So, I’m releasing this for people to use and contribute to it. It’s my approach to zone based firewalling (or ZBF) I’ve got this on a few routers in production (RB1100, hAP-Lite and CCR1009).
For anyone that doesn’t know, ZBF is a methodology to filter traffic based on the trustworthiness of an interface, it’s IP agnostic so what matter is actually from where it came (interface) and to where it goes (again, interface). A common set of rules are always applied to a particular flow stream (for instance, from a trusted interface to a non-trusted interface). To me, this kind of approach is easier to maintain, sadly Mikrotik doesn’t have direct support for it.
The scripts sets up everything for the firewall to behave like a ZBF based one. It even adds 2 functions that can be used to add or remove interfaces from a particular security context.
Thank you for sharing this. I am going to give this a try and report back. I to prefer Zone Based Firewall setups.
So I ran the script on a mikrotik with no default config, added my vlans/subnets/dhcp and etc, bu when I enable all of the rules (particularly the three rules that “DROP ALL TRAFFIC * TO AN INTERFACE WITH NO SECURITY ZONE DEFINED”. Is that because I have vlan interfaces? If so, how do I add the vlan interfaces to the inside zone?
Current port assignment: Ether1 (Outside), Ether2 (Inside), Ether3 (DMZ).
Vlans on Ether2 and other test Vlans on Ether3.
Regards,
Actually, the new 6.40 release has it by default. Upgrade a router to 6.40 and reset it to defaults, and see how it looks.
It creates “interface lists” and puts the internal and external interfaces in a “LAN” and “WAN” list, then uses those lists for the default rules.
Of course, when you want to filter more agressively you still need to extend this default firewall with your own rules, but the starting point is there.
It does not use “jump” rules, which is not warranted for such a small firewall, but that is something you can change (jump to a WAN rule for traffic
incoming from the WAN interface list, etc). Indeed, on a more complicated setup I also do that, as it has better performance and more clarity than
a straight list matching the interface list on every rule.
But if I wanted to fix my current setup, is there an easy way to include the can interfaces? I tried using bridge interfaces, to encompass all subinterfaces (hoping it would include the vlans). That didn’t work.
If you see the date of this post I wrote this long before such changes were made. I did update this setup to use the lists instead of creating a bunch of jump rules between interfaces. I just didn’t update the repository since nobody was using it.
It keeps the zones jump though, since this is how I wanted to control traffic and is needed to emulate the zbf behavior, but adding removing zones and interfaces from zones is now easier (a lot thanks to the interfaces lists) .
Enviado desde mi SAMSUNG-SM-G920A mediante Tapatalk
Eric yes you need to add the vlan interfaces to a zone, the rules in there had defaults, the one your mentioned basically drops everything not assigned to a security zone.
anyway adding interfaces to a zone was kind of complicated when I wrote that configuration, that’s why there’s a function loaded that does this all for you.
But now is easier/cleaner thanks to some changes mikrotik did. I’ll try to get the time to update that repository
Enviado desde mi SAMSUNG-SM-G920A mediante Tapatalk
That would be cool! I appreciate the response, knowing this was an older topic. I just thought it was cool.
I did try $zbf add 1 Ether2_Vlan100 and is says something like l failed to add, could not locate interface.
Another update, I added a subnet to the source IP address for each of those three DROP rules and it worked. In the screenshot II had created an AddressList for the local subnets. This is probably not the correct way to have do this, but is works for now.
Regards,
Eric
