Be carefull .... most external attacks are on the port 22 (SSH)

Therefore there is this default firewall rule:

Code: Select all

add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN log=yes

You have to make an accept exception rule, before this general rule.
This must be very specific, explicit port number, even source IP address (range) or other filter.

By disabling the rule every port on your router is open from the internet. That's absolutely terrible from a security perspective. What is the purpose for this forward in the first place? Do you want to be able to perform admin on the MT?

As mentioned, if (and you really don't!) you want to have SSH available from WAN, you want to only have port 22 available. You might want to add a source address to make this service only available from a specific IP. More safe would be introducing port knocking, search on this forum how that works.

But my only accept rule on the input chain from WAN is VPN (besides the default rules). Everything I have to do on the MT or internal network is through this tunnel.

TLDR
Don't open ports on you MT, use VPN. Any doubts...read the above.

I second @erlinden in this. Use a VPN if you can, it has better username/password/certificate protection, and even then you can use secured SSH in the VPN tunnel.
HTTPS is also encrypted, but port 21,22,80 and 443 are very high on the scan-lists of attacking bots.
(Nobody wants to harm you specificly? But with those ports open the bots try within seconds)
My ISP is blocking 443 just for this reason. I have to explicitly request 443, they advice against this. And I closed the port again, too much unwanted traffic on my line.

Countries have known IP ranges. So one step is to limit the source address to eg your own country only. (http://www.ip2country.net/ip2country/ip ... _list.html)
IP source is spoofed with VPN (like NordVPN), but HTTP can be spoofed also with anonymous proxies.

Just try to be smarter than the intruder (s bot). E.g. any access attempt to public port 22 should put that IP in your blacklist

Shodan knows your port is open, and tells everyone who wants to know open ports .... (https://www.shodan.io/)

See tutorials, like https://www.youtube.com/watch?v=QWLY5vdKV4c

It's "matching VPN client and server" when eg the client is on your laptop/tablet/smartphone/smartwatch/car/ ..... . The server side on MKT is in the PPP menu.
But there is also Wireguard, Zerotier etc now.
I use a mAP Lite as travel companion, which creates the tunnel for my above client devices.

By disabling the rule every port on your router is open from the internet.

Starting Nmap 7.80 ( https://nmap.org ) at 2023-11-23 17:02 MSK
...
Not shown: 2996 closed ports
PORT     STATE    SERVICE
139/tcp  filtered netbios-ssn
445/tcp  filtered microsoft-ds
1723/tcp open     pptp
2000/tcp open     cisco-sccp

By disabling the rule every port on your router is open from the internet.

Oh, really? Your statement a little bit pedantic, do not you think so?

Code: Select all

Starting Nmap 7.80 ( https://nmap.org ) at 2023-11-23 17:02 MSK
...
Not shown: 2996 closed ports
PORT     STATE    SERVICE
139/tcp  filtered netbios-ssn
445/tcp  filtered microsoft-ds
1723/tcp open     pptp
2000/tcp open     cisco-sccp

I have got this output without all the firewall's rules enabled in MikroTik RouterOS 6.49.1.
Too much panic about the safety.

More, I cannot to forward 22 port to my local PC from external IP address by 22211 port with SSH forwarding enabled for "both" and, again, with the firewall disabled. I just getting: "... port 22211: Connection refused". Too much security, although it is not in vain.