN users to access DNS.
This is the most common setup.
All you need to do is make a firewall address list of all the admin IPs, ( desktop, laptop, smartphone, and even L2TP
Also you can then get rid of silly winbox port rule too… clear, clean, readable.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
(3) I dont understand the rules you have made at all… Two of them use the same source address for two different routing marks ???
/ip firewall mangle
add action=mark-routing chain=prerouting comment=“HP Note-OFFICE2”
dst-address=!192.168.0.0/16 new-routing-mark=OFFICE2 passthrough=yes
src-mac-address=SENSITIVE
add action=mark-routing chain=prerouting comment=Desktop-OFFICE disabled=yes
dst-address=!192.168.0.0/16 new-routing-mark=OFFICE passthrough=yes
src-mac-address=SENSITIVE
add action=mark-routing chain=prerouting comment=MiPad5-OFFICE2 disabled=yes
dst-address=!192.168.0.0/16 new-routing-mark=OFFICE2 passthrough=yes
src-address=192.168.0.73
What you can do to avoid mangling and by the way the mangle rules would need work if you wanted to use them…
You already have the tables
You already have the routes
Delete mangles and add Routing Rules.
add src-address=IPofPC-1 that needs to go out VPN1 action=lookup table=office
add src-address=IPofPC-2 that needs to go out VPN2 action=lookup table=office2
Note; If you want the user to be able to access LOCAL WAN if the VPN is working you are good to go.
If you do not WANT the pc user to be able to access LOCAL WAN ever, then change action to
action=lookup-only-in-table.