2

As the title says I need to block all the connection to mikrotik router from outside except connection to VPN server. Then allow Remote desktop to LAN's system over VPN(either L2TP/IPSec or PPTP) from outside LAN.

What would be the rule in Mikrotik router's Firewall to block all the connection except rdp over vpn?

Addition info:

There is LAN setup in our office and the final gateway is Mikrotik router. I know how to create VPN server, VPN client in clients system and make rdp from clients system. I want that external firewall should only let in connections to VPN server vpn firewall rdp mikrotik

5

PPTP uses

  • TCP port 1723
  • GRE (protocol ID 47) for tunneling

Accept PPTP in Mikrotik:

/ip firewall filter add chain=input action=accept protocol=tcp dst-port=1723
/ip firewall filter add chain=input action=accept protocol=gre

L2TP/IPSec uses

  • TCP port 1701
  • UDP port 500 for Security Association (SA) - to negotiate security method (password, certificate, kerberos)
  • AH (Protocol ID 50) - Authentication Header
  • ESP (Protocol ID 51) - Encapsulated Secure Payload

Accept L2TP/IPSec in Mikrotik:

/ip firewall filter add chain=input action=accept protocol=tcp dst-port=1701
/ip firewall filter add chain=input action=accept protocol=udp dst-port=500
/ip firewall filter add chain=input action=accept protocol=ipsec-ah
/ip firewall filter add chain=input action=accept protocol=ipsec-esp

Block all other incoming connection (TCP)

/ip firewall filter add chain=input protocol=tcp action=reject reject-with=tcp-reset

You can use action=drop instead of reject, but according to Hannes Schmidt, NMAP can still see the port is open but dropped (filtered) by firewall

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.