Winbox by MAC address and client firewalling

RouterOS General
8

For MAC WinBox to work on my Linux installations with nftables, I had to do his:

  • Make sure the interface on the PC has an IP address assigned.

  • Add the two following rules to table filter chain input:

    udp sport 20561 udp dport 10000-65535 ip saddr 0.0.0.0 ip daddr 255.255.255.255 accept comment "allow MAC WinBox"
udp dport 5678 meta pkttype { broadcast, multicast } accept comment "allow MNDP"

    The 2nd rule is for the Neighbors list. For the first rule, unfortunately we need to filter by source port 20561 and dst/src-address because the packets cannot be matched to have connection state established. And they are not broadcast packets either, so filtering with pkttype doesn't work. The high dst-port hopefully limits the attack surface.

With that, no root privileges are required for running WinBox.