Mikrotik Firewall - Protecting the Router (Ep 2)

[@TheNetworkTrip]

Have you encountered any specific challenges or interesting use cases while configuring MikroTik firewalls? Share your experiences and insights with the community! 👇 Additionally, if you have any specific firewall topics you'd like us to cover in future videos, feel free to suggest them. We're here to help you learn and master MikroTik firewall configurations. Your input and questions are valuable to us! 🔥💻"

[@mikkio5371]

The order of processing looks like ACL or route map in cisco . Proccesing will continue until a satisfactory condition has been met . Thank you Mr Wilmar

[@TheNetworkTrip]

You got it! Same logic than ACLs in Cisco.

[@chris2pple1]

Very good explanation of the default MikrotikRouter firewall

[@TheNetworkTrip]

Thank you!

[@srh_btk]

Really useful lessons for refreshing my knowledge. Thank you, Wilmer.

[@TheNetworkTrip]

Glad to hear that!

[@JasonsLabVideos]

Good video sir !! thanks !!

[@TheNetworkTrip]

Thank you Jason!

[@rodneymoore465]

This is very properly explained thank you, I have a problem with the (drop everything else firewall) if you have customers with PPPoE connections and your routers goes off and on again it will block your PPPoE connections

[@TheNetworkTrip]

Hi! The PPPoE connections will be established without any problem.

[@luhu188]

very good! a chinese fans!

[@tallyharry3704]

I love you sir... Thank you so much..

[@TheNetworkTrip]

All the best

[@MrRobotDevelop]

great video... could you allow also dhcp requests from the clients or not needed?

[@TheNetworkTrip]

Hello! That’s not required. That traffic won’t be affected by the rules under filter.

[@Smoothy0911]

Hi and many thanks for this very interesting video series. I already had the point you mentioned at the end of the video in my head and was wondering how we can allow external access as "trusted"....? Because we cannot create a “trusted mac list”, similar to the “trusted IP list”, since the mac addresses cannot be recognized from outside access. I'm looking forward to the solution in the next video :)

[@TheNetworkTrip]

Thanks! It’s interesting how we can deal with that. The video is coming tomorrow 😀

[@TheNetworkTrip]

Video ready 😃: Port Knocking & Scanner Detection - Mikrotik Firewall Ep 3 kzbin.info/www/bejne/iqWoiaGnidh8Y7c

[@remixedMind]

thanks for all the videos, do you plan on making one for CAPsMAN

[@sebastiendeliedekerke5251]

Similar to what you recommend for DNS, if the router acts as DHCP server, should an accept rule also be added for DHCP requests received from the LAN?

[@TheNetworkTrip]

Hello! DHCP traffic won’t be affected by the rules under Filter.

[@aperson1181]

which router would you recommend for home use? What is a good authorized seller in the USA?

[@sergioantoniohernandezestr7728]

Hola @Wilmer Almazan hay alguna forma de implementar OSPF con PBR. Ahorita me funciona con ruteo estático. Pero me gustaría cambiarme a ruteo donamico.

[@TheNetworkTrip]

Hola! Sin problema. Solo coloque arriba de las reglas del PBR en el mangle una regla aceptando el trágico OSPF. Saludos!

[@mrraulmeneses]

Can I please get your opinion on these rules: /ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp add action=accept chain=input src-address-list=Local-LAN comment="Config Access" add action=accept chain=input comment=L2TP dst-port=500,1701,4500 \ in-interface-list=WAN protocol=udp add action=accept chain=input comment="IKE IPSec" in-interface-list=WAN \ protocol=ipsec-esp add action=drop chain=input comment="drop all else" add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid add action=accept chain=forward comment="Access Internet From LAN" \ in-interface-list=LAN out-interface-list=WAN add action=accept chain=forward comment="Access Internet From LAN2" \ in-interface-list=LAN2 out-interface-list=WAN add action=accept chain=forward comment=VPN dst-address-list=Local-LAN \ src-address-list=VPN add action=accept chain=forward dst-port=25 protocol=tcp src-address-list=\ BarracudaIP-SMTP add action=accept chain=forward dst-port=25 out-interface=WAN protocol=tcp add action=accept chain=forward comment="allow dst-nat from both WAN and LAN (including port forwarding)" connection-nat-state=dstnat add action=drop chain=forward comment="drop all else" Thanks!

[@hotforex4435]

how we can block andriod app