[admin@sea-rou-001] > /ip/address/print Flags: D - DYNAMIC Columns: ADDRESS, NETWORK, INTERFACE # ADDRESS NETWORK INTERFACE 0 192.168.1.1/24 192.168.1.0 ether2 1 192.168.2.1/24 192.168.2.0 ether3 2 D HIDDEN_PUBLIC_IP HIDDEN_PUBLIC_IP ether1 [admin@sea-rou-001] > /ip/firewall/filter/print Flags: X - disabled, I - invalid; D - dynamic 0 D ;;; special dummy rule to show fasttrack counters chain=forward action=passthrough 1 ;;; Necessary for the router to get ntp and upgrades. chain=input action=accept connection-state=established,related connection-mark="" log=no log-prefix="" 2 chain=forward action=accept protocol=tcp src-address=192.168.1.5 dst-address=192.168.2.2 in-interface=ether3 out-interface=ether2 dst-port=22 3 ;;; block all traffic from LAN to guest network chain=forward action=drop in-interface=ether3 out-interface=ether2 log=yes log-prefix="firewall" 4 ;;; block all traffic from guest to LAN network chain=forward action=drop in-interface=ether2 out-interface=ether3 log=yes log-prefix="firewall" 5 ;;; block all traffic from the internet to ether1 chain=input action=drop in-interface=ether1 log=no log-prefix=""

add action=accept chain=forward comment="defconf: accept established,related, untracked" \ connection-state=established,related,untracked

Flags: X - disabled, I - invalid; D - dynamic 0 D ;;; special dummy rule to show fasttrack counters chain=forward action=passthrough 1 ;;; Drop Invalid connections chain=input action=drop connection-state=invalid 2 ;;; Allow Established/Related/Untracked connections chain=input action=accept connection-state=established,related,untracked 3 ;;; Necessary for the router to get ntp and upgrades. chain=input action=accept connection-state=established,related connection-mark="" log=no log-prefix="" 4 X chain=forward action=accept connection-state=established,related protocol=tcp src-address=192.168.1.5 dst-address=192.168.2.2 in-interface=ether3 out-interface=ether2 dst-port=22 5 ;;; block all traffic from LAN to guest network chain=forward action=drop in-interface=ether3 out-interface=ether2 log=yes log-prefix="firewall" 6 ;;; block all traffic from guest to LAN network chain=forward action=drop in-interface=ether2 out-interface=ether3 log=yes log-prefix="firewall" 7 ;;; block all traffic from the internet to ether1 chain=input action=drop in-interface=ether1 log=no log-prefix=""

DSL modem -> sea-rou-001 (config below) ether1 interface sea-rou-001 ether2 -> connected to dumb switch network=192.168.1.0/24 "LAN" with desktops etc. sea-rou-001 ether3 -> connected to dumb switch network=192.168.2.0/24 guest wifi

# 5 / 20/2023 22:02:43 Roul雷竞技terOS 7.9 #软件雷电竞app下载官方版苹果id = XXXX-XXXX # # model = CCR2004-16G-2S+ # serial number = XXXXXXXX /interface ethernet set [ find default-name=ether1 ] mac-address=00:0C:42:XX:XX:XX /interface list add name=WAN /interface list add name=LAN /interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik /ip dhcp-server add interface=ether2 lease-time=1h name=dhcp-server /ip dhcp-server option add code=17 name=ripley-root-path value="'192.168.1.201:/vol/vol1/diskless/root/ripley'" /ip dhcp-server option add code=67 name=ripley-boot-filename value="'ripley/pxelinux.0'" /ip dhcp-server option add code=66 name=tftp-server-name value="'192.168.1.201'" /ip dhcp-server option sets add name=ripley options=ripley-boot-filename,ripley-root-path,tftp-server-name /port set 0 name=serial0 /port set 1 name=serial1 /system logging action set 3 remote=192.168.1.5 /interface list member add interface=ether1 list=WAN /interface list member add list=LAN /ip address add address=192.168.1.1/24 interface=ether2 network=192.168.1.0 /ip address add address=192.168.2.1/24 interface=ether3 network=192.168.2.0 /ip dhcp-client add interface=ether1 /ip dhcp-server lease add address=192.168.1.4 comment=ripley dhcp-option-set=ripley mac-address=FC:4D:D4:XX:XX:XX server=dhcp-server /ip dhcp-server network add address=192.168.1.0/24 dns-server=1.1.1.1 domain=XXX.com gateway=192.168.1.1 netmask=32 next-server=192.168.1.201 /ip dns set allow-remote-requests=yes cache-max-ttl=1d servers=192.168.1.1 /ip firewall filter add action=drop chain=input comment="Drop Invalid connections" connection-state=invalid /ip firewall filter add action=accept chain=input comment="Allow Established/Related/Untracked connections" connection-state=established,related,untracked /ip firewall filter add action=accept chain=input comment="Necessary for the router to get ntp and upgrades." connection-mark="" connection-state=established,related /ip firewall filter add action=accept chain=forward disabled=yes dst-address=192.168.2.2 dst-port=22 in-interface=ether2 out-interface=ether3 protocol=tcp src-address=192.168.1.5 /ip firewall filter add action=accept chain=forward disabled=yes dst-address=192.168.1.5 in-interface=ether3 out-interface=ether2 protocol=tcp src-address=192.168.2.2 src-port=22 /ip firewall filter add action=drop chain=forward comment="block all traffic from LAN to guest network" in-interface=ether3 log=yes log-prefix=firewall out-interface=ether2 /ip firewall filter add action=drop chain=forward comment="block all traffic from guest to LAN network" in-interface=ether2 log=yes log-prefix=firewall out-interface=ether3 /ip firewall filter add action=drop chain=input comment="block all traffic from the internet to ether1" in-interface=ether1 /ip firewall nat add action=dst-nat chain=dstnat dst-port=8090 in-interface=ether1 protocol=tcp src-address=XX.XX.XX.XX to-addresses=192.168.1.XXX to-ports=XXXX /ip firewall nat add action=masquerade chain=srcnat out-interface=ether1 out-interface-list=WAN /system clock set time-zone-name=America/Los_Angeles /system identity set name=sea-rou-001 /system logging set 0 action=remote /system logging set 1 action=remote /system logging set 2 action=remote /system logging set 3 action=remote /system note set show-at-login=no /system ntp client set enabled=yes /system ntp client servers add address=time.nist.gov