Securing Mikrotik without using Firewall for fastpath

RouterOS General
1

Dear Member,

How would you secure your mikrotik services such as winbox without using built in firewall so that fastpath can kick in?

This is a BGP router and you want the best performance ever.

Thanks!

2

1.) Fast path works on forwarding packets, the services work on the input chain, so securing them via firewall should not affect fast path performance.
2.) You can dissable unwanted services running on the router, and you can also change the port they listen to to obscure thingts a bit more.

3

According to http://wiki.mikrotik.com/wiki/Manual:Fast_Path

one of the rule it said

  1. firewal rules are not configured;
4

That’s for when it’s automatically enabled. You can still use the firewall and NAT, just put in you’re own fasttrack-connection rule.

5

The only approach I can think of is the following. Allocate one interface for management purposes only, and connect it to your trusted (protected) network. Then configure winbox, ssh and other services you need to listen on this management interface only.

6

Configure the services to only be available from some trusted IP address.

7

Please, does anybody know how to protect a BGP Router (Port TCP 179) without breaking fastpath ?