In summary,
So far I see most ports are access ports to devices that are not vlan aware on the private LAN, and ether 9 being a wired guest port??, eth10 a base port).
You have an SFP port which is most likely a trunk port which may carry all three vlans?
You have 4 wlans, two private (Atlas and fuji) and two guest (Atlas and fuji) (assuming private 1x5gh, 1x2ghz and same with guest)
The private are standard wlans the guest are virtual wlans.
So far so good! (I guess the SFP is not attached to anything at the moment).
(1) Now lets look at the one of the usual got you places… See the missing bits!!
/interface bridge vlan
add bridge=vlan_bridge tagged=vlan_bridge untagged=wlan_atlas,wlan_fujijama,ether2,ether3,ether4,ether5,ether6,ether7,ether8
vlan-ids=10
add bridge=vlan_bridge tagged=vlan_bridge untagged=wlan_atlas_guest,wlan_fujijama_guest,ether9 vlan-ids=20
add bridge=vlan_bridge tagged=vlan_bridge untagged=ether10 vlan-ids=99
Next fw rules…standby
(2) This is a holdover hard to find to get rid of from default rules - hint check static DNS…
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
(3) Only comment is that I usually put the allow vlan rules after the default rules in place… So slight change in location with negligible effect (in other words you dont have to change them).
I do want to know the purpose of your ALLOW VLAN to the router. I would not let any tom dick and harry access to the router.
The only reason they need access is to access services the router provides. Typically I only allow port 53 for DNS services for example.
I believe you have this covered for pi-hole already right? So you could get rid of the VLAN rule.
If you still need it for DNS, then just make it for DNS (two rules port 53 udp/tcp etc.)
/ip firewall filter
add action=accept chain=input comment=“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=“accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
add action=drop chain=input comment=“defconf: drop all not coming from LAN” in-interface-list=!LAN
add action=accept chain=input comment=“Allow VLAN” in-interface-list=VLAN
add action=accept chain=input comment=“Allow Base_Vlan Full Access” in-interface=vlan_base
add action=accept chain=forward comment=“Access Pi-hole DNS from VLANs UDP” dst-address=10.0.0.3
dst-port=53 in-interface-list=VLAN protocol=udp
add action=accept chain=forward comment=“Access Pi-hole DNS from VLANs TCP” dst-address=10.0.0.3
dst-port=53 in-interface-list=VLAN protocol=tcp
add action=accept chain=forward comment=“defconf: accept established,related, untracked”
connection-state=established,related,untracked disabled=yes
add action=accept chain=forward comment=“defconf: accept out ipsec policy” ipsec-policy=out,ipsec
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=forward comment=“VLAN Internet Access only” connection-state=new
in-interface-list=VLAN out-interface-list=WAN
add action=drop chain=forward comment=“defconf: drop all from WAN not DSTNATed” connection-nat-state=
!dstnat connection-state=new in-interface-list=WAN
(4) Look fine, dont need to ports if same as dest ports (implied). Noticed you had two translated so that is good.
/ip firewall nat
add action=masquerade chain=srcnat comment=masquerade ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment=NAS dst-port=22 in-interface=ether1 protocol=tcp to-addresses=
10.0.0.252 to-ports=18022
add action=dst-nat chain=dstnat comment=“Transmission Web Interface” dst-port=19091 in-interface=ether1
protocol=tcp to-addresses=10.0.0.252
add action=dst-nat chain=dstnat comment=Transmission dst-port=49850 in-interface=ether1 protocol=tcp
to-addresses=10.0.0.252
add action=dst-nat chain=dstnat comment=HTTPS dst-port=61443 in-interface=ether1 protocol=tcp
to-addresses=10.0.0.252 to-ports=443
