As Jaclaz points out, one only needs to export the file, and then using a program like notepad++
Remove
a. router serial number
b. any public WANIP information ( aka WAN DHCP information ( your actual wanip, the gateway IP etc)
c. any keys if you are using vpn ( probably not yet )
d. the dhcp lease list, sometime people put personal names on things etc.
the rest is of no consequence……
most likely you are missing firewall rules and some nat rules and probably shouldnt connect anything to the internet until you do.
Here is a good generic safe set of rules.
First ensure the ISP associated vlan is identifed on the interface list as well as the bridge.
/interface list
add list=WAN
add list=LAN
/interface list members
add interface=vlanISP list=WAN ( whatever the vlan interface is called )
add interface=bridge list=LAN ( whatever your bridge is called )
/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input dst-address=127.0.0.1 in-interface=lo src-address=127.0.0.1
add action=accept chain=input in-interface-list=LAN
add action=drop chain=input comment="drop all else"
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward comment="internet access" in-interface-list=
LAN out-interface-list=WAN
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade"
ipsec-policy=out,none out-interface-list=WAN
you can manually add these one by one through winbox and the appropriate menu but REAL QUICK and easier………
Simply go to winbox, then click on the left hand menu selection of New Terminal
Then copy the above ( from /interface list down to and including last line ).
Then paste it at the prompt blinking on the bottom of the page brought up by selecting New Terminal.
You can then at the prompt type /export to see for yourself the new rules………..
Then come back for further assistance if required. ( but ensure you provide the latest config as that is what is relevant )
BUT BUT BUT Before you do any of that, best advice is to create another way to access the router safely as what I call emergency access or a safe spot to do any configuration.
Take any etherport and do the following, lets say ether10
FIRST take ether10 off the bridge ( go to bridge menu on left hand side menu, select ports sub-menu at top
find ether10 and remove.
/interface ethernet
set [ find default-name=ether10 ] name=emergaccess10
/ip address
add address=192.168.78.1/30 interface=emergaccess10 network=192.168.78.0
/interface list
add interface=emergaccess10 list=LAN
Then all one has to do is plug their pc/laptop into ether10 change the ipv4 settings on the nic card to
192.168.78.2, and with username and password you should gain access via winbox.
