(1) Comment: hiding your private IPs throughout the config is useless from a security perspective and actually gets in the way of detecting errors one has made in the config.
(2) Why do you have this setup… as such???
/ip dns
set servers=xx,xx
Should be something like.
/ip dns
set allow-remote-requests=yes servers=1.1.1.2,8.8.4.4 ( pick a couple of decent dns servers on the net )
(3) Firewall address list you use is WHACK!
Use interface lists to identify subnets that the admin may come from to config the router, but use address list to narrow down to specific IP addresses.
There is no point in identifying subnets of users to identify admin IPs in an address list.
/ip firewall address-list
add address=xx/24 list=Management
add address=xx list=Management
add address=xx list=Management
add address=xx list=Management
add address=xx/24 list=Management
/ip firewall filter
add action=accept chain=input src-address-list=Management
better to have
/interface list
add name=WAN
add name=LAN
add name=MANAGE ( and then add appropriate interfaces in list members )
WHICH by the way is also weird you have TWO subnets associated with the source address list but ONLY one subnet and that is on the bridge,
Where are you getting this second subnet??
Surely it cannot be proton VPN because that is an outgoing service aka VPN to the outer world ???
/interface list members
add interface=ether5-backhaul list=WAN
add interface=bridge list=LAN
add interface=bridge list=MANAGE
then
add action=accept chain=input in-interface-list=MANAGE src-address-list=AdminAccess
(4) RAW RULES REMOVED / Mangle left alone as you need it for VPN for some reason, but not clear why???
/ip firewall filter
{Input Chain}
(default rules)
add action=accept chain=input comment=“defconf: accept established,related,untracked” connection-state=established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
(admin rules)
add action=accept chain=input in-interface-list=MANAGE src-address-list=Management
add action=accept chain=input comment=“Allow LAN DNS queries-UDP” \ {and NTP *** services if required etc}
dst-port=53,123* in-interface-list=LAN protocol=udp
add action=accept chain=input comment=“Allow LAN DNS queries - TCP”
dst-port=53 in-interface-list=LAN protocol=tcp}
add action=drop chain=input comment=“drop all else” { put this rule in last otherwise you could lock yourself out }**
{forward chain}
(default rules)
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related
add action=accept chain=forward comment=“defconf: accept established,related, untracked” connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
(admin rules)
add action=accept chain=forward comment=“allow internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“allow port forwarding” connection-nat-state=dstnat { disable if not required }
add action=drop chain=forward comment=“drop all else”
/ip firewall mangle
add action=mark-connection chain=prerouting new-connection-mark=
under_protonvpn passthrough=yes src-address-list=under_protonvpn
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade” out-interface-list=WAN
(5) Also go into IP FIREWALL, select TAB Connections and below the TAB line, find the button and select “Tracking”
In the pop-up menu ensure the checkbox is NOT checked, we dont want loose here.
(6) DISABLE www, unless required for some reason, its not a secure service and should not be enabled.
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=xx/16
set ssh address=xx/16
set api disabled=yes
set winbox address=xx/16
set api-ssl disabled=yes
