Hi
So i swap the router with a new RB4011, but as all the research made, i still struggle to get special service running. I do have all rules in place, but might be in wrong order… or the input/ output interface required or not… Basically, i have the port 25 blocked, a softVpn don’t connect(1196 to 1203) and the voip Sip don’t work either (5060 and 5061)
softvpn:192.168.0.146 / voip sip: 192.168.0.30 / email IpCam 192.168.0.128 and email pc .62
Wan modem on ether1 dns 192.168.1.120 / bridge subnet & rb4011 : 192.168.0.1
the nat : 11 to 16 appear by themself from the ipcam
** In firewall service port, i disable the Ftp and the Sip / and into ip service list : api / api-ssl / ssh / ftp / telnet : are disable.
I can ping all device fine. NC - netstat on any pc confirm port 25 not passing.
Thanks in advance for helping me to review that.
So i’ve check further and put on a quite basic rule.. i guess .. But i do don’t get why i can’t have access to a softvpn. Softvnp.. any software you put on a pc.. And the weird thing is with this, at one point the voip phone start to work.. I clic l disable the filter rule to confirm it was the good filter rules. I put it back on and the voip cannot connect back.
I did a reboot. And now : i cannot login anymore via winbox !!!
quite bad.. Any help ?
I was able to load an old config and winbox came back up. Pretty sure fastrack do something bad.. Here the rules present now that i cannot figure out :
Firewall filter flags: X - disabled, I - invalid, D - dynamic
0 chain=input action=accept connection-state=established,related
1 X ;;; S1: accept input established,related,untracked
chain=input action=accept connection-state=established,related,untracked log=no
log-prefix=""
2 chain=input action=accept protocol=tcp dst-port=1194 log=no log-prefix=""
3 chain=input action=accept protocol=tcp dst-port=1196 log=no log-prefix=""
4 chain=input action=accept protocol=tcp in-interface=bridge1 src-port=5060-5061
log=no log-prefix=""
5 X chain=forward action=accept connection-state=established,related log=no
log-prefix=""
6 X ;;; Allow LAN access to move through the router
chain=forward action=accept connection-state=new in-interface=ether1 log=no
log-prefix=""
7 ;;; S1: drop invalid
chain=input action=drop connection-state=invalid
8 ;;; Allow LAN access to the router itself
chain=input action=accept connection-state=new in-interface=ether1
9 ;;; ^^ that originated from LAN
chain=input action=accept connection-state=established
10 ;;; Allow ping ICMP from anywhere
chain=input action=accept protocol=icmp
11 X ;;; IPcam
chain=forward action=accept protocol=tcp src-address=192.168.0.128
src-port=8000 log=no log-prefix=""
12 ;;; ss: softVPN
chain=input action=accept protocol=tcp dst-port=1197-1202 log=no log-prefix=""
13 ;;; ipCam mail
chain=input action=accept protocol=tcp dst-port=25
14 ;;; Voip
chain=input action=accept protocol=tcp dst-port=5060-5061
15 X ;;; Plex Ports - TCP
chain=forward action=accept protocol=tcp dst-port=3005,8324,32469 log=no
log-prefix=""
16 X ;;; Plex Ports - TCP
chain=forward action=accept protocol=udp dst-port=1900,5353,32412-32414 log=no
log-prefix=""
17 ;;; L2TP/IPSEC
chain=input action=accept protocol=udp dst-port=500
18 ;;; L2TP/IPSEC
chain=input action=accept protocol=ipsec-esp
19 ;;; L2TP/IPSEC
chain=input action=accept protocol=udp dst-port=4500
20 ;;; L2TP
chain=input action=accept protocol=udp dst-port=1701
21 ;;; S1: accept forward established,related, untracked
chain=forward action=accept connection-state=established,related,untracked
22 X ;;; ^ that originated from LAN -new connection
chain=forward action=accept connection-state=established log=no log-prefix=""
23 ;;; Add a filter exception for port mapped server
chain=forward action=accept protocol=tcp dst-address=192.168.0.128 dst-port=25
log=no log-prefix=""
24 X ;;; voiptest
chain=forward action=accept protocol=tcp src-port=12700-65500 log=no
log-prefix=""
25 chain=forward action=accept protocol=tcp dst-port=5060-5061 log=no log-prefix=""
26 ;;; S1: drop invalid
chain=forward action=drop connection-state=invalid