I just want to make sure while adding the VLAN rule I did not screw up my firewall protection.
Here is the config;
Code: Select all
# nov/01/2021 15:22:39 by RouterOS 6.49
# software id = 5MZ7-RL5B
#
# model = RB760iGS
# serial number = XXXXXXXXXB
/interface bridge
add admin-mac=XX:XX:XX:XX:XX auto-mac=no comment=defconf name=bridge
/interface vlan
add comment="Untrusted IoT" interface=ether4 name=VLAN20 vlan-id=20
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=dhcp ranges=192.168.4.10-192.168.4.200
add comment="DhcpPool for IoT" name=DhcpPool_20 ranges=\
192.168.20.10-192.168.20.100
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
add address-pool=DhcpPool_20 disabled=no interface=VLAN20 name=DHCP-20
/tool user-manager customer
set admin access=\
own-routers,own-users,own-profiles,own-limits,config-payment-gw
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.4.1/24 comment=defconf interface=bridge network=\
192.168.4.0
add address=192.168.20.1/24 interface=VLAN20 network=192.168.20.0
/ip cloud
set update-time=no
/ip dhcp-client
add comment=defconf disabled=no interface=ether1 use-peer-dns=no \
use-peer-ntp=no
/ip dhcp-server network
add address=192.168.4.0/24 comment=defconf dns-server=\
192.168.4.209,192.168.4.208 domain=clubamgg.com gateway=192.168.4.1 \
netmask=24
add address=192.168.20.0/24 comment="VLAN20 - IoT" dns-server=1.1.1.1,8.8.8.8 \
gateway=192.168.20.1
/ip dns
set servers=1.1.1.1,9.9.9.9
/ip dns static
add address=192.168.4.1 comment=defconf name=router.lan
/ip firewall address-list
add address=192.168.20.0/24 comment="Addresses for untrusted vlan 20" list=\
VLAN20
add address=192.168.4.0/24 list=LAN
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=drop chain=forward dst-address-list=LAN src-address-list=VLAN20
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=51820 in-interface=ether1 protocol=\
udp to-addresses=192.168.4.8 to-ports=51820
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=2200
set api disabled=yes
set winbox address=192.168.4.0/24
set api-ssl disabled=yes
/system clock
set time-zone-name=America/New_York
/system identity
set name=Router
/system note
set note="mehdi, clubamgg.com - Authorized administrators only. Access to this\
\_device is monitored."
/system ntp client
set enabled=yes primary-ntp=38.229.71.1 secondary-ntp=199.180.133.100
/system package update
set channel=development
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool mac-server ping
set enabled=no
/tool user-manager database
set db-path=flash/user-manager
