The default firewall rules are for the sole purpose of an individual connecting to his ISP and using the internet.
Once you start changing the network it is advised to revisit the firewall rules and modify accordingly.
As you have found out, the default rules are not all that clear for the beginner.
The rules if you are able to discern are set up with two concepts.
ALLOW ALL TRAFFIC as the starting point.
BLOCK certain traffic that is known to be not secure.
The problem is this relies on the user knowing in detail what may or may not be insecure, and this gets more difficult as the config gains in complexity.
Thus most users, as a first step, change the concept of the firewall rules with the following approach:
BLOCK ALL TRAFFIC as the starting point]
ALLOW only needed traffic.
In this way the user doesnt have to know whats potentially insecure, as all traffic is blocked and only user/device traffic needed is permitted.
++++++++++++++++++++++++++++++++++++++++++
The way to make this change is by putting at the end of the input chain and forward chain the basic rule
add chain=input/forward action=drop comment=“drop all else”
Thus if any of the rules above this rule, are not matched, then any other traffic is dropped cold.
One must be careful of implementing this in the input chain as one needs to allow ADMIN access to the input chain in a prior rule or you will lock yourself out of the router.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
The rule in question:
add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN comment=“defconf: drop all from WAN not DSTNATed”
Basically is two rules. I prefer separating rules and having clear rules so that to the reader its not ambiguous.
The first embedded rule, is to allow traffic going to normally a server ( port forwarding ) as that traffic comes in from the WAN usually.
The second embedd rule, is to block all other WAN to LAN traffic.
From the above, you now know that this second rule will not be required as we will have a last rule in the forward chain that drops all such traffic anyway.
The first rule will be stated in a much clearer new firewall rule!!
add chain=forward action=accept comment=“port forwarding” connection-nat-state=dstnat
However we are not DONE.
The default rules have an IMPLIED Third rule you were probably not even aware of.
It permits LAN to WAN traffic as well. Remember the approach is to allow all traffic and only block bad traffic.
Since we are not changing that to block all traffic at the end, we must ensure needed traffic is permitted, so typically we also add
add chain=forward action=accept comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
So now you have the new approach setup for firewall rules ready to be expanded to receive more rules for any needed traffic (allow).
/ip firewall filter
{forward chain}
_**add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=forward comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat { disable or remove if not required }
add action=drop chain=forward comment=“Drop all else”**_
*********** Where one puts any more rules to allow traffic
