...
| Code Block | ||
|---|---|---|
| ||
/ip firewall filter add action=accept chain=input comment="default configuration" connection-state=established,related add action=accept chain=input src-address-list=allowed_to_router add action=accept chain=input protocol=icmp add action=drop chain=input /ip firewall address-list add address=192.168.88.2-192.168.88.254 list=allowed_to_router |
- IPv4 firewall for clients
Established/related packets are added to fasttrack for faster data throughput, firewall will work with new connections only;
drop invalid connection and log them with prefix invalid;
drop attempts to reach not public addresses from your local network, apply address-list=not_in_internet before, bridge1 is local network interface, log attempts with !public_from_LAN;
drop incoming packets that are not NATed, ether1 is public interface, log attempts with !NAT prefix;
drop incoming packets from Internet, which are not public IP addresses, ether1 is public interface, log attempts with prefix !public;
drop packets from LAN that does not have LAN IP, 192.168.88.0/24 is local network used subnet;
| Code Block | ||
|---|---|---|
| ||
/ip firewall filter |
...
add action=fasttrack-connection chain=forward comment=FastTrack connection-state=established,related |
...
add action=accept chain=forward comment="Established, Related" connection-state=established,related |
...
add action=drop chain=forward comment="Drop invalid" connection-state=invalid log=yes log-prefix=invalid |
...
add action=drop chain=forward comment="Drop tries to reach not public addresses from LAN" dst-address-list=not_in_internet in-interface=bridge1 log=yes log-prefix=!public_from_LAN out-interface=!bridge1 |
...
add action=drop chain=forward comment="Drop incoming packets that are not NATted" connection-nat-state=!dstnat connection-state=new in-interface=ether1 log=yes log-prefix=!NAT |
...
add action=drop chain=forward comment="Drop incoming from internet which is not public IP" in-interface=ether1 log=yes log-prefix=!public src-address-list=not_in_internet |
...
add action=drop chain=forward comment="Drop packets from LAN that do not have LAN IP" in-interface=bridge1 log=yes log-prefix=LAN_!LAN src-address=!192.168.88.0/24 |
| Code Block | ||
|---|---|---|
| ||
/ip firewall address-list |
...
add address=0.0.0.0/8 comment=RFC6890 list=not_in_internet |
...
add address=172.16.0.0/12 comment=RFC6890 list=not_in_internet |
...
add address=192.168.0.0/16 comment=RFC6890 list=not_in_internet |
...
add address=10.0.0.0/8 comment=RFC6890 list=not_in_internet |
...
add address=169.254.0.0/16 comment=RFC6890 list=not_in_internet |
...
add address=127.0.0.0/8 comment=RFC6890 list=not_in_internet |
...
add address=224.0.0.0/4 comment=Multicast list=not_in_internet |
...
add address=198.18.0.0/15 comment=RFC6890 list=not_in_internet |
...
add address=192.0.0.0/24 comment=RFC6890 list=not_in_internet |
...
add address=192.0.2.0/24 comment=RFC6890 list=not_in_internet |
...
add address=198.51.100.0/24 comment=RFC6890 list=not_in_internet |
...
add address=203.0.113.0/24 comment=RFC6890 list=not_in_internet |
...
add address=100.64.0.0/10 comment=RFC6890 list=not_in_internet |
...
add address=240.0.0.0/4 comment=RFC6890 list=not_in_internet |
...
add address=192.88.99.0/24 comment="6to4 relay Anycast [RFC 3068]" list=not_in_internet |
IPv6
Currently, IPv6 package is disabled by default. Please enable package with care, as RouterOS will not create any default firewall rules for IPv6 at the moment.
IPv6 ND
Disable IPv6 Neighbour Discovery
/ipv6 nd and set [find] disabled=yes
IPv6 firewall to a router
...