1

I have a 750Gl that I have a webserver behind. Its address is 10.30.1.70/24.

I had a problem with it getting hacked. After rebuilding it and hopefully fixing my vulnerabilities, I want to go a little further by denying any possible outgoing viruses that might get through in the future. The easiest way I can figure out is to close all outgoing ports except 53 & 80.

I want to allow my webserver to get updates, so I need to allow outgoing port 80 & 53. My webserver is also on port 80.

I have tried a few different ways, but I cannot make anything work properly. I have tried the configs below. The first works great to block everything outgoing except port 80 & 53. But using it seems to nullify my port forward to the same server on port 80. How can I get this to work?

/ip firewall filter
add chain=forward action=accept src-address=10.30.1.0/24 protocol=tcp dst-port=53
add chain=forward action=accept dst-address=10.30.1.0/24 protocol=tcp src-port=53
add chain=forward action=accept src-address=10.30.1.0/24 protocol=udp dst-port=53
add chain=forward action=accept dst-address=10.30.1.0/24 protocol=udp src-port=53
add chain=forward action=accept src-address=10.30.1.0/24 protocol=tcp dst-port=80
add chain=forward action=accept dst-address=10.30.1.0/24 protocol=tcp src-port=80
add chain=forward action=drop

With a forward like this:

/ip firewall nat
add action=dst-nat chain=dstnat comment="Access to Webserver NAT Rule" disabled=no \
dst-port=80 protocol=tcp to-addresses=10.30.1.70 to-ports=80
Improve this question

1 Answer 1

Reset to default
0

The problem with what you are proposing is that connections TO the webserver come from random, high ports, not 80. So with that in place it would not be able to serve webpages. So you are doing exactly what you need to do what you're attempting, but what you are attempting to do is fundamentally flawed.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .