1.why 192.168.0.0/16 is a bad source for ipv4?
https://help.mikrotik.com/docs/display/ROS/Building+Advanced+Firewall#heading-IPv4AddressLists
2.should be ipv6 raw rule
https://help.mikrotik.com/docs/display/ROS/Building+Advanced+Firewall#heading-IPv4RAWRules-2
Ad 1.: the article is an example to show how one can strenghten security. Surely exact config should be adapted for actual network layout. For example: 192.168.0.0/16 is a bad SRC IP address for packets arriving from WAN interface. Except in very rare cases. But for majority of installations bad SRC address is 10.0.0.0/8 as well … unless ISP is using CGNAT. The example rule on the page you quoted is dropping any traffic with SRC address 192.168.0.0/16 regardless the ingress interface. In most SOHO cases such rule is too restrictive because it’s dropping traffic originating from LAN which usually belongs to some 192.168.x.0/24 subnet which means that the rule should be adjusted to check also the ingress interface.
In short: the article is there to illustrate potential configuration of firewall, not exact configuration recipe … if it was recipe, it would probably become a part of default setup.
In other words, if you dont understand subnetting, nor what the rules are doing, then its probably best to stick with the default firewall rules until more knowledge is gained.
192.168.0.0/16 was added by mistake.
Also fixed title form IPv4 to Ipv6.
I think you misunderstood the address list of bad_src_ipv4 in the example. If you read it carefully, you will find that the bad_src_ipv4 address list should contain the ip which can’t be a src ip, both for private and public network. for example:255.255.255.255
Thanks for the confirm.
And is this right?
/ipv6 firewall address-list
add address=2001::/32 comment="defconf: RFC6890 TEREDO" list=not_global_ipv6
/ipv6 firewall raw
add action=drop chain=prerouting comment="defconf: drop non global from WAN" src-address-list=not_global_ipv6 in-interface-list=WAN
Yes should be correct,