Yikes what did you do LOL…
This is what your interface list should look like
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
This is what your interface list members should look like (just modify the interface name to what you are using.)
/interface list member
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether1 list=WAN
I think whats screwed up is at the start your ETHERNET INTERFACE is not setup.
You should only have four of everything , pools, dhcp servers etc. if you have four subnets??
Understand you are probably keeping the default original while configuring so okay!
Firewall rules are partially okay, where you kept the defaults mostly okay, the rest needs review.
/ip firewall filter
a_dd action=accept chain=input comment=
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=
“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1_
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
in-interface-list=!LAN {note- should be here in the order of rules}
add action=accept chain=forward comment=“defconf: accept in ipsec policy”
ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy”
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related
add action=accept chain=forward comment=
“defconf: accept established,related, untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid”
connection-state=invalid
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
*Everything below is suspect!!!
and dependent upon requirements.
Suggesting you get rid of them and state the requirements of what your trying to do without talking about the config but simply in terms of users/devices.
*
(add action=accept chain=input comment=“MY FW STARTS HERE” in-interface-list=
LAN-ether2
add action=accept chain=forward in-interface-list=LAN-ether2
add action=accept chain=input in-interface-list=LAN-ether3
add action=accept chain=forward in-interface-list=LAN-ether3
add action=accept chain=input in-interface-list=LAN-ether4
add action=accept chain=forward in-interface-list=LAN-ether4
add action=accept chain=input in-interface-list=LAN-ether5
add action=accept chain=forward in-interface-list=LAN-ether5
TO CONTROL internet access simply add an Interface list ENTRY
like so.
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add comment=internet_access name=With_INT
/interface list member
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether1 list=WAN
add interface=ether2 list=With_INT
add interface=ether4 list=With_INT
add interface=ether5 list=With_INT
In firewall rules.
Add last rule
add chain=forward action=drop comment=drop all else.
Right before this last rule add
add chain=forward action=accept in-interface-list=With_INT out-interface-list=WAN
Now only lans 2,4,5 will have access to the internet.
As an added bonus all connectivity between the subnets should be blocked as well.
LAN2 should not be able to reach any other LAN for example.
If you wish to ensure routing between them is possible
then you would add BEFORE THE LAST DROP ALL RULE…(for all of these)
add chain=forward actioni=accept in-interface=ether2 out-interface=ether3 I think you get the idea.
If you only wanted one IP address in LAN2 to access LAN3
add chain=forward action=accept source-address=LAN2 IP address out-interface=ether3
If you wanted a few IP addresses to access LAN 3 then create a firewall address list containing those IPs and call it TOLAN3
add chain=forward action=accept source-address-list=TOLAN3 out-interface=ether3
