The official Mikrotik router thread

[nad_isa]

Oh right I’m with you now.

Unlikely to find a single unit that does both.

Maybe need to buy two to cover both areas. 48V ones are quite rare to start with.

yes im going to need 2. I already have 1 powering the ONT (12v). Its the gizzu dual dc and can only output 12v.

so i think my best bet is to then sell this one and get 12 units. one for 48v poe and another for 24v dc.

a schlep but will see if i can flog it to my tenant.

 

[nad_isa]

How does your filter rules tab look?

just the one rule to drop connections from 2nd subnet (tenant) to the 1st subnet (my main network).

 

[Peon]

just the one rule to drop connections from 2nd subnet (tenant) to the 1st subnet (my main network).

View attachment 1317376

Go here (https://www.grc.com/shieldsup) and post the picture of the result. Blank out your WAN IP in paint.

 

[nad_isa]

Go here (https://www.grc.com/shieldsup) and post the picture of the result. Blank out your WAN IP in paint.

this?

 

[Peon]

View attachment 1317414

And choose all service ports option.

 

[nad_isa]

And choose all service ports option.

GRC Port Authority Report created on UTC: 2022-05-29 at 17:54:13

Results from scan of ports: 0-1055

4 Ports Open
1052 Ports Closed
0 Ports Stealth
---------------------
1056 Ports Tested

NO PORTS were found to be STEALTH.

Ports found to be OPEN were: 21, 22, 23, 80

Other than what is listed above, all ports are CLOSED.

TruStealth: FAILED - NOT all tested ports were STEALTH,
- NO unsolicited packets were received,
- A PING REPLY (ICMP Echo) WAS RECEIVED.

 

[PsyWulf]

Oof,thats problematic

 

[nad_isa]

Oof,thats problematic

Are you referring to the open ports? Or anything else. Any tips to secure the router?

I did do a new configuration with no defaults.

 

[Leno]

Are you referring to the open ports? Or anything else. Any tips to secure the router?

I did do a new configuration with no defaults.

Any reason not to use the default config? the default filter rules are pretty good, by default incoming is blocked and include rules to block invalid packetc etc

 

[nad_isa]

Any reason not to use the default config? the default filter rules are pretty good, by default incoming is blocked and include rules to block invalid packetc etc

No particular reason. Likely due to a tutorial I was following at the time. I'm sure I can add those rules afterwards?

Not sure I want to go through the entire setup again..

 

[Leno]

No particular reason. Likely due to a tutorial I was following at the time. I'm sure I can add those rules afterwards?

Not sure I want to go through the entire setup again..

Think I found them on the mikrotik forum

NB make sure your lan interfaces (bridge 1 & 2 in your case) are added to the LAN interface list or you will be locked out, and your isp interface is added to the WAN interface list

Enable safe mode on the router while changing these so that if it locks you out you can just reboot the router to undo the changes, remember to turn safe mode off to save once its working

/ip firewall filter
add chain=input action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
add chain=input action=drop connection-state=invalid comment="defconf: drop invalid"
add chain=input action=accept protocol=icmp comment="defconf: accept ICMP"
add chain=input action=accept dst-address=127.0.0.1 comment="defconf: accept to local loopback (for CAPsMAN)"
add chain=input action=drop in-interface-list=!LAN comment="defconf: drop all not coming from LAN"
add chain=forward action=accept ipsec-policy=in,ipsec comment="defconf: accept in ipsec policy"
add chain=forward action=accept ipsec-policy=out,ipsec comment="defconf: accept out ipsec policy"
add chain=forward action=fasttrack-connection connection-state=established,related comment="defconf: fasttrack"
add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related, untracked"
add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid"
add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN comment="defconf: drop all from WAN not DSTNATed"

Buying - RB1100AHx4 Dude Edition - Questions about Firewall

search tag # rextended default firewall rules WARNING: default WAN and LAN interface list must be defined WARNING: if you do not know what you are doing, you probably lose control of your device MikroTik RouterOS 6.49.19 default firewall rules (fixed for reflect new 7.x rules change) for...

forum.mikrotik.com

 

[nad_isa]

Think I found them on the mikrotik forum

NB make sure your lan interfaces (bridge 1 & 2 in your case) are added to the LAN interface list or you will be locked out, and your isp interface is added to the WAN interface list

Enable safe mode on the router while changing these so that if it locks you out you can just reboot the router to undo the changes, remember to turn safe mode off to save once its working

Buying - RB1100AHx4 Dude Edition - Questions about Firewall

search tag # rextended default firewall rules WARNING: default WAN and LAN interface list must be defined WARNING: if you do not know what you are doing, you probably lose control of your device MikroTik RouterOS 6.49.19 default firewall rules (fixed for reflect new 7.x rules change) for...

forum.mikrotik.com

thanks! will do so.

I disabled port 21,22,23 (SSH, Telnet, ftp) from IP services. i saw logon failures from unknown ip's via telnet.

 

[nad_isa]

Think I found them on the mikrotik forum

NB make sure your lan interfaces (bridge 1 & 2 in your case) are added to the LAN interface list or you will be locked out, and your isp interface is added to the WAN interface list

Enable safe mode on the router while changing these so that if it locks you out you can just reboot the router to undo the changes, remember to turn safe mode off to save once its working

Buying - RB1100AHx4 Dude Edition - Questions about Firewall

search tag # rextended default firewall rules WARNING: default WAN and LAN interface list must be defined WARNING: if you do not know what you are doing, you probably lose control of your device MikroTik RouterOS 6.49.19 default firewall rules (fixed for reflect new 7.x rules change) for...

forum.mikrotik.com

Where do i do this "NB make sure your lan interfaces (bridge 1 & 2 in your case) are added to the LAN interface list or you will be locked out, and your isp interface is added to the WAN interface list"

 

[Peon]

Nadisa, you need to essentially create your firewall rules until that simple test passes, all green blocks. Your Winbox service you need to allow access only from your LAN IP range.

The admin user account. Create another user account and grant it full or admin access then disable the old standard admin account. This new user account also should be specified to only login from local LAN IP range.

It looks like you wanting to learn so keep at it until those tests pass.

 

[nad_isa]

Nadisa, you need to essentially create your firewall rules until that simple test passes, all green blocks. Your Winbox service you need to allow access only from your LAN IP range.

The admin user account. Create another user account and grant it full or admin access then disable the old standard admin account. This new user account also should be specified to only login from local LAN IP range.

It looks like you wanting to learn so keep at it until those tests pass.

okay will do some more reading...

so the blue blocks are not good? will do some more reading on getting them to green.

 

[PsyWulf]

Are you referring to the open ports?

Literally every dangerous port open

 

[nad_isa]

Literally every dangerous port open

Im trying...as per later post i closed port 21,22,23... working on figuring out the rest.

like i said im new to this and hence me asking and appreciating all the help

 

[nad_isa]

Nadisa, you need to essentially create your firewall rules until that simple test passes, all green blocks. Your Winbox service you need to allow access only from your LAN IP range.

The admin user account. Create another user account and grant it full or admin access then disable the old standard admin account. This new user account also should be specified to only login from local LAN IP range.

It looks like you wanting to learn so keep at it until those tests pass.

Winbox port allowed from local ip range - done
new user added with full access, default admin user removed - allowed from local IP range.

now to do some more reading on securing more for those tests..

 

[Peon]

Just for now, all the other services I would disable also. Just for now. Just leave Winbox enabled.

 

[nad_isa]

Just for now, all the other services I would disable also. Just for now. Just leave Winbox enabled.

okay. will do. the below is current list. wont internet stop working if i disable port 80?