Firewall Problem

DavidGB · Fri Nov 27, 2020 11:53 am

Hi!,

I have a problem with a dst NAT. I work with MQTT protocol inside and ouside of my network and integrating alexa devices in my server. When I open dst.nat with "In interface:WAN" only work MQTT devices in my network and alexa deviecs and when i remove "In interface: WAN" only works MQTT devices (inside and outside of my network, but not alexa)
Other problem is that sometimes i lose internet conection and i don´t know if the problem is my router configuration or my isp conection. I have isp router in bridge mode.

Can you see my configuration please??

Thanks so much!!

# model = RB4011iGS+
/interface bridge
add comment=Red_LAN_Cable name=LAN_Ppal
/interface ethernet
set [ find default-name=ether1 ] comment=Proveedor_ISP name=WAN
set [ find default-name=ether2 ] comment=Switch
/interface vlan
add interface=WAN name=MasMovil vlan-id=20
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/ip pool
add name=Red_LAN_Ppal ranges=192.168.2.20-192.168.2.150
add name=Pool_VPN_Admin ranges=10.0.0.20-10.0.0.100
add name=Pool_VPN_User ranges=10.0.0.102-10.0.0.200
add name=Red_LAN_2 ranges=192.168.3.20-192.168.3.150
add name=dhcp_pool4 ranges=192.168.2.2-192.168.2.254
add name=dhcp_pool5 ranges=192.168.3.2-192.168.3.254
/ip dhcp-server
add address-pool=Red_LAN_Ppal disabled=no interface=LAN_Ppal name=Red_LAN_Ppal
/ppp profile
set *0 dns-server=8.8.8.8,8.8.4.4
add change-tcp-mss=yes local-address=10.0.0.1 name=PerfilAdmin remote-address=\
    Pool_VPN_Admin use-encryption=yes
add change-tcp-mss=yes dns-server=8.8.8.8,8.8.4.4 local-address=10.0.0.1 name=\
    PerfilUser remote-address=Pool_VPN_User use-encryption=yes
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0 name=MonitoreoLM
/interface bridge port
add bridge=LAN_Ppal interface=ether2
add bridge=LAN_Ppal interface=ether5
/interface detect-internet
set detect-interface-list=all
/interface l2tp-server server
set authentication=mschap2 enabled=yes use-ipsec=required
/interface pptp-server server
set enabled=yes
/ip address
add address=192.168.2.1/24 comment=Red_LAN_Ppal interface=LAN_Ppal network=\
    192.168.2.0
add address=192.168.3.1/24 comment=Red_LAN_2 interface=ether5 network=\
    192.168.3.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=MasMovil
/ip dhcp-server lease
add address=192.168.2.11 client-id=1:b8:ac:6f:9d:62:d6 comment="PC Estudio" \
    mac-address=B8:AC:6F:9D:62:D6 server=Red_LAN_Ppal
add address=192.168.2.225 client-id=1:cc:9e:a2:62:f2:cc comment="Alexa Yoga" \
    mac-address=CC:9E:A2:62:F2:CC server=Red_LAN_Ppal
add address=192.168.2.222 comment="Alexa Estudio" mac-address=14:91:38:F3:DF:F0 \
    server=Red_LAN_Ppal
add address=192.168.2.221 client-id=1:44:0:49:4d:e4:ab comment="Alexa Salon" \
    mac-address=44:00:49:4D:E4:AB server=Red_LAN_Ppal
add address=192.168.2.224 client-id=1:5c:41:5a:93:bd:85 comment="Alexa Cocina" \
    mac-address=5C:41:5A:93:BD:85 server=Red_LAN_Ppal
add address=192.168.2.13 client-id=1:44:85:0:30:1e:61 mac-address=\
    44:85:00:30:1E:61 server=Red_LAN_Ppal
add address=192.168.2.12 client-id=1:a8:9c:ed:cd:f8:12 comment="Movil David" \
    mac-address=A8:9C:ED:CD:F8:12 server=Red_LAN_Ppal
add address=192.168.2.231 comment="Xiaomi Vacuum" mac-address=40:31:3C:A2:E3:3B \
    server=Red_LAN_Ppal
/ip dhcp-server network
add address=192.168.2.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.2.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip firewall address-list
add address=10.0.0.20-10.0.0.100 list=Src_Administradores
add address=192.168.2.20-192.168.2.255 list=Src_Red_LAN
add address=192.168.2.201 list=Dst_Servidores_Usuarios
add address=192.168.2.204 list=Dst_Servidores_Usuarios
add address=192.168.2.205 list=Dst_Servidores_Usuarios
add address=192.168.2.10-192.168.2.20 list=Src_Administradores
add address=10.10.0.200 list=Src_AdministracionClientes
add address=10.10.0.0/20 list=Dst_Clientes
add address=10.10.1.12 list=Src_Administradores
add address=10.10.1.13 list=Src_Administradores
add address=10.0.0.102-10.0.0.200 list=Src_Servidores_Usuarios
add address=192.168.2.108/31 disabled=yes list=Src_Red_LAN_interno
add address=192.168.2.10-192.168.2.255 list=Dst_Red_LAN
/ip firewall filter
add action=tarpit chain=input comment="##### Filtra IPs en Lista Negra #####" \
    protocol=tcp src-address-list="BLACKLIST TARPIT"
add action=add-src-to-address-list address-list="BLACKLIST TARPIT" \
    address-list-timeout=1m chain=input src-address-list=BLACKLIST
add action=drop chain=input log=yes log-prefix="DROP BlackList" \
    src-address-list=BLACKLIST
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward connection-state=\
    established,related
add action=accept chain=forward comment=\
    "##### Permite el trafico establecido y relacionado #####" \
    connection-state=established,related
add action=accept chain=output connection-state=established,related
add action=accept chain=input connection-state=established,related
add action=drop chain=forward comment="##### Filtra Paquetes Invalidos #####" \
    connection-state=invalid log=yes log-prefix="DROP Invalid Packets"
add action=drop chain=input connection-state=invalid log=yes log-prefix=\
    "DROP Invalid In Packets"
add action=accept chain=forward comment="##### Prermite trafico Forward #####" \
    src-address-list=Src_Administradores
add action=accept chain=forward src-address-list=Src_Red_LAN
add action=accept chain=forward disabled=yes src-address-list=\
    Src_Red_LAN_interno
add action=accept chain=forward disabled=yes dst-address-list=Dst_Red_LAN \
    src-address-list=Src_Red_LAN_interno
add action=accept chain=forward dst-address-list=Dst_Servidores_Usuarios \
    src-address-list=Src_Servidores_Usuarios
add action=accept chain=forward dst-address-list=Dst_Clientes src-address-list=\
    Src_AdministracionClientes
add action=accept chain=input comment=\
    "##### Prermite trafico Input ##### - Conexiones PPTP" dst-port=1723 \
    protocol=tcp
add action=add-src-to-address-list address-list=Src_TocToc_Temporal \
    address-list-timeout=1m chain=input comment=\
    "##### Prermite trafico Input ##### - TocToc" dst-port=5000 protocol=tcp
add action=add-src-to-address-list address-list=Src_TocToc_NAS \
    address-list-timeout=1d chain=input dst-port=7000 protocol=tcp \
    src-address-list=Src_TocToc_Temporal
add action=add-src-to-address-list address-list=Src_TocToc_LM_NAS \
    address-list-timeout=5d chain=input dst-port=8000 protocol=tcp \
    src-address-list=Src_TocToc_Temporal
add action=accept chain=input comment=\
    "##### Prermite trafico Input ##### - Conexiones L2TP" dst-port=\
    1701,500,4500 protocol=udp
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=input protocol=ipsec-ah
add action=accept chain=input comment="##### Prermite trafico Input ##### " \
    src-address-list=Src_Administradores
add action=accept chain=input comment=\
    "##### Prermite trafico Input #####  Para comunicacion SNMP" dst-port=161 \
    protocol=udp src-address=192.168.2.205
add action=drop chain=input comment="##### BLOQUEO POR DEFECTO #####" \
    log-prefix="INPUT DROP"
add action=drop chain=forward connection-nat-state=!dstnat in-interface=WAN \
    log=yes log-prefix="FORWARD DROP"
/ip firewall nat
add action=dst-nat chain=dstnat comment="CONTROL TOUCH" dst-port=2199 log=yes \
    log-prefix="Conexion CT" protocol=tcp to-addresses=192.168.2.204 to-ports=\
    2199
add action=dst-nat chain=dstnat comment="xxx Conexion Web (IMP. Dst type adress \
    local para que funcionen las paginas con puerto 80)" dst-address-type=local \
    dst-port=80 log=yes log-prefix="Conexi\F3n_Web" protocol=tcp to-addresses=\
    192.168.2.202 to-ports=80
add action=dst-nat chain=dstnat dst-address-type=local dst-port=443 log=yes \
    log-prefix="Conexion Web" protocol=tcp to-addresses=192.168.2.202 to-ports=\
    443
add action=dst-nat chain=dstnat comment="xxx Nextcloud" disabled=yes dst-port=\
    52300 protocol=tcp to-addresses=192.168.2.202 to-ports=52300
add action=dst-nat chain=dstnat comment=\
    "MQTT - Si pongo In Interface (WAN) no funciona MQTT de aitas" dst-port=\
    1883 log-prefix="Conexion MQTT" protocol=tcp to-addresses=192.168.2.205 \
    to-ports=1883
add action=dst-nat chain=dstnat comment="Conexion NAS" dst-port=52151 log=yes \
    log-prefix="Conexion NAS" protocol=tcp src-address-list=Src_TocToc_LM_NAS \
    to-addresses=192.168.2.201 to-ports=52151
add action=dst-nat chain=dstnat comment="xxx Conexion NAS" disabled=yes \
    dst-port=52151 log=yes log-prefix="Conexion NAS" protocol=tcp to-addresses=\
    192.168.2.201 to-ports=52151
add action=dst-nat chain=dstnat comment="xxx Conexion Plex" dst-port=32400 log=\
    yes log-prefix="Conexion Plex" protocol=tcp to-addresses=192.168.2.201 \
    to-ports=32400
add action=dst-nat chain=dstnat comment="Conexion LM" dst-port=52200 log=yes \
    log-prefix="Conexi\EF\BF\BDn NAS" protocol=tcp src-address-list=\
    Src_TocToc_LM_NAS to-addresses=192.168.2.205 to-ports=80
add action=dst-nat chain=dstnat comment="Conexion LM" dst-port=52201 log=yes \
    log-prefix="Conexi\EF\BF\BDn NAS" protocol=tcp src-address-list=\
    Src_TocToc_LM_NAS to-addresses=192.168.2.245 to-ports=80
add action=dst-nat chain=dstnat comment="Juego Android" disabled=yes dst-port=\
    43210 log=yes log-prefix="Juego Android" protocol=udp to-addresses=\
    192.168.2.12 to-ports=43210
add action=dst-nat chain=dstnat comment="xxx Conexion LM Cliente 2" disabled=\
    yes dst-port=52002 log-prefix=PROBANDO protocol=tcp to-addresses=\
    10.10.1.201 to-ports=80
add action=dst-nat chain=dstnat comment="xxx Conexion LM Cliente 1" disabled=\
    yes dst-port=52001 log=yes log-prefix=PROBANDO protocol=tcp to-addresses=\
    10.10.1.200 to-ports=80
add action=masquerade chain=srcnat comment="Para hacer LoopBack y que no se romp\
    a la consxion si accedemos desde dentro" dst-address=192.168.2.201 \
    dst-port=52151 out-interface=LAN_Ppal protocol=tcp src-address=\
    192.168.2.0/24
add action=masquerade chain=srcnat dst-address=192.168.2.205 dst-port=80 \
    out-interface=LAN_Ppal protocol=tcp src-address=192.168.2.12
add action=masquerade chain=srcnat dst-address=192.168.2.202 dst-port=80 \
    out-interface=LAN_Ppal protocol=tcp src-address=192.168.2.0/24
add action=masquerade chain=srcnat dst-address=192.168.2.202 dst-port=443 \
    out-interface=LAN_Ppal protocol=tcp src-address=192.168.2.0/24
add action=masquerade chain=srcnat comment="Loopback para pruebas con MQTT" \
    disabled=yes dst-address=192.168.2.201 dst-port=1883 out-interface=LAN_Ppal \
    protocol=tcp src-address=192.168.2.0/24
add action=masquerade chain=srcnat comment="Enmascarar hacia internet VPN" \
    disabled=yes dst-port="" out-interface=WAN protocol=tcp src-address-list=\
    Src_Administradores
add action=dst-nat chain=dstnat comment="Conexion NAS" dst-port=52150 log=yes \
    log-prefix="Conexion NAS" protocol=tcp src-address-list=Src_TocToc_LM_NAS \
    to-addresses=192.168.2.201 to-ports=52150
add action=masquerade chain=srcnat out-interface=MasMovil
/ip firewall service-port
set ftp disabled=yes
set sip disabled=yes
/ip route
add comment="Ruta Hacia Red Txirrita" distance=1 dst-address=10.10.1.0/24 \
    gateway=10.10.1.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox port=8299
set api-ssl disabled=yes
/ppp secret
add name=David profile=PerfilAdmin
add name=Usuario profile=PerfilUser
add local-address=10.10.0.1 name=Txirrita remote-address=10.10.1.1 service=pptp
add local-address=10.10.0.1 name=AdministradorClientes remote-address=\
    10.10.0.200 service=pptp
/snmp
set enabled=yes
/system clock
set time-zone-name=Europe/Madrid
/system logging
add topics=pptp,debug

DavidGB · Mon Dec 28, 2020 12:03 pm

Hi,

I´ve solved MQTT problem changing dst port.
But I have the same problem with internet connection. A lot of times I lose internet connection, I try doing ping to 8.8.8.8, or google.com from Mikrotik and it doesn't response.
If I reboot Masmovil Router (that is configured in bridge mode) it works again. I don't know if the problem is from ISP or from my Mikrotik configuration. They don't help me becaouse the router is configured as bridge.

Can you help me please?

Thanks so much

anav · Mon Dec 28, 2020 3:09 pm

Yeah your problem is your bridge setup.
For instance you have the bridge giving out DHCP, and have ether5 with its own DHCP and yet you stuck ether5 on the bridge.............

I also dont quite follow the administrators on 10.xx.xxx.xx network when its never defined??
I would drop tarpit rules
I would ensure that I listed my rules so that input are together and forward chain rules are together for ease of config reading and less prone to errors
Never have seen the output chain used ???? add action=accept chain=output connection-state=established,related

Dont understand what you are doing with sourcenat and destination nat rules...........
Overall very messy and hard to understand.

Perhaps it all has to do with the VPN you are using??
I would get rid of vpn and all the rules and start with the default set of rules and build back up from there.

Hopefully someone else can chime in with some better targetted responses in case, its only a few things or one thing and the rest of the setup is legit.

DavidGB · Mon Dec 28, 2020 6:10 pm

Hi! Thanks for response.

I have some questions (I have little experience with mikrotik)
I can´t see dhcp server in ether5. In dhcp server i have configured "LAN_Ppal" Bridge with ports 2-6. Where can you see ether5 dhcp? I have an acces point in ether5.
10.xx.xx.xxx is VPN network. I have 2 pool defined as VPN_Admin and VPN_User. How should i define this network?
I dont understund what do you mean with "drop tarpit rules". I add tarpit rules to Blacklist and then i drop them. I put this rule by recommendation
With destination nat rules I access to my servers using "TocToc" for more security and with srcnat I access to those servers from LAN (using LoopBack)

Thanks for the patience

anav · Mon Dec 28, 2020 8:00 pm

You even have more pools then defined subnets, the entire config needs to be scratched and started anew.
The only reason you need VPN is to manage the router, and pptp is an insecure VPN method anyway not recommended.

DavidGB · Tue Dec 29, 2020 9:42 pm

Hi!! I´ve reset router to default factory and I´ve only create necesary rules and in right order.

I think now is Ok

# dec/29/2020 20:38:27 by RouterOS 6.44.5
# software id = E82L-C64C
#
# model = RB4011iGS+
/interface bridge
add comment=LAN_Ppal name=LAN_Ppal
/interface ethernet
set [ find default-name=ether1 ] comment=ISP
set [ find default-name=ether2 ] comment=Switch
set [ find default-name=ether3 ] comment=PC
set [ find default-name=ether5 ] comment=AP
set [ find default-name=ether6 ] comment=LM
set [ find default-name=ether7 ] disabled=yes
set [ find default-name=ether8 ] disabled=yes
set [ find default-name=ether9 ] disabled=yes
set [ find default-name=ether10 ] disabled=yes
set [ find default-name=sfp-sfpplus1 ] disabled=yes
/interface vlan
add interface=ether1 name=MasMovil vlan-id=20
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/interface list
add comment=defconf name=WAN
/ip pool
add name=DHCP_LAN_Ppal ranges=192.168.2.20-192.168.2.150
add name=Pool_VPN_Admin ranges=10.0.0.20-10.0.0.100
/ip dhcp-server
add address-pool=DHCP_LAN_Ppal disabled=no interface=LAN_Ppal name=DHCP_LAN_Ppal
/ppp profile
add change-tcp-mss=yes dns-server=8.8.8.8,8.8.4.4 local-address=10.0.0.1 name=PerfilAdmin remote-address=Pool_VPN_Admin use-encryption=yes
/interface bridge port
add bridge=LAN_Ppal interface=ether2
add bridge=LAN_Ppal interface=ether3
add bridge=LAN_Ppal interface=ether4
add bridge=LAN_Ppal interface=ether5
add bridge=LAN_Ppal interface=ether6
/ip neighbor discovery-settings
set discover-interface-list=none
/ip settings
set rp-filter=strict
/interface detect-internet
set detect-interface-list=all
/interface l2tp-server server
set authentication=mschap2 enabled=yes use-ipsec=required
/interface list member
add interface=MasMovil list=WAN
/ip address
add address=192.168.2.1/24 comment=LAN_Ppal interface=LAN_Ppal network=192.168.2.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=MasMovil
/ip dhcp-server lease
add address=192.168.2.225 client-id=1:cc:9e:a2:62:f2:cc comment="Alexa Yoga" mac-address=CC:9E:A2:62:F2:CC server=DHCP_LAN_Ppal
add address=192.168.2.222 comment="Alexa Estudio" mac-address=14:91:38:F3:DF:F0 server=DHCP_LAN_Ppal
add address=192.168.2.221 client-id=1:44:0:49:4d:e4:ab comment="Alexa Salon" mac-address=44:00:49:4D:E4:AB server=DHCP_LAN_Ppal
add address=192.168.2.224 client-id=1:5c:41:5a:93:bd:85 comment="Alexa Cocina" mac-address=5C:41:5A:93:BD:85 server=DHCP_LAN_Ppal
add address=192.168.2.13 client-id=1:44:85:0:30:1e:61 comment="PC Curro" mac-address=44:85:00:30:1E:61 server=DHCP_LAN_Ppal
add address=192.168.2.12 client-id=1:a8:9c:ed:cd:f8:12 comment="Movil David" mac-address=A8:9C:ED:CD:F8:12 server=DHCP_LAN_Ppal
add address=192.168.2.231 comment="Xiaomi Vacuum" mac-address=40:31:3C:A2:E3:3B server=DHCP_LAN_Ppal
add address=192.168.2.145 client-id=1:7c:d5:66:b8:e7:90 comment=Despertador mac-address=7C:D5:66:B8:E7:90 server=DHCP_LAN_Ppal
add address=192.168.2.232 client-id=1:e8:f2:e2:ab:ea:39 comment="TV Salon" mac-address=E8:F2:E2:AB:EA:39 server=DHCP_LAN_Ppal
/ip dhcp-server network
add address=192.168.2.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.2.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip firewall address-list
add address=0.0.0.0/8 list=Bogon
add address=10.0.0.0/8 list=Bogon
add address=100.64.0.0/10 list=Bogon
add address=127.0.0.0/8 list=Bogon
add address=169.254.0.0/16 list=Bogon
add address=172.16.0.0/12 list=Bogon
add address=192.0.0.0/24 list=Bogon
add address=192.0.2.0/24 list=Bogon
add address=192.168.0.0/16 list=Bogon
add address=198.18.0.0/15 list=Bogon
add address=198.51.100.0/24 list=Bogon
add address=203.0.113.0/24 list=Bogon
add address=240.0.0.0/4 list=Bogon
add address=10.0.0.20-10.0.0.100 list=Src_Administradores
add address=192.168.2.10-192.168.2.20 list=Src_Administradores
add address=192.168.2.205 list=Src_Administradores
add address=192.168.2.20-192.168.2.255 list=Src_Red_LAN
add address=192.168.2.201 list=Dst_Servidores_Usuarios
add address=192.168.2.204 list=Dst_Servidores_Usuarios
add address=192.168.2.205 list=Dst_Servidores_Usuarios
add address=192.168.2.10-192.168.2.255 list=Dst_Red_LAN
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=accept chain=input comment="defconf: accepr input from Src_Admin" src-address-list=Src_Administradores
add action=accept chain=input comment=L2TP dst-port=1701,500,4500 protocol=udp
add action=accept chain=input comment=L2TP protocol=ipsec-esp
add action=accept chain=input comment=L2TP protocol=ipsec-ah
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=add-src-to-address-list address-list=Src_TocToc_Temporal address-list-timeout=1m chain=input comment=TocToc dst-port=5000 protocol=tcp
add action=add-src-to-address-list address-list=Src_TocToc_LM address-list-timeout=5d chain=input comment=AccesoLM dst-port=7000 protocol=tcp src-address-list=Src_TocToc_Temporal
add action=add-src-to-address-list address-list=Src_TocToc_LM_NAS address-list-timeout=5d chain=input comment=AccesoLM_NAS dst-port=8000 protocol=tcp src-address-list=Src_TocToc_Temporal
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface=!LAN_Ppal
add action=accept chain=forward src-address-list=Src_Red_LAN
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward src-address-list=Src_Administradores
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="Drop Bogon Forward -> Ether1" in-interface-list=WAN src-address-list=Bogon
add action=drop chain=forward comment="defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=dst-nat chain=dstnat comment=DMZ disabled=yes in-interface=ether1 to-addresses=192.168.2.202
add action=dst-nat chain=dstnat comment="CONTROL TOUCH" dst-port=2199 in-interface=MasMovil log=yes log-prefix="Conexion CT" protocol=tcp to-addresses=192.168.2.204 to-ports=2199
add action=dst-nat chain=dstnat comment="xxx Conexion Web (IMP. Dst type adress local para que funcionen las paginas con puerto 80)" dst-address-type=local dst-port=80 log=yes log-prefix=Conexion_Web protocol=tcp to-addresses=192.168.2.202 to-ports=\
    80
add action=dst-nat chain=dstnat dst-address-type=local dst-port=443 log=yes log-prefix="Conexion Web" protocol=tcp to-addresses=192.168.2.202 to-ports=443
add action=dst-nat chain=dstnat comment=MQTT_ext dst-port=41883 log=yes log-prefix="Conexion MQTT" protocol=tcp to-addresses=192.168.2.205 to-ports=1883
add action=dst-nat chain=dstnat comment=NAS dst-port=52151 log=yes log-prefix="Conexion NAS" protocol=tcp src-address-list=Src_TocToc_LM_NAS to-addresses=192.168.2.201 to-ports=52151
add action=dst-nat chain=dstnat comment=Plex dst-port=32400 log=yes log-prefix="Conexion Plex" protocol=tcp to-addresses=192.168.2.201 to-ports=32400
add action=dst-nat chain=dstnat comment=LM dst-port=52200 log=yes log-prefix="Conexi\EF\BF\BDn NAS" protocol=tcp src-address-list=Src_TocToc_LM_NAS to-addresses=192.168.2.205 to-ports=80
add action=masquerade chain=srcnat comment="Para hacer LoopBack y que no se rompa la consxion si accedemos desde dentro" dst-address=192.168.2.201 dst-port=52151 out-interface=LAN_Ppal protocol=tcp src-address=192.168.2.0/24
add action=masquerade chain=srcnat dst-address=192.168.2.202 dst-port=80 out-interface=LAN_Ppal protocol=tcp src-address=192.168.2.0/24
add action=masquerade chain=srcnat dst-address=192.168.2.202 dst-port=443 out-interface=LAN_Ppal protocol=tcp src-address=192.168.2.0/24
add action=masquerade chain=srcnat dst-address=192.168.2.205 dst-port=80 out-interface=LAN_Ppal protocol=tcp src-address=192.168.2.12
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set winbox port=8299
set api-ssl disabled=yes
/ppp secret
add name=David profile=PerfilAdmin
/system clock
set time-zone-name=Europe/Madrid
/system ntp client
set primary-ntp=216.239.35.0 secondary-ntp=129.250.35.250
/system scheduler
add interval=15s name="Mikrotik Despierto" on-event="{\r\
    \n/tool fetch url=\"http://remote:AAaa1111@192.168.2.205/scada-remote\" http-data=\"m=json&r=grp&fn=write&alias=34/3/51&value=1\" http-method=post as-value output=user; \t \r\
    \n}" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=nov/16/2019 start-time=13:44:56
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=none
/tool mac-server ping
set enabled=no

anav · Wed Dec 30, 2020 2:50 pm

Not true!
what did you do with the default interface list that included WAN and LAN?? (???add comment=deconf name=LAN???)
/interface list
add comment=defconf name=WAN
/ip pool

I do not believe this is a standard setup?? I know mine is set to loose?
Cannot remember but there was a reason to use loose vice strict, but you probably have good reason.
/ip settings
set rp-filter=strict

For the interface list members, once you have added back in the default LAN setting you can complete this as well.
/interface list member
add interface=MasMovil list=WAN
add interface=LAN_Ppal list=LAN

[input chain]
I will be honest and do not understand what you are doing with all the address lists in the input chain near the bottom but if it works for your needs, super.
However, I think the one last rule in the input chain needs to change.
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface=!LAN_Ppal
Just think about it, you spend all this time defining who needs access to the router to configure the router ............ then you let everybody on the LAN access the router???
Much better is this.
add action=accept chain=input comment="Allow services to lan users" protocol=TCP/UDP port=53 in-interface-list=LAN (or whatever other service may be required for normal function)
add action=drop chain=input comment="drop all else" (all other traffic gets dropped)

[forward chain]
It is not clear to me what your intentions are by this first rule............. what is it that this address list DOES not have access too that they need such an open ended rule????
add action=accept chain=forward src-address-list=Src_Administradores

The next two rule can be modifed by the more simpler...........
add action=drop chain=forward comment="Drop Bogon Forward -> Ether1" in-interface-list=WAN src-address-list=Bogon
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=drop chain=forward comment="drop all else"

But since you are doing port forwarding, it needs a bit of work
add action=accept chain=forward comment="allow port forwarding" connection-nat-state=dstnat connection-state=new in-interface-list=WAN
add action=drop chain=forward comment="drop all else"

And since you have a drop all rule at the end don't forget to allow internet access
add action=accept chain=forward in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="allow port forwarding" connection-nat-state=dstnat connection-state=new in-interface-list=WAN
add action=drop chain=forward comment="drop all else"

DSTNAT etc.
Like I said, some of your dstnat rules seem fine, but when you get to moving stuff around internally, I get lost and I certainly get lost in your sourcnat rules.
If these rules work for you great!!

DavidGB · Wed Dec 30, 2020 5:25 pm

Thanks a lot!!!
I don't have much experience yet and I copy some other people's rules thinking they will work. I have perfectly understood everything you have explained to me, thank you very much for the comments.
I have already corrected everything.

The "Src_Administradores" list are devices that I personally use to access to my network (my PC, VPN and my phone). Do you think that rule is too open?

Thanks again!

Firewall Problem

Firewall Problem

Re: Firewall Problem

Re: Firewall Problem

Re: Firewall Problem

Re: Firewall Problem

Re: Firewall Problem

Re: Firewall Problem

Re: Firewall Problem