Mikrotik block and allow traffic flow

[Dirty Harry101]

Nope, as soon as I enable that drop rule, no internet,rdp etc etc

 

[Sarel0092]

Disconnect your router from the Internet and delete all the firewall filter and nat rules.

Once that is done run the below commands:
/ip firewall filter
add action=drop chain=input comment="Drop invalid connections on input" connection-state=invalid
add action=drop chain=forward comment="Drop invalid connections on forward" connection-state=invalid
add action=accept chain=input comment="Allow administrators to connect" src-address-list=local
add action=accept chain=input comment="Allow established connections" connection-state=established
add action=drop chain=input comment="Drop all inputs"
add action=accept chain=forward comment="Allow all new connections to the Internet, restricted to the local LAN" connection-state=new src-address-list=local
add action=accept chain=forward comment="Allow related connections" connection-state=related
add action=accept chain=forward comment="Allow established connections" connection-state=established
add action=drop chain=forward comment="Drop all forward"

/ip firewall nat
chain=srcnat action=masquerade out-interface=<wan/pppoe interface>

I would also recommend you disable the services you don't use, such as ftp, telnet, ssh, www, www-ssl, api and api-ssl
ip service disable 0,1,2,3,4,5,7

Also disable the service ports you aren't using, such as ftp, tftp, irc, h323, sip, pptp, udplite, dccp and sctp
ip firewall service-port disable 0,1,2,3,4,5,6,7,8

Once you have added the above mentioned rules connect your router to the Internet again and test if you get internet.

 

[Dirty Harry101]

I reset my router to default, applied these exact rules above, no internet. As soon as I disable the drop rule at the end, all works again.

 

[Dirty Harry101]

This is what I have now after the reset.

/ip firewall filter
add action=drop chain=input comment="Drop invalid connections on input" \
connection-state=invalid
add action=drop chain=forward comment="Drop invalid connections on forward" \
connection-state=invalid
add action=accept chain=input comment="Allow adminsitrators to connect" \
src-address-list=local
add action=accept chain=input comment="Allow established connections" \
connection-state=established
add action=drop chain=input comment="Drop all inputs"
add action=accept chain=forward comment=\
"Allow all new connections to the Internet, restricted to the local LAN" \
connection-state=new src-address-list=local
add action=accept chain=forward comment="Allow related connections" \
connection-state=related
add action=accept chain=input comment="Accept DNS - UDP" port=53 protocol=udp
add action=accept chain=input comment="Accept DNS - TCP" port=53 protocol=tcp
add action=accept chain=input dst-port=53 protocol=udp
add action=accept chain=input protocol=udp src-port=53
add action=accept chain=forward comment="Allow established connections" \
connection-state=established
add action=accept chain=output dst-port=4949 out-interface=ether8 protocol=tcp
add action=accept chain=output dst-port=3389 out-interface=ether8 protocol=tcp
add action=drop chain=forward comment="Drop all forward" disabled=yes

 

[Dirty Harry101]

I have also noticed, there is no traffic going through any of those rules added relating to the DNS and RDP.

 

[Dirty Harry101]

Ok, managed to get somewhere, I changed all the rdp and dns rules from input to forward.

 

[Sarel0092]

/ip firewall filter
add action=drop chain=input comment="Drop invalid connections on input" \
connection-state=invalid
add action=drop chain=forward comment="Drop invalid connections on forward" \
connection-state=invalid
add action=accept chain=input comment="Allow adminsitrators to connect" \
src-address-list=local
add action=accept chain=input comment="Allow established connections" \
connection-state=established
add action=drop chain=input comment="Drop all inputs"
add action=accept chain=forward comment=\
"Allow all new connections to the Internet, restricted to the local LAN" \
connection-state=new src-address-list=local
add action=accept chain=forward comment="Allow related connections" \
connection-state=related
add action=accept chain=input comment="Accept DNS - UDP" port=53 protocol=udp
add action=accept chain=input comment="Accept DNS - TCP" port=53 protocol=tcp
add action=accept chain=input dst-port=53 protocol=udp
add action=accept chain=input protocol=udp src-port=53
add action=accept chain=forward comment="Allow established connections" \
connection-state=established
add action=accept chain=output dst-port=4949 out-interface=ether8 protocol=tcp
add action=accept chain=output dst-port=3389 out-interface=ether8 protocol=tcp
add action=drop chain=forward comment="Drop all forward" disabled=yes

The problem with the above mentioned rules are that your rules aren't in order, you input accept rules for dns and rtp is below the input drop rule. It needs to be above the input drop rule.

/ip firewall filter
add action=drop chain=input comment="Drop invalid connections on input" \
connection-state=invalid
add action=drop chain=forward comment="Drop invalid connections on forward" \
connection-state=invalid
add action=accept chain=input comment="Allow adminsitrators to connect" \
src-address-list=local
add action=accept chain=input comment="Allow established connections" \
connection-state=established
add action=accept chain=input comment="Accept DNS - UDP" port=53 protocol=udp
add action=accept chain=input comment="Accept DNS - TCP" port=53 protocol=tcp
add action=accept chain=input dst-port=53 protocol=udp
add action=accept chain=input protocol=udp src-port=53
add action=drop chain=input comment="Drop all inputs"
add action=accept chain=forward comment=\
"Allow all new connections to the Internet, restricted to the local LAN" \
connection-state=new src-address-list=local
add action=accept chain=forward comment="Allow related connections" \
connection-state=related
add action=accept chain=forward comment="Allow established connections" \
connection-state=established
add action=accept chain=output dst-port=4949 out-interface=ether8 protocol=tcp
add action=accept chain=output dst-port=3389 out-interface=ether8 protocol=tcp
add action=drop chain=forward comment="Drop all forward" disabled=yes

What are you trying to do with the below rules?
add action=accept chain=output dst-port=4949 out-interface=ether8 protocol=tcp
add action=accept chain=output dst-port=3389 out-interface=ether8 protocol=tcp

 

[Dirty Harry101]

I didnt see that, just copied straight from the one above.
The last two was to make the out going connection, I keep on forgetting that its not in and out of the network, but the router.

Once I added the forward rules, most of it worked. will adjust and play again now

 

[mariyom]

Hi, I have this problem with trying to create a remote desktop connection to my local server in my office. I have configure all the necessary port forwarding NAT rule but still doesn't work. can someone please help me out. Thanks alot. I am using a mikrotik router.

 

[PsyWulf]

Do a dump of your nat rules

 

[mariyom]

Attached is a screen shot of my NAT rule., I can use RDP on my local network but not from any other network. I have deactivated firewall on the local server but still not working.Thanks alot

 

[PsyWulf]

Attached is a View attachment 598440screen shot of my NAT rule., I can use RDP on my local network but not from any other network. I have deactivated firewall on the local server but still not working.Thanks alot

Right,I checked on mine to confirm,your rule looks misconfigured
That destination IP looks strange for an Internal IP,but that section should be blank anyway

The actual magic happens on the Actions tab

 

[mariyom]

Ok i have removed the destination ip but it still doesn't work i replace the destination ip with my internal ip which is also on the to address, but it still doesn't work. Find screen shots attached.

 

[PsyWulf]

It's showing 2 packet hits,so it's doing something,it's likely something else is causing an issue returning traffic ( Gateway on the remote machine is the mikrotik? )