So i will be buying RB1100AHx4 Dude Edition https://mikrotik.com/product/RB1100Dx4 .
It is probably a bit overkill for my SOHO, but better safe than sorry and make sure it will last a few years ahead.
The thing I have been pondering the most is the ability to control the Firewall and I have read some of the relevant articles for this: https://help.mikrotik.com/docs/display/ ... t+Firewall but i am also curious as to if any of the community members have exported firewalls with pre defined rules one might look in to? Perhaps saving some work by using a tried and tested configuration?
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
Best thing is to accept the default firewalls as they work out of the box quite safely.
Then work to understand all the default rules.
Then state your requirements and folks will likely chime in to give some advice.
Do not use quickset.
Do use the safe mode button at all times.
Clear requirements with a network diagram = useful assistance.
Then work to understand all the default rules.
Then state your requirements and folks will likely chime in to give some advice.
Do not use quickset.
Do use the safe mode button at all times.
Clear requirements with a network diagram = useful assistance.
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
Best thing is to accept the default firewalls as they work out of the box quite safely.
SOHO-line of Mikrotik routers comes with very decent default firewall rule set. RB1100AHx4, however, is not from that line and comes with pretty plain defaults, hence it's wise to get some decent starting setttings elsewhere.
@SecCon: you can either wait for somebody to publish default settings and risk (probably low risk though) that it won't really be complete or not really MT default. Or you can get yourself cheapest possible MT device (that would likely be hEX lite with suggested price of $40) and use that both as playground and as trustworthy source of default settings.
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
search tag # rextended default firewall rules
WARNING: default WAN and LAN interface list must be already defined
WARNING: if you do not know what you are doing, you probably lose control of your device
The MikroTik RouterOS 6.46.8, 6.47.9 and 6.48.2 default firewall rules are:
for IPv4
for IPv6 is also created address-list bad_ipv6 before creating firewall rules
WARNING: default WAN and LAN interface list must be already defined
WARNING: if you do not know what you are doing, you probably lose control of your device
The MikroTik RouterOS 6.46.8, 6.47.9 and 6.48.2 default firewall rules are:
for IPv4
Code: Select all
/ip firewall filter
add chain=input action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
add chain=input action=drop connection-state=invalid comment="defconf: drop invalid"
add chain=input action=accept protocol=icmp comment="defconf: accept ICMP"
add chain=input action=accept dst-address=127.0.0.1 comment="defconf: accept to local loopback (for CAPsMAN)"
add chain=input action=drop in-interface-list=!LAN comment="defconf: drop all not coming from LAN"
add chain=forward action=accept ipsec-policy=in,ipsec comment="defconf: accept in ipsec policy"
add chain=forward action=accept ipsec-policy=out,ipsec comment="defconf: accept out ipsec policy"
add chain=forward action=fasttrack-connection connection-state=established,related comment="defconf: fasttrack"
add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related, untracked"
add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid"
add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN comment="defconf: drop all from WAN not DSTNATed"
for IPv6 is also created address-list bad_ipv6 before creating firewall rules
Code: Select all
/ipv6 firewall address-list
add list=bad_ipv6 address=::/128 comment="defconf: unspecified address"
add list=bad_ipv6 address=::1 comment="defconf: lo"
add list=bad_ipv6 address=fec0::/10 comment="defconf: site-local"
add list=bad_ipv6 address=::ffff:0:0/96 comment="defconf: ipv4-mapped"
add list=bad_ipv6 address=::/96 comment="defconf: ipv4 compat"
add list=bad_ipv6 address=100::/64 comment="defconf: discard only "
add list=bad_ipv6 address=2001:db8::/32 comment="defconf: documentation"
add list=bad_ipv6 address=2001:10::/28 comment="defconf: ORCHID"
add list=bad_ipv6 address=3ffe::/16 comment="defconf: 6bone"
add list=bad_ipv6 address=::224.0.0.0/100 comment="defconf: other"
add list=bad_ipv6 address=::127.0.0.0/104 comment="defconf: other"
add list=bad_ipv6 address=::/104 comment="defconf: other"
add list=bad_ipv6 address=::255.0.0.0/104 comment="defconf: other"
/ipv6 firewall filter
add chain=input action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
add chain=input action=drop connection-state=invalid comment="defconf: drop invalid"
add chain=input action=accept protocol=icmpv6 comment="defconf: accept ICMPv6"
add chain=input action=accept protocol=udp dst-port=33434-33534 comment="defconf: accept UDP traceroute"
add chain=input action=accept protocol=udp dst-port=546 src-address=fe80::/10 comment="defconf: accept DHCPv6-Client prefix delegation."
add chain=input action=accept protocol=udp dst-port=500,4500 comment="defconf: accept IKE"
add chain=input action=accept protocol=ipsec-ah comment="defconf: accept ipsec AH"
add chain=input action=accept protocol=ipsec-esp comment="defconf: accept ipsec ESP"
add chain=input action=accept ipsec-policy=in,ipsec comment="defconf: accept all that matches ipsec policy"
add chain=input action=drop in-interface-list=!LAN comment="defconf: drop everything else not coming from LAN"
add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid"
add chain=forward action=drop src-address-list=bad_ipv6 comment="defconf: drop packets with bad src ipv6"
add chain=forward action=drop dst-address-list=bad_ipv6 comment="defconf: drop packets with bad dst ipv6"
add chain=forward action=drop protocol=icmpv6 hop-limit=equal:1 comment="defconf: rfc4890 drop hop-limit=1"
add chain=forward action=accept protocol=icmpv6 comment="defconf: accept ICMPv6"
add chain=forward action=accept protocol=139 comment="defconf: accept HIP"
add chain=forward action=accept protocol=udp dst-port=500,4500 comment="defconf: accept IKE"
add chain=forward action=accept protocol=ipsec-ah comment="defconf: accept ipsec AH"
add chain=forward action=accept protocol=ipsec-esp comment="defconf: accept ipsec ESP"
add chain=forward action=accept ipsec-policy=in,ipsec comment="defconf: accept all that matches ipsec policy"
add chain=forward action=drop in-interface-list=!LAN comment="defconf: drop everything else not coming from LAN"
Last edited by rextended on Sun Jun 23, 2024 3:47 am, edited 14 times in total.
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
I would accept the default of course but i guess there is room for improvement if you know your network and what can be blocked/allowed.Best thing is to accept the default firewalls as they work out of the box quite safely.
Then work to understand all the default rules.
Then state your requirements and folks will likely chime in to give some advice.
Do not use quickset.
Do use the safe mode button at all times.
Clear requirements with a network diagram = useful assistance.
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
What would be the SOHO line of routers in your opinion? Mikrotik sure doesn't list any...SOHO-line of Mikrotik routers comes with very decent default firewall rule set. RB1100AHx4, however, is not from that line and comes with pretty plain defaults, hence it's wise to get some decent starting setttings elsewhere.Best thing is to accept the default firewalls as they work out of the box quite safely.
@SecCon: you can either wait for somebody to publish default settings and risk (probably low risk though) that it won't really be complete or not really MT default. Or you can get yourself cheapest possible MT device (that would likely be hEX lite with suggested price of $40) and use that both as playground and as trustworthy source of default settings.
I have a Xeon server standing by for custom solutions and plenty of server power for virtual solutions that I can connect anyhow I like, but I am going with this for now.
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
BTW, also got this switch: https://mikrotik.com/product/CRS326-24G-2SplusRM
Weird this is at it apperas both as Router and as Switch on many shop sites... very confusing. Fortunately Mikrotik has it listed as "switch".
Delivery May 20.
Weird this is at it apperas both as Router and as Switch on many shop sites... very confusing. Fortunately Mikrotik has it listed as "switch".
Delivery May 20.
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
THe RB4011 would be the router of choice if looking at current or future 1gig ISP connections.
But not familiar with the 1100 that may be a step down in terms of number of ports and throughput
But not familiar with the 1100 that may be a step down in terms of number of ports and throughput
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
The CRS switches can run both SwOS and ROS. When running ROS they may be used as routers and/or switches: they will route packages, and have all the possibilities of a Mikrotik router.BTW, also got this switch: https://mikrotik.com/product/CRS326-24G-2SplusRM
Weird this is at it apperas both as Router and as Switch on many shop sites... very confusing. Fortunately Mikrotik has it listed as "switch".
Delivery May 20.
BUT
They have a VERY weak CPU. So, they would route - but quite slowly. This CRS326, as an example, can pass L2 traffic at wirespeed, in all ports at the same time. As a router it would barely get as high as 750Mbps.
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
The 1100AxH4 is just the 4011 with 3 switches, 13 gigabit ports and no SFP+. Same RAM, and I think one has 128MB of flash and the other 512MB. The 1100 Dude edition has two SATA ports.THe RB4011 would be the router of choice if looking at current or future 1gig ISP connections.
But not familiar with the 1100 that may be a step down in terms of number of ports and throughput
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
What would be the SOHO line of routers in your opinion?
All devices apart from: CHR, CRS line, CCR line, RB1100 line and possibly RB3011 (not sure about this one).
I'm not talking about SwOS devices here.
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
@mkx can you send me an email please.
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
I would certainly wish for that being clearly stated when looking at product purchase.The again, we look mostly at port speed, cpu power and ram when choosing I guess.All devices apart from: CHR, CRS line, CCR line, RB1100 line and possibly RB3011 (not sure about this one).
I'm not talking about SwOS devices here.
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
In any case, the more you can clearly define your current and likely future requirements the better advice can be provided.
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
where to? ;-)@mkx can you send me an email please.
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
The email address when you click on my icon.........
Just below where it says I am a Mikrotik slow learner! ;-)
Just below where it says I am a Mikrotik slow learner! ;-)
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
No kidding, one can actually click on icon? Who ever came up with that great idea must be a genious ;-)
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
and a genius!!
Normis je genije.
Normis je genije.
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
You meant to write "Normis ir ģēnijs"?
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
Mana kļūda, ko es pieņēmu horvātu valodā, ir tā, ka LOL ir slikta lieta
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
Are we having language lessons for the rats? :lol:
Re: Buying - RB1100AHx4 Dude Edition - Questions about Firewall
I think we're rather having fun with our favourite on-line translating tools.
Who is online
Users browsing this forum: No registered users and 12 guests