Winbox WAN access problem

erdemefe · Thu Apr 04, 2024 3:54 pm

Hello everybody.

Altough i added a filter rule for allowing 8291 port, This rule located before drop all !LAN rule. My connecting requests are dropping by "defconf: drop all not coming from LAN" rule. when i enable log this rule i'm getting this log.

Why my rule does'nt work?

how my rule "Winbox izin"

input: in:ttnet_fiber out:(unknown 0), connection-state:new proto TCP (SYN), 85.105.77.7:58501->85.100.253.83:8291, len 52

my internet interface is PPPOE and it is added to WAN interface list.

/interface vlan
add interface=ether1 name=vlan_35 vlan-id=35

/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN

/interface list member
add comment=defconf interface=bridge list=LAN
add interface=ttnet_fiber list=WAN

/interface pppoe-client
add add-default-route=yes disabled=no interface=vlan_35 max-mtu=1500 name=ttnet_fiber use-peer-dns=yes user=username

/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid log-prefix=def_drop
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="WinBox izin" connection-nat-state="" connection-state=new connection-type="" dst-port=8291 in-interface-list=WAN log=yes log-prefix=winbox_drop protocol=tcp tcp-flags=""
add action=accept chain=input comment="NAS SSH" disabled=yes dst-port=8022 in-interface-list=WAN protocol=tcp
add action=accept chain=input comment="Gitea SSH" dst-port=22 in-interface-list=WAN protocol=tcp
add action=accept chain=input comment="OpenVpn Server " dst-port=11949 in-interface-list=WAN protocol=tcp
add action=accept chain=input comment="OpenVpn LAN" src-address=10.15.15.0/24
add action=accept chain=input comment=Nginx dst-port=80,443 in-interface-list=WAN protocol=tcp
add action=accept chain=input comment=Mosquitto dst-port=1883 in-interface-list=WAN protocol=tcp
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN log=yes
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN

llamajaja · Thu Apr 04, 2024 4:01 pm

Wrong approach.
One should not open up winbox to the www.
Instead VPN to he router and then access the config via winbox. Wireguard is a decent option.

erdemefe · Thu Apr 04, 2024 4:07 pm

I know the security risks so I’m using ovpn to accessing. But sometimes I need to access via without vpn because make config about vpn.

It will be disabled in general using

johnson73 · Thu Apr 04, 2024 4:19 pm

We always try to use an address list to define access. This will make it easier to define access.
If access to Winbox is needed from the outside, we define the port and use the address-list, which contains the allowed addresses.
This is of course not a good practice because the good practice is to use a vpn connection.

/ip firewall address-list
add address=192.168.88.0/24 list=MY-Local-LAN
add address=2.3.4.5 list=outside-adr
/ip firewall filter	
add action=accept chain=input comment=work-IP dst-port=8291 protocol=tcp src-address-list=outside-adr

erdemefe · Thu Apr 04, 2024 4:32 pm

Thanks for answering.

It will probably fix the connection problem but I don’t have static ip I’m using ddns so I will not fill the ip area so I selected WAN interface as input.

I don’t understand why my rule doesn’t work. It says that accept all 8291 request comes from WAN. In my case my input comes from WAN. So it should work

johnson73 · Thu Apr 04, 2024 4:37 pm

Look carefully at your 8291 roll record. It's not really correct. If you write like this, it doesn't work either?

add action=accept chain=input dst-port=8291 protocol=tcp in-interface-list=WAN

llamajaja · Thu Apr 04, 2024 4:49 pm

I dont see an issue with the rule myself? I think the extras showing are simply the defaults and not stuff he is added,,,,,,,, but not sure.

However, you have a mixed bag of crap,
Unsafe winbox access, two different access to openvpn?? and SSH which is not the most secure access.

Simply and get better security and replace all of that with wireguard.

Winbox WAN access problem

Winbox WAN access problem

Re: Winbox WAN access problem

Re: Winbox WAN access problem

Re: Winbox WAN access problem

Re: Winbox WAN access problem

Re: Winbox WAN access problem

Re: Winbox WAN access problem

Who is online