This is my first MikroTik configuration setup. I’m not sure I implemented everything right, especially the firewall. So I decided to post my configuration here and may be someone would suggest something to improve it before putting it into production My setup consists of 4 vlans:
1. 10.0.10.0/24 - vlan10-base
2. 10.0.20.0/24 - vlan20-cloud
3. 10.0.30.0/24 - vlan30-iot
4. 10.0.40.0/24 - vlan40-guests
vlan10-base, vlan20-cloud is used for home computers and smartphones
vlan30-iot - for IOT devices
vlan40-guests - for guests
vlan10-base, vlan30-iot, vlan40-guests should have direct access to the internet
vlan20-cloud should access the internet through the WireGuard tunnel only
Devices from vlan20-cloud should be able to access devices in vlan10-base
Devices from vlan10-base and vlan20-cloud should be able to access local resources of the Windows Server
Winbox access to the router should be limited to a few devices from vlan10-base and vlan20-cloud
The router should block accessing my vlans from the Windows Server
Each vlan should have a corresponding Wi-Fi
Wi-Fi clients of vlan30-iot and vlan40-guests should be isolated
The router security should be tightened up before putting into production
The router configuration:
Code: Select all
# 2023-11-03 11:48:21 by RouterOS 7.11.2
# software id =
#
# model = C53UiG+5HPaxD2HPaxD
# serial number =
/interface bridge
add admin-mac=48:A9:... auto-mac=no name=bridge protocol-mode=none \
vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name=ether1-wan
set [ find default-name=ether2 ] name=ether2-base
set [ find default-name=ether3 ] name=ether3-cloud
set [ find default-name=ether4 ] name=ether4-iot
set [ find default-name=ether5 ] name=ether5-guests
/interface wifiwave2
set [ find default-name=wifi1 ] channel.band=5ghz-ax .skip-dfs-channels=\
10min-cac configuration.mode=ap .ssid=WIFI-BASE disabled=no \
name=wifi1-base security.authentication-types=wpa2-psk,wpa3-psk
set [ find default-name=wifi2 ] channel.band=2ghz-ax .skip-dfs-channels=\
10min-cac configuration.mode=ap .ssid=WIFI-IOT \
datapath.client-isolation=yes disabled=no name=wifi2-iot \
security.authentication-types=wpa2-psk,wpa3-psk
add configuration.mode=ap .ssid=WIFI-CLOUD disabled=no mac-address=\
4A:A9:... master-interface=wifi1-base name=wifi3-cloud \
security.authentication-types=wpa2-psk,wpa3-psk
add configuration.mode=ap .ssid=WIFI-GUESTS datapath.client-isolation=yes disabled=\
no mac-address=4A:A9:... master-interface=wifi2-iot name=\
wifi4-guests security.authentication-types=wpa2-psk,wpa3-psk
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1-wan name=pppoe-out \
user="pppoe_user_name"
/interface wireguard
add listen-port={router_wireguard_port} mtu=1420 name=wireguard
/interface vlan
add interface=bridge name=vlan10-base vlan-id=10
add interface=bridge name=vlan20-cloud vlan-id=20
add interface=bridge name=vlan30-iot vlan-id=30
add interface=bridge name=vlan40-guests vlan-id=40
/interface list
add name=WAN
add name=LAN
/ip pool
add name=pool10-base ranges=10.0.10.2-10.0.10.254
add name=pool20-cloud ranges=10.0.20.2-10.0.20.254
add name=pool30-iot ranges=10.0.30.2-10.0.30.254
add name=pool40-guests ranges=10.0.40.2-10.0.40.254
/ip dhcp-server
add address-pool=pool10-base interface=vlan10-base name=dhcp10-base
add address-pool=pool20-cloud interface=vlan20-cloud name=dhcp20-cloud
add address-pool=pool30-iot interface=vlan30-iot name=dhcp30-iot
add address-pool=pool40-guests interface=vlan40-guests name=dhcp40-guests
/routing table
add fib name=cloud
/interface bridge port
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
interface=ether2-base pvid=10
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
interface=wifi1-base pvid=10
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
interface=ether3-cloud pvid=20
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
interface=wifi3-cloud pvid=20
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
interface=ether4-iot pvid=30
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
interface=wifi2-iot pvid=30
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
interface=ether5-guests pvid=40
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
interface=wifi4-guests pvid=40
/ip firewall connection tracking
set loose-tcp-tracking=no
/ip neighbor discovery-settings
set discover-interface-list=none
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridge tagged=bridge vlan-ids=10
add bridge=bridge tagged=bridge vlan-ids=20
add bridge=bridge tagged=bridge vlan-ids=30
add bridge=bridge tagged=bridge vlan-ids=40
/interface list member
add interface=pppoe-out list=WAN
add interface=wireguard list=WAN
add interface=vlan10-base list=LAN
add interface=vlan20-cloud list=LAN
add interface=vlan30-iot list=LAN
add interface=vlan40-guests list=LAN
/interface wireguard peers
add allowed-address=0.0.0.0/0 comment=Cloud endpoint-address={windows_server_public_ip} \
endpoint-port={windows_server_wireguard_port} interface=wireguard persistent-keepalive=25s \
public-key={public_key}
/ip address
add address=10.255.0.0 interface=wireguard network=10.255.0.0
add address=10.0.10.1/24 interface=vlan10-base network=10.0.10.0
add address=10.0.20.1/24 interface=vlan20-cloud network=10.0.20.0
add address=10.0.30.1/24 interface=vlan30-iot network=10.0.30.0
add address=10.0.40.1/24 interface=vlan40-guests network=10.0.40.0
/ip cloud
set update-time=no
/ip dhcp-server lease
add address=10.0.10.110 client-id=1:20:a5... comment="macOS" \
mac-address=20:A5:... server=dhcp10-base
add address=10.0.20.110 client-id=1:20:a5... comment="macOS" \
mac-address=20:A5:... server=dhcp20-cloud
/ip dhcp-server network
add address=10.0.10.0/24 dns-server=10.0.10.1 gateway=10.0.10.1
add address=10.0.20.0/24 dns-server=208.67.222.222,208.67.220.220 gateway=\
10.0.20.1
add address=10.0.30.0/24 dns-server=10.0.30.1 gateway=10.0.30.1
add address=10.0.40.0/24 dns-server=10.0.40.1 gateway=10.0.40.1
/ip dns
set allow-remote-requests=yes servers=208.67.222.222,208.67.220.220
/ip firewall address-list
add address=10.0.10.110 list=admins
add address=10.0.20.110 list=admins
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid log-prefix=-drop_invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="allow winbox for admins" dst-port=\
{winbox_port} in-interface-list=LAN protocol=tcp src-address-list=admins
add action=accept chain=input comment="allow DNS" dst-port=53 \
in-interface-list=LAN log-prefix=+accept_tcp_dns protocol=tcp
add action=accept chain=input comment="allow DNS" dst-port=53 \
in-interface-list=LAN log-prefix=+accept_udp_dns protocol=udp
add action=accept chain=input comment="allow DHCP discover?" dst-port=67 \
in-interface-list=LAN log=yes log-prefix=+accept_udp_dhcp_discover \
protocol=udp src-port=68
add action=accept chain=input comment="allow NetBIOS?" dst-port=137 \
in-interface-list=LAN log=yes log-prefix=+accept_udp_netbios protocol=udp \
src-port=137
add action=accept chain=input comment="macOS???" dst-port=5678 \
in-interface-list=LAN log=yes log-prefix=+accept_udp_5678 protocol=udp
add action=reject chain=input comment="for tracking LAN issues" \
in-interface-list=LAN log=yes log-prefix=-reject_LAN reject-with=\
icmp-admin-prohibited
add action=drop chain=input comment="drop all else" log=yes log-prefix=\
-drop_all_else
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid log-prefix=-drop_invalid
add action=accept chain=forward comment="allow internet traffic" \
in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=\
"allow traffic from vlan20-cloud to vlan10-base" in-interface=\
vlan20-cloud out-interface=vlan10-base
add action=accept chain=forward comment="allow port forwarding" \
connection-nat-state=dstnat
add action=reject chain=forward comment="for tracking LAN issues" \
in-interface-list=LAN log-prefix=-reject_LAN reject-with=\
icmp-admin-prohibited
add action=drop chain=forward comment="drop all else" log-prefix=\
-drop_all_else
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/ip route
add dst-address=0.0.0.0/0 gateway=wireguard routing-table=cloud
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes port={ssh_port}
set api disabled=yes
set winbox address=10.0.10.110/32,10.0.20.110/32 port={winbox_port}
set api-ssl disabled=yes
/ip ssh
set strong-crypto=yes
/ipv6 firewall filter
add action=drop chain=input comment="drop everything"
add action=drop chain=forward comment="drop everything"
/routing rule
add action=lookup-only-in-table dst-address=10.255.0.1/32 src-address=\
10.0.10.0/24 table=cloud
add action=lookup-only-in-table dst-address=10.0.10.0/24 src-address=\
10.0.20.0/24 table=main
add action=lookup-only-in-table dst-address={windows_server_public_ip} src-address=\
10.0.20.0/24 table=main
add action=lookup-only-in-table src-address=10.0.20.0/24 table=cloud
/system note
set show-at-login=no
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=none
/tool mac-server ping
set enabled=no
WireGuard configuration on Windows Server:
Code: Select all
[Interface]
PrivateKey = {private_key}
ListenPort = {server_port}
Address = 10.255.0.1/32
PostUp = powershell -command ". C:\WireGuard\PostUp.ps1"
[Peer]
PublicKey = {public_key}
AllowedIPs = 10.255.0.0/32
Any help would be appreciated
