Community discussions

MikroTik App
 
sultanbrunei
newbie
Topic Author
Posts: 32
Joined: Sun Apr 26, 2020 8:52 am

Unable to access mikrotik via IP address

Mon May 09, 2022 9:23 am

Hi, my mikrotik Hex router is configured using standard firewall rules.
mikro.jpeg
I have to disable the "drop input for all other traffic" rule to be able to access the router from IP address.
Should I disable the rule and still feel safe, or should I make additional rule to make an exception so that my PC can access my mikrotik through IP address? How?

Thank you
You do not have the required permissions to view the files attached to this post.
 
erlinden
Forum Guru
Forum Guru
Posts: 1920
Joined: Wed Jun 12, 2013 1:59 pm
Location: Netherlands

Re: Unable to access mikrotik via IP address

Mon May 09, 2022 9:56 am

I think you want to access it only from "LAN" (that's like a double hint)?

Referring to default rules, these are (assuming you do use Interface List):
/ip firewall filter
add action=accept chain=input comment="accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="drop invalid" connection-state=invalid
add action=accept chain=input comment="accept ICMP" protocol=icmp
add action=drop chain=input comment="drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=accept chain=forward comment="accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="accept out ipsec policy" ipsec-policy=out,ipsec
add action=drop chain=forward comment="drop all from WAN not DSTNATed" connection-nat-state=!dstnat in-interface-list=WAN
You might want to activate logging (or read the logging) to get some information about packets getting dropped.
 
sultanbrunei
newbie
Topic Author
Posts: 32
Joined: Sun Apr 26, 2020 8:52 am

Re: Unable to access mikrotik via IP address

Mon May 09, 2022 11:08 am

I think you want to access it only from "LAN" (that's like a double hint)?

Referring to default rules, these are (assuming you do use Interface List):
/ip firewall filter
add action=accept chain=input comment="accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="drop invalid" connection-state=invalid
add action=accept chain=input comment="accept ICMP" protocol=icmp
add action=drop chain=input comment="drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=accept chain=forward comment="accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="accept out ipsec policy" ipsec-policy=out,ipsec
add action=drop chain=forward comment="drop all from WAN not DSTNATed" connection-nat-state=!dstnat in-interface-list=WAN
You might want to activate logging (or read the logging) to get some information about packets getting dropped.

Should I ADD all of these, as firewall rules number 8-16 ?
 
User avatar
bpwl
Forum Guru
Forum Guru
Posts: 2983
Joined: Mon Apr 08, 2019 1:16 am

Re: Unable to access mikrotik via IP address

Mon May 09, 2022 11:45 am

Hi, my mikrotik Hex router is configured using standard firewall rules.
Doesn't look like the standard firewall rules. The other posts show what I also get as default firewall rules. eg: add action=drop chain=input comment="drop all not coming from LAN" in-interface-list=!LAN , allowing input from LAN. "bridge1" should then be in the LAN interface list (under "interfaces" menu)

Or just make a specific rule above the "drop input for all other", allowing port 8291 from a specific interface or IP address.
Last edited by bpwl on Mon May 09, 2022 11:50 am, edited 3 times in total.
 
User avatar
own3r1138
Long time Member
Long time Member
Posts: 681
Joined: Sun Feb 14, 2021 12:33 am
Location: Pleiades
Contact:

Re: Unable to access mikrotik via IP address

Mon May 09, 2022 11:48 am

Hi,
If you don't have any config other than what comes with MT out of the box I recommend resetting the configuration to default as the easiest way to get default firewall rules in place.
When you play with the firewall you should use "SAFE MODE".
https://help.mikrotik.com/docs/display/ ... t+Firewall
Firstly, check the above article.
You should remove all your current firewall rules and then replace them with the default firewall rules.
If you copy the rules be aware if you do NOT use fast-track you should remove "untracked" at the "connection-state".
/ip firewall filter
add action=accept chain=input comment="accept established,related,untracked" connection-state=established,related,untracked
add action=accept chain=forward comment="accept established,related, untracked" connection-state=established,related,untracked
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19099
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Unable to access mikrotik via IP address

Mon May 09, 2022 4:47 pm

To be clear, first, the source of your information is in question!
Second, your knowledge of firewall rules etc is in question!

Suggest some reading first and as for guidance this is a good safe spot. - viewtopic.php?t=180838

WHEN and only WHEN you understand the difference between input chain and forward chain, destination nat and source nat,
and IP routes ( how to manually or automatically apply) and understand what each rule is doing, I highly suggest you stay away from youtube,
or anyone here with any wild ideas or seemingly complex ideas.

Who is online

Users browsing this forum: giovanniv, GoogleOther [Bot], mtkvvv, shadarim and 48 guests