Hello, I hope this is the correct section to post.
I have just installed RouterOS on a device and I have never used it before.
So I am not sure if I have configured it correctly.

I have the following scenario:
- I have a main router connected to devices and servers.
- On those servers I have exsi with multiple VMs.
- I have connected the VMs to a RouterOS device.

What I would like to achieve in the RouterOS Lan is:
- VMs cannot reach each others;
- VMs cannot reach devices outside of their Lan;
- VMs cannot access neither the main router panel (i.e. 192.168.1.1), neither RouterOS panel (192.168.2.1);
- I need to open port 25000 on device 192.168.2.50 to the whole internet.

RouterOS is connected to the main router with an IP such as 192.168.1.150, to the gateway 192.168.1.1 and provides a lan of 192.168.2.0/24.
I have attached the screenshots of my firewall setup.
Everything seems to be working, however I am not sure if it is safe enough from potential hackers.

Also now that I have tried RouterOS I would like to purchase a separate device allowing me to do the same thing, I was thinking of the Hex S since I have a Gbit connection, would it allow me to do all of the above?

I apologize since I do not have a deep knowledge in networking.
Thanks in advance for any help!

What I would like to achieve in the RouterOS Lan is:
- VMs cannot reach each others;
- VMs cannot reach devices outside of their Lan;
- VMs cannot access neither the main router panel (i.e. 192.168.1.1), neither RouterOS panel (192.168.2.1);
- I need to open port 25000 on device 192.168.2.50 to the whole internet.

- VMs communicate with each other through the vSwitch, as long as they are on the same port group, of your ESXi host , so they won't reach the physical network in order to communicate with one another... So you have to configure the network settings of your ESXi host so that you drop the communication between them ( different port groups, VLANs etc ...) .
So if you have VM1 and VM2 that do exist in the same vSwitch and port group, they communicate directly without reaching your physical switch... thus they can achieve better speeds as well...
- Maybe you should think of using VLANs in your Network. What is the ROS device you use ?
- Use the Firewall filter ...
- Use Firewall Nat

What I would like to achieve in the RouterOS Lan is:
- VMs cannot reach each others;
- VMs cannot reach devices outside of their Lan;
- VMs cannot access neither the main router panel (i.e. 192.168.1.1), neither RouterOS panel (192.168.2.1);
- I need to open port 25000 on device 192.168.2.50 to the whole internet.

- VMs communicate with each other through the vSwitch, as long as they are on the same port group, of your ESXi host , so they won't reach the physical network in order to communicate with one another... So you have to configure the network settings of your ESXi host so that you drop the communication between them ( different port groups, VLANs etc ...) .
So if you have VM1 and VM2 that do exist in the same vSwitch and port group, they communicate directly without reaching your physical switch... thus they can achieve better speeds as well...
- Maybe you should think of using VLANs in your Network. What is the ROS device you use ?
- Use the Firewall filter ...
- Use Firewall Nat

I might think about adding VLANs, however I thought that adding the blocking rule from 192.168.2.0 to 192.168.2.0 would stop VMs from reaching each others.
I have installed ROS on a VM in order to test it before buying an actual router.
The two screenshots are from the firewall filter and the nat one.
Thank you!

I thought that adding the blocking rule from 192.168.2.0 to 192.168.2.0 would stop VMs from reaching each others.

Ofcorse not...
Firewall Works on Layer 3 and effectively Layer 4 ...
In order to handle Layer 2 traffic you should either work with bridge filter or switch rules ( if the device used supports them ) ...

So a host on network 192.168.2.0/xy when communicating with another host in the 192.168.2.0/xy won't even go through the firewall ...

I thought that adding the blocking rule from 192.168.2.0 to 192.168.2.0 would stop VMs from reaching each others.

Ofcorse not...
Firewall Works on Layer 3 and effectively Layer 4 ...
In order to handle Layer 2 traffic you should either work with bridge filter or switch rules ( if the device used supports them ) ...

So a host on network 192.168.2.0/xy when communicating with another host in the 192.168.2.0/xy won't even go through the firewall ...

Thank you, I didn’t know that. So I guess that the only working rules regard the reachability of 192.168.1.1 and 192.168.2.1. VMs at the moment can’t reach each other, which is what I wanted but I suppose that it’s because they are on different port groups (in the same vswitch), right?

No...
If you drop the traffic from 192.168.2.0/24 to 192.168.1.0/24, it will work because it goes through the routing engine first, so as said before, the firewall can block Layer 3 traffic ...