Is my firewall safe?

steamy · Thu Oct 31, 2024 10:07 pm

I followed this guide for VLANs: viewtopic.php?t=143620
The firewall example in it is different from the firewall filters in the default config. I guess my question is, do I need any or all the stuff I've left out from the default?
All seems to be working so far.
Thanks for any input and thanks for all the forum support up to this point, including all involved with the guide sticky post I followed.
What I have so far:

# 2024-10-31 23:16:13 by RouterOS 7.16.1
# software id = 5Z7V-M9DI
#
# model = RB5009UG+S+
# serial number = x
/interface bridge
add name=BR1 protocol-mode=none vlan-filtering=yes
/interface wireguard
add listen-port=39898 mtu=1420 name=wg0
/interface vlan
add interface=BR1 name=BASE_VLAN vlan-id=99
add interface=BR1 name=home_VLAN vlan-id=11
add interface=BR1 name=printers_VLAN vlan-id=77
add interface=BR1 name=untrusted_VLAN vlan-id=22
add interface=BR1 name=work_VLAN vlan-id=88
/interface list
add name=WAN
add name=VLAN
add name=BASE
add name=WORK
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=home_POOL ranges=10.3.11.2-10.3.11.254
add name=untrusted_POOL ranges=10.3.22.2-10.3.22.254
add name=printers_POOL ranges=10.3.77.2-10.3.77.254
add name=work_POOL ranges=10.3.88.2-10.3.88.254
/ip dhcp-server
add address-pool=home_POOL interface=home_VLAN name=home_DHCP
add address-pool=untrusted_POOL interface=untrusted_VLAN name=untrusted_DHCP
add address-pool=printers_POOL interface=printers_VLAN name=printers_DHCP
add address-pool=work_POOL interface=work_VLAN name=work_DHCP
/interface bridge port
add bridge=BR1 frame-types=admit-only-vlan-tagged interface=ether2
add bridge=BR1 frame-types=admit-only-vlan-tagged interface=ether3
add bridge=BR1 frame-types=admit-only-vlan-tagged interface=ether4
add bridge=BR1 frame-types=admit-only-vlan-tagged interface=ether5
add bridge=BR1 frame-types=admit-only-vlan-tagged interface=ether6
add bridge=BR1 frame-types=admit-only-vlan-tagged interface=ether7
add bridge=BR1 frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=BASE
/interface bridge vlan
add bridge=BR1 tagged=BR1,ether2,ether3,ether4,ether5,ether6,ether7,sfp-sfpplus1 vlan-ids=11
add bridge=BR1 tagged=BR1,ether2,ether3,ether4,ether5,ether6,ether7,sfp-sfpplus1 vlan-ids=22
add bridge=BR1 tagged=BR1,ether2,ether3,ether4,ether5,ether6,ether7,sfp-sfpplus1 vlan-ids=77
add bridge=BR1 tagged=BR1,ether2,ether3,ether4,ether5,ether6,ether7,sfp-sfpplus1 vlan-ids=88
add bridge=BR1 tagged=BR1,ether2,ether3,ether4,ether5,ether6,ether7,sfp-sfpplus1 vlan-ids=99
/interface list member
add interface=ether1 list=WAN
add interface=BASE_VLAN list=VLAN
add interface=home_VLAN list=VLAN
add interface=untrusted_VLAN list=VLAN
add interface=printers_VLAN list=VLAN
add interface=work_VLAN list=VLAN
add interface=wg0 list=VLAN
add interface=BASE_VLAN list=BASE
add interface=work_VLAN list=WORK
/interface wireguard peers
add allowed-address=10.88.0.2/32 interface=wg0 name=x public-key="x"
/ip address
add address=10.3.0.1/24 interface=BASE_VLAN network=10.3.0.0
add address=10.3.11.1/24 interface=home_VLAN network=10.3.11.0
add address=10.3.22.1/24 interface=untrusted_VLAN network=10.3.22.0
add address=10.3.77.1/24 interface=printers_VLAN network=10.3.77.0
add address=10.3.88.1/24 interface=work_VLAN network=10.3.88.0
add address=10.88.0.1/24 interface=wg0 network=10.88.0.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=10.3.11.0/24 dns-server=10.3.0.1 gateway=10.3.11.1
add address=10.3.22.0/24 dns-server=10.3.0.1 gateway=10.3.22.1
add address=10.3.77.0/24 dns-server=10.3.0.1 gateway=10.3.77.1
add address=10.3.88.0/24 dns-server=10.3.0.1 gateway=10.3.88.1
/ip dns
set allow-remote-requests=yes mdns-repeat-ifaces=home_VLAN,printers_VLAN,work_VLAN,untrusted_VLAN,BASE_VLAN servers=9.9.9.9
/ip firewall filter
add action=accept chain=input comment="Allow Estab & Related" connection-state=established,related
add action=accept chain=input comment="Allow VLAN" in-interface-list=VLAN
add action=accept chain=input comment="Allow Base_Vlan Full Access" in-interface=BASE_VLAN
add action=accept chain=input comment="allow WireGuard" dst-port=39898 protocol=udp
add action=accept chain=input comment="allow WireGuard traffic" src-address=10.88.0.0/24
add action=accept chain=input comment="Allow wireguard wg0 Full Access" in-interface=wg0
add action=drop chain=input comment=Drop
add action=accept chain=forward comment="Allow Estab & Related" connection-state=established,related
add action=accept chain=forward comment="VLAN Internet Access only" connection-state=new in-interface-list=VLAN out-interface-list=WAN
add action=accept chain=forward comment="Allow printers_VLAN to be the Public VLAN" connection-state=new in-interface-list=VLAN out-interface=printers_VLAN
add action=accept chain=forward comment="Allow Wireguard wg0 in to VLANs" connection-state=new in-interface=wg0 out-interface-list=VLAN
add action=drop chain=forward comment=Drop
/ip firewall nat
add action=masquerade chain=srcnat comment="Default masquerade" out-interface-list=WAN
/system clock
set time-zone-name=America/New_York
/system identity
set name=hs-router
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=BASE
/tool mac-server mac-winbox
set allowed-interface-list=BASE

and the default config's filters:

/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" dst-port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN

anav · Thu Oct 31, 2024 10:22 pm

Clearly you didnt ---> I followed this guide for VLANs: viewtopic.php?t=143620
Just check out your /interface bridge port settings LOL

steamy · Thu Oct 31, 2024 10:54 pm

I did follow the guide. I just modified that section to make them access ports for testing and forgot to put it back. Thanks, I will correct that. Was anything else that obvious? The firewall?

Thanks for catching that. I'm going to switch it back and test some more to make sure it works as expected.

@anav I really appreciate you and your posts on other threads have helped. Sorry to be annoying and I understand how people like me on this forum could burn someone out, so.. Sorry about that,

steamy · Fri Nov 01, 2024 5:24 am

Okay I went through the guide again and left the /interface bridge port settings alone (all trunks, right?).
I changed IP ranges which I think is arbitrary. I've added Wireguard and the mdns reflector. If I've done poorly, I can take it. Know that I have tried.

I think whats most daunting to me is combining the default config's firewall rules/filters with what I have here. Particularly the order. I will try it.

I also edited the OP with my current export.

steamy · Fri Nov 01, 2024 6:03 am

Like this?

/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="Allow VLAN" in-interface-list=VLAN
add action=accept chain=input comment="Allow Base_Vlan Full Access" in-interface=BASE_VLAN
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="allow WireGuard" dst-port=39898 protocol=udp
add action=accept chain=input comment="allow WireGuard traffic" src-address=10.88.0.0/24
add action=accept chain=input comment="Allow wireguard wg0 Full Access" in-interface=wg0
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!VLAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=forward comment="VLAN Internet Access only" connection-state=new in-interface-list=VLAN out-interface-list=WAN
add action=accept chain=forward comment="Allow printers_VLAN to be the Public VLAN" connection-state=new in-interface-list=VLAN out-interface=printers_VLAN
add action=accept chain=forward comment="Allow Wireguard wg0 in to VLANs" connection-state=new in-interface=wg0 out-interface-list=VLAN
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" dst-port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from VLAN" in-interface-list=!VLAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from VLAN" in-interface-list=!VLAN

EDIT: I think this is not working right at all. I'd like printer_VLAN to be accessible from the others, but not the other way. I had it working, just not with the extra firewall filters from the default config.

EDIT 2: added "add chain=forward action=drop comment="Drop""

anav · Fri Nov 01, 2024 2:42 pm

/ip firewall address-list
add address=adminIP1-trustedsubnet/32 list=AUTHORIZED comment="admin device wired"
add address=adminIP2-trustedsubnet/32 list=AUTHORIZED comment="admin device wifi"
add address=wg0-IP1/32 list=AUTHORIZED comment="admin remote device1"
add address=wg0-IP2/32 list=AUTHORIZED comment="admin remote device2"
etc.

/ip firewall filter
( default rules to keep )
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input dst-address=127.0.0.1
( admin rules )
add action=accept chain=input comment="incoming WG handshake" dst-port=39898 protocol=udp
add action=accept chain=input comment="admin access" src-address-list=AUTHORIZED
add action=accept chain=input comment="users to services" in-interface-list=VLAN dst-port=53,123 protocol=udp
add action=accept chain=input comment="users to services" in-interface-list=VLAN dst-port=53 protocol=tcp
add action=drop chain=input comment="Drop all else" { add this last so as NOT to lock yourself out }
++++++++++++++++++++++++++++++++++++++++++++++
( default rules needed )
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec [ not needed if not doing ipsec vpn ]
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec [ not needed if not doing ipsec vpn ]
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
( admin rules )
add action=accept chain=forward comment="VLAN Internet Access only" connection-state=new in-interface-list=VLAN out-interface-list=WAN
add action=accept chain=forward comment="Allow access to printer" in-interface-list=VLAN dst-address=IPaddress-Printer
add action=accept chain=forward comment="Allow WG to VLAN" in-interface=wg0 out-interface-list=VLAN
add action=accept chain=forward comment="port forwarding" connection-nat-state=dstnat
add action=drop chain=forward comment="drop all else"

steamy · Fri Nov 01, 2024 4:58 pm

Thank you so much and especially adding the comments for context of what does what.

anav · Fri Nov 01, 2024 5:45 pm

The firewall address list entries with LAN subnet IPs, should be set statically via DHCP leases.

steamy · Sat Nov 02, 2024 12:19 am

Understood.

Is my firewall safe?

Is my firewall safe?

Re: Is my firewall safe?

Re: Is my firewall safe?

Re: Is my firewall safe?

Re: Is my firewall safe?

Re: Is my firewall safe?

Re: Is my firewall safe?

Re: Is my firewall safe?

Re: Is my firewall safe?