Community discussions

MikroTik App
 
niren
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 76
Joined: Mon Oct 14, 2013 9:59 am

Block all ports but 80 and 1723

Mon Nov 25, 2013 1:44 pm

Block all ports except 80 and 1723.
how do I do?

I tried these codes to block all but 80
/ip firewall filter
add chain=forward action=accept src-address=192.168.0.0/24 protocol=tcp dst-port=80
add chain=forward action=accept dst-address=192.168.0.0/24 protocol=tcp src-port=80
add chain=forward action=drop.
after I enable these rules, I can't able to browse. Once I disable last rule then I able to do browse.
 
Thasaidon
just joined
Posts: 3
Joined: Mon Sep 09, 2013 10:42 am

Re: Block all ports but 80 and 1723

Mon Nov 25, 2013 2:54 pm

Surfing probably doesn't work, because you are not allowing DNS.
If you type http://somehere.net in your browser, it needs to resolve the FQDN to an IP through DNS.
So if you only allow http (tcp 80) you should either use IP addresses for each page you want to visit (like http://12.23.34.45), or enable DNS (tcp/53 & udp/53) to pass through the firewall too.
 
efaden
Forum Guru
Forum Guru
Posts: 1711
Joined: Sat Mar 30, 2013 1:55 am
Location: New York, USA

Re: Block all ports but 80 and 1723

Mon Nov 25, 2013 3:09 pm

Surfing probably doesn't work, because you are not allowing DNS.
If you type http://somehere.net in your browser, it needs to resolve the FQDN to an IP through DNS.
So if you only allow http (tcp 80) you should either use IP addresses for each page you want to visit (like http://12.23.34.45), or enable DNS (tcp/53 & udp/53) to pass through the firewall too.
+1... the other option would be to block DNS as you are doing in the forward chain, but make sure you have the dns server setup on the mikrotik itself and allow remote requests.

Post your whole config if you have problems setting that up.
 
niren
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 76
Joined: Mon Oct 14, 2013 9:59 am

Re: Block all ports but 80 and 1723

Mon Nov 25, 2013 5:34 pm

It is working by these rules
add chain=forward action=accept protocol=tcp dst-port=80 comment="Allow HTTP" 
add chain=forward action=accept protocol=tcp scr-port=80 comment="Allow HTTP" 
add chain=forward action=accept protocol=tcp dst-port=443 comment="Allow HTTPS" 
add chain=forward action=accept protocol=tcp scr-port=443 comment="Allow HTTPS"
add chain=forward protocol=udp comment="allow udp"
add chain=forward action=drop comment="drop everything else"
I have another problem, please check my another question http://forum.mikrotik.com/viewtopic.php?f=2&t=79251
 
troy
Member
Member
Posts: 310
Joined: Thu Jun 30, 2005 6:47 pm

Re: Block all ports but 80 and 1723

Mon Nov 25, 2013 6:20 pm

add chain=forward action=accept protocol=tcp dst-port 3389 in-interface=VPN comment="Allow RDP via VPN"

If you don't mind a suggestion... take some time to review the basic firewall documentation in the wiki. Also search for various firewall scripts out there.

IMO, firewalls are typically used to protect a LAN from the WAN while treading lightly on user-originated activities. From your posts, it would appear that you're wanting to place some severe restrictions on what users can do, which is fine, but is often much more difficult to implement.

A closed firewall (default drop), looks something like this:

1) drop invalid connections
2) allow established connections
3) allow related connections
4) drop undesirable connections (that might otherwise be allowed in #5)
5) allow the good stuff (tcp/53, udp/53, http/80, https/443, pop3/110, smtp/25, etc...)
6) drop everything else (final rule)

When you want to allow certain traffic, but only from certain sources, use the source:

ros code

add chain=forward action=accept protocol=tcp dst-port=3389 in-interface=VPN
add chain=forward action=accept protocol=tcp dst-port=3389 src-address=go.od.add.res/32
So, your prototype firewall to restrict users as much as possible, might look like this:

ros code

/ip firewall filter
add chain=forward protocol=tcp connection-state=invalid action=drop comment="drop invalid connections"  
add chain=forward connection-state=established action=accept comment="allow already established connections"  
add chain=forward connection-state=related action=accept comment="allow related connections"
add chain=forward action=accept protocol=tcp dst-port=53 in-interface=LAN comment "allow DNS"
add chain=forward action=accept protocol=udp dst-port=53 in-interface=LAN comment "allow DNS"
add chain=forward action=accept protocol=tcp dst-port=80 in-interface=LAN comment "allow HTTP"
add chain=forward action=accept protocol=tcp dst-port=443 in-interface=LAN comment "allow HTTPS"
add chain=forward action=accept protocol=tcp dst-port=3389 in-interface=VPN comment "allow RDP via VPN"
add chain=forward action=drop
Please review the wiki firewall article, it explains a lot. If you're impatient (like me), use this code as a start and move on from there, but don't expect too much help beyond the absolute basics.

Good luck!
 
niren
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 76
Joined: Mon Oct 14, 2013 9:59 am

Re: Block all ports but 80 and 1723

Mon Nov 25, 2013 10:43 pm

@troy thanks a lot. its working. I need to study wiki documentation as you said.
 
kei888
newbie
Posts: 47
Joined: Fri Feb 07, 2014 7:54 am

Re: Block all ports but 80 and 1723

Mon Oct 27, 2014 3:20 am

Hi I have almost the same problem with my RB951G-2HnD router, I just want it to allow all ports.

Can someone post the script for my Mikrotik to allow ALL ports especially port 22?

Thank you.
 
bingo220
Member Candidate
Member Candidate
Posts: 124
Joined: Sun Sep 22, 2013 9:30 pm
Location: Ukraine

Re: Block all ports but 80 and 1723

Mon Oct 27, 2014 3:15 pm

...I just want it to allow all ports...
For allow all ports you need no rules.

Who is online

Users browsing this forum: No registered users and 52 guests